{"report_id":"c8d65e23-100f-4358-b616-23e95e48a02d","version":6,"status":"done","tags":[],"date":"2025-12-07T19:05:29Z","url":{"schema":"https","addr":"usecorns.live/","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"104.21.23.2","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"usecorns.live/","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"title":"Corn","dom":{"size":344,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (344), with no line terminators","md5":"9498ac86c5c7645679505ab93b8fb63a","sha1":"ceb91035d2a515ce187723f6b0602dedfc512938","sha256":"3d9092a3182eb5537151513571ccd4af4bcfe01881eb339b2c850a7431743ff6","sha512":"3ee1c30a98d120187fc876a02d1c83b70487ed5b7cfe1973cab6350eb5748da6e65152d72ed1bbd2565fadeb8a72d36810e8c6c171839d448aa3fc5f9616c412","ssdeep":"","tlshash":"c0e026ee1c7ac83865e4128620b5e29c5e2061a0bf11e64452d9dc7b9e20fe74c92a4c","dom_hash":"domhashfa92bf49a0529f3ae8099507699ba65b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"usecorns.live/","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"104.21.23.2","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-11T19:05:29Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13","referer":"www.bing.com","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"corsproxy.io","ip":{"addr":"104.26.7.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2022-01-30","domain_rank":175528,"first_seen":"2016-05-19T01:27:08Z","last_seen":"2025-12-04T00:08:27.923958Z","alert_count":0,"request_count":2,"received_data":2880,"sent_data":1171,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"2025-10-12","domain_rank":0,"first_seen":"2025-11-03T13:57:07.007765Z","last_seen":"2025-12-01T17:09:55.299754Z","alert_count":3,"request_count":1,"received_data":949,"sent_data":590,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.74.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2025-11-30T22:14:19.793229Z","alert_count":0,"request_count":1,"received_data":13066,"sent_data":571,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"usecorns.live","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":25,"request_count":25,"received_data":4464663,"sent_data":14225,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2025-11-30T22:13:37.547558Z","alert_count":0,"request_count":3,"received_data":74585,"sent_data":1772,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"usecorns.live/","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f5b767c078c6813816231552aca1d562","sha1":"34f99579b527c24b3a5af82abb42079a0d3e1a51","sha256":"c17d50bae5a02a35e0ae5d0005c694495952f093629bb5193c668070161b0f7a","sha512":"7b4aed1d33c4891894a556505047a8f7afd72efc1c30c064b5a428fac50a5475e895f3937869de6d047128910d762069084c41d12fbacecffd43cd98e84b2e48","ssdeep":"","tlshash":"70c0125d7010696614ce687d4ccf088ebe368812a20809c999dcd4547bb1e6c42e484c","size":185,"data":"","first_seen":"2024-04-08T19:47:46Z","last_seen":"2026-07-22T10:27:05.32214Z","times_seen":702,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/ant-input-5.1.0.min.js","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8efc73123dcfe306663777d9feaa456a","sha1":"23acc79e943e6477857d71d232d79bf2a653f0b0","sha256":"23e34cebed1b892fce0d343cb2e51a2e847fb338e92b5836836f48971d2dbd4e","sha512":"6fd8a66444c291f57d2828aa0e1ad0b160d2deac5be5264a52a7aec8310abf613e250fa2d3815a1db88663c14a5e76f3d8573069497b8ee08b98116c6ae543b9","ssdeep":"3072:Vlse1BD1UtsUc/U2UqsUl/U1NPQr+SIu/mdBIjf3BcyRoG2EueK:X97B/4MSSy0jf3Bcy2UK","tlshash":"e5f30915cf09fcff9272c4e640fb320a9e52b450a069883ac76bf5c45366f62ad53a74","size":163446,"data":"","first_seen":"2025-12-07T19:05:36.429458Z","last_seen":"2025-12-07T19:05:36.429458Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/istanbul.dark.js","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7799b460d4f99f3f141860fff7c9fc8b","sha1":"5c92514ef1610b09cef888e3f0aa2f2dac882ed4","sha256":"ac7b7126fc77d204d1e0122b4846b4fa8bcc0a512a6f18ef3bc8e7efdc5c0565","sha512":"85f47fe46fc25274b8b0639dddb5ca11b2e6868abe369eef9bd13c224c5bb5bc865d0f43827ae3b4cb381420ad8af9f90218a6628818d7f090be6bf8c9c4d436","ssdeep":"3072:L5DxYxHS+hP2trWTLGsGyY2ayQ5KsmKHXkw+cSHIRT7P/fE60zZMNKwbcqgK23q9:L5D2F+6OyayQ5KvcoIFcqcqlr7","tlshash":"2e9440dc9e8a17ed8e3381a629561c48f4b428d4476d3e84fbd5d6b6ec0452323fe2c9","size":419162,"data":"","first_seen":"2025-12-07T19:05:36.442306Z","last_seen":"2025-12-07T19:05:36.442306Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"310afe0e8fdeffbc48db74aa0668dbd0","sha1":"98e12fb2ccfa5eb1ffa3fce6c5b6cda1b945c78c","sha256":"b77af0dd15066955f02737c6ee7832b498ca101edd8c0447289e2aed4e8cf14e","sha512":"ca1b927308e3fccdee799beebbe36096cab3d50accd1036fb0f8f7a52a8703ce93856432c9b2f914c92117d2b13ab70538d72903f3f6b9ecefd4f835e07667ba","ssdeep":"3072:t+148zxMafGCv/6141hssGCYEayQ5KkmKLX+wSA6DetTH5/fE60zZMNKkJcYg22b:ta42lfW6gwayQ5KNAie/cY8qlrK","tlshash":"489431ecde8a17ec8e3381a629561d48f8b428d4436d3e94fbd5d6b5ac0416323fe1c9","size":413724,"data":"","first_seen":"2025-12-07T19:05:36.444605Z","last_seen":"2025-12-07T19:05:36.444605Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"895f526ab37305311d1e998fa4d5a6e8","sha1":"06d0220830c81bf254c70552e908371c6dc1f18f","sha256":"90916b8b1fb2fbbd765a22eba866c30d8829f59aa2d7ee86869abd20207b2117","sha512":"6b087d2e2025f4d11073254448b124af8839ce24ff37eb45bf2fd1a2b66bee8fd4fdca2b4d23c08786d217dd71dbc660d1054b7876b37752dee3baaefdaeaa4e","ssdeep":"","tlshash":"2871bc3beb00173bdc8fa9fdced5b4c02e62497262496960691ce102a16cd7487bed88","size":3743,"data":"","first_seen":"2025-08-14T22:47:51.287187Z","last_seen":"2026-07-18T23:39:45.242722Z","times_seen":1363,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"bedf363bc18e1657dc2e5d94ad055c4e","sha1":"35006d49293e2cc5298350c5ba7a2d6b0b26a7e3","sha256":"d4789d088246db0cb0dd0e547d91ac31147b267ce235317bf75da654b2ab47af","sha512":"e3355340558cd883b4b9e01d748f8a8a1a0d6491840a912ef86538a03f4996b54a86c631a6dbec1fae8ad0dfc62e9f94b48542bf3e7167ebc60013b8c964b927","ssdeep":"","tlshash":"1321987866711410beaf744707ee1b3c20aef303a316c29c386e4a981fd8814954fee8","size":1198,"data":"","first_seen":"2025-12-07T19:05:36.447244Z","last_seen":"2025-12-07T19:05:36.447244Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eval","is_inline":false,"md5":"8e6a7541baee4b9d6a7da8be1a379e97","sha1":"9ecb9ae1c33861992025b761893a1e4bba633db5","sha256":"583f2ea7b9dd027dcefb9a07237df9fd6c30d07e0df15ce14a6f92f83c3e16ea","sha512":"7217e3ba88443c668ea4f7bab50b329eb31cc8603c331ba22a628d888c5d4b62dfc006be6196cf6ab3418a35cf76acca3eb7cd68b8b002017c35b4638d026c34","ssdeep":"768:DCF355hmEtFKs/CfcF7LfYHebj0U0hgpzibbepvxF:DCFfMsrH0X+x","tlshash":"be53a9764909603f4f722d9073e3a27b24257d68acdb94a5c38fd8d4edafeb48035612","size":60871,"data":"","first_seen":"2025-12-07T19:05:36.448251Z","last_seen":"2025-12-07T19:05:36.448251Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"be14fb9c2e901685e229492df5d0dfdc","sha1":"56d78ee6ce22d0888ea3457562317210e94e4878","sha256":"ff475f4ef98a256424f6b124e7e4d15e61f2854465f6008ab8e2472570b82826","sha512":"a2b48da8d1fbdd16df556b4835a98b14c970fd6b050a6a1f8c486a3edd8354c302d8e15778a9bf03e5c8f002010a66c5a7cbb21174f175374ae7bdb0afd85393","ssdeep":"","tlshash":"8411c0793a2a5534c6c5918b317ee7a93e3260617f02a084c26ccc295d28e9714efdbe","size":902,"data":"","first_seen":"2025-12-07T19:05:36.449472Z","last_seen":"2025-12-07T19:05:36.449472Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"c61e41141433939cc4bb95253ec98b89","sha1":"6dc235781dc779e8b7c973c367ba41e78c5be486","sha256":"7487ddfd42848d7a988deaf57b2e7f46aaffcb8820d5f89e6ff0d354db8f409d","sha512":"f5406e56a3ff671a8a3cf9e53597ec58b8c036e698d6eb804e2e403578c72a0a791c62d5d16ae1ef6f4f9b018870b1582f306cd95fddf0548e0b6e3d36e1a5d7","ssdeep":"","tlshash":"bfd023ae1c79c53452d901463075d3e46f613050bf11a14091cdcc6f6e31fd305b1a5c","size":217,"data":"","first_seen":"2025-12-07T19:05:36.450572Z","last_seen":"2025-12-07T19:05:36.450572Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"0f528a174e91e3871252523879146bb7","sha1":"09925b442b819bdc05d3c119ff93f95b7104fb5a","sha256":"4e9d3e507f19250fe7d4380061090433e8e9cabbe3bd8bb4944ce1bbda8363ed","sha512":"b6ae5b6579fd97ba532d69615e5c69b4c33413ceeba889db0cee760f27b1bbc9c40d80d86487f49428d91ccb068cbfa658ad396dd534d94d86693d2d120c491a","ssdeep":"192:lZlYDtHKrHGccVDIb4xTok4Hz32pkqMrwdyZB15sTkASDG:dYDtqzGr9IbuEk4Hz322qMrwdyMTkAx","tlshash":"92221b8f7d0db162e5385464983f38fb12347f9540886d039305ea997d6638abceae4d","size":10318,"data":"","first_seen":"2025-12-07T19:05:36.425084Z","last_seen":"2025-12-07T19:05:36.425084Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"usecorns.live/secureproxy?e=ping_proxy","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:06.912Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /secureproxy?e=ping_proxy HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://usecorns.live/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:07 GMT\r\ncontent-type: text/html; charset=utf-8\r\nserver: cloudflare\r\ncast-mode: default\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nlast-modified: Sun, 07 Dec 2025 19:05:07 GMT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rtHIRC0ivswlxuMfTfhC%2FQvDmzcQH01GxUeGliTccA%2BDtgxrCy40dYGizUQlMNFO3MHvHsyJuorrJ1Vf%2Bx7b7uK368LZN9dBE%2FCV\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9aa64aea388c568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"6fdb087aa3fbfbcb8287a593a0919e61","sha1":"0e514a0662bcb69dc863953d1ce26e3d40e81a87","sha256":"9795c5ff8937f23526ccb207a5684c1fc94a7854e19c021b39d944e51f5baef2","sha512":"be5457d14c930b51b47ab152850c1ceaafe6ef88c8671b48164abbc83410b0c07a1e178540f6cdeac5f2672cadb1d1cbbb3434b3e39bc2c50c4646a2bae57437","ssdeep":"","tlshash":"fe300000300000000000000c0000000000000000000000000000000000300000000000","first_seen":"2023-04-12T09:14:15Z","last_seen":"2026-07-22T21:02:33.498872Z","times_seen":8948,"resource_available":true,"data":null}},"time_used":219,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":219,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/b9d84774-c679-4375-9fce-594e5ec62c27.png","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:06.982Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /b9d84774-c679-4375-9fce-594e5ec62c27.png HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:07 GMT\r\ncontent-type: image/png\r\ncontent-length: 1167628\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"11d10c-19ae6074d0c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XuSAXnKu4ajIJ4QkXe92%2FT6bwaE4ZF%2B0L16daicZXKXOIcY7%2B5rPvplMU%2Beewo%2BL4VKp44BGljkdH0rRQuSF%2B%2ByVkSekZ3OyTvS9\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9aa64aeaa903568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":1167628,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2160 x 1350, 8-bit/color RGBA, non-interlaced","md5":"78ef8f25d6cab6406b025062d1a35019","sha1":"3b0623606ac74c0bd804d5926cd3c7119a59e998","sha256":"81dd32f885ccfbddcd289ab4755ad81b72353bc2eccf770d932c84dbabc37aa7","sha512":"1b82d8ae3ea24bd3bfd85b484b9fd5068eb4b260903f36a7ea7e8398267d2b22730671eaedccee555b6d9eb9646e7a82428b10e5b0ca755a455ec8e1b1fcc6c5","ssdeep":"24576:zn6+8PBfufaDj9Y51X/Alqz92ZehPz4XQjgyxBiq5FEmClDkZqW:zn6+Ylj9kXl4Ehr4WfMaD","tlshash":"292533b2cb249546d62871fe1ec5edd51d2d18ea75a8a9782bfbca230333f9dc113640","first_seen":"2025-12-07T19:05:36.402338Z","last_seen":"2025-12-07T19:05:36.402338Z","times_seen":1,"resource_available":false,"data":null}},"time_used":698,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":333,"receive":365,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:07.065Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 Found\r\ndate: Sun, 07 Dec 2025 19:05:07 GMT\r\ncontent-length: 0\r\ncf-ray: 9aa64aeb29be568d-OSL\r\nlocation: /cdn-cgi/challenge-platform/h/g/scripts/jsd/5eaf848a0845/main.js?\r\ncache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public\r\naccess-control-allow-origin: *\r\npriority: u=3,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=30vbQ8NfN5IRAimi%2F3ixCMlg0k0onaAgzkRPxMiuIo0K1X6jvd2oT2xXRutSHG6bRxT2VzqBGZn8GHC5vapN7Hex7LPEdiQhVBnev04jAT4s2oyMLa3uk88p7vrNGlub\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=1100\u0026min_rtt=751\u0026rtt_var=110\u0026sent=463\u0026recv=68\u0026lost=0\u0026retrans=0\u0026sent_bytes=516793\u0026recv_bytes=8468\u0026delivery_rate=20268710\u0026cwnd=30000\u0026unsent_bytes=0\u0026cid=77379a3c0ec7a346\u0026ts=1428\u0026x=1\", cfExtPri, cfHdrFlush;dur=0\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10318,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T01:50:58.104205Z","times_seen":17490279,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Farg.basic.umd.js%3Ft%3D29418905%26u%3DXQZb1c2NOiVpG614GDY5MjZkZjgwZTZhZDExYWUwYWQxMmFlMFxKbWRlJZ6R1VPM9w","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:07.397Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /secureproxy?s=%2F%40v1%2Fcdn%2Fjs%2Farg.basic.umd.js%3Ft%3D29418905%26u%3DXQZb1c2NOiVpG614GDY5MjZkZjgwZTZhZDExYWUwYWQxMmFlMFxKbWRlJZ6R1VPM9w HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nCookie: cf_clearance=_xy_M2b3nlctRh8LvibxxyQLpMjTfJUvKqkLFN2IND8-1765134307-1.2.1.1-p72Xpd.DEmvwHzne0uPAfXoUxRmRXQyMhMLD6moGgDgrRVZsgMLxZDhzZMyoS_z6w3G49V6IEMEK3kkiI9oqX1tJ9CxNfadqo7iY7SW8t6kAE5XU_PQM42qs3S31lyN_3QRjpgB8vgtGn1Af_Dqrr7phe2U4lyWboWD8rXFj3RsT3WVXHgvRk_O3AfYauXb7PBLKFDyHKfy2PwLBAqztRZ4mbPkT8.0oxZTg3qRj.c4\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 523 No Reason Phrase\r\ndate: Sun, 07 Dec 2025 19:05:09 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 7177\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncf-ray: 9aa64aed3ca9568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"523","status_text":"No Reason Phrase","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7177,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (555)","md5":"53b0328a9985d0e9dd3d12d032c3704e","sha1":"ba1c80446a7877a7c128dfd1c39f3c9a73139d59","sha256":"af368ec364f52b49f6fd8da36fc743aa0e7a3c64ec0022b35681801d8aecacb4","sha512":"c7c8903defea44fc27269d4c7c9c8c68cd82f66cc168b680ead6be0650fef15184bf46254e385c90072946cf9ae8b731a9c63db69f00ef5998fb34ee1071aee7","ssdeep":"96:1j9jwIjYjGDK/D9KUaGG4Fh8/G4FQg424FP+skKmomH1XnMSt7RLleaQxP:1j9jhjYjiK/BWGeWdVL2jt71l5eP","tlshash":"e8e17676b5f51277009382923195fb5abae0c213cbef4598b3dcc2632f9ee81d903294","first_seen":"2025-12-07T19:05:36.406131Z","last_seen":"2025-12-07T19:05:36.406131Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2418,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":2418,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/66cec95d-19c2-4acb-8e8e-1c37a630c4a6.png","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:08.103Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /66cec95d-19c2-4acb-8e8e-1c37a630c4a6.png HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nCookie: cf_clearance=_xy_M2b3nlctRh8LvibxxyQLpMjTfJUvKqkLFN2IND8-1765134307-1.2.1.1-p72Xpd.DEmvwHzne0uPAfXoUxRmRXQyMhMLD6moGgDgrRVZsgMLxZDhzZMyoS_z6w3G49V6IEMEK3kkiI9oqX1tJ9CxNfadqo7iY7SW8t6kAE5XU_PQM42qs3S31lyN_3QRjpgB8vgtGn1Af_Dqrr7phe2U4lyWboWD8rXFj3RsT3WVXHgvRk_O3AfYauXb7PBLKFDyHKfy2PwLBAqztRZ4mbPkT8.0oxZTg3qRj.c4\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 3476\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"d94-19ae6074d00\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HfeVyQPwcqdsafeExDMZBkACH7t2kEUAAdmftl8wNA7QJkuVWOpW%2Fo6ZBwDeoLL9QUsZUJKMl9JCuuo9hqhnuclAR6p3BrE8mmxm\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9aa64af1a95c568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3476,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced","md5":"bf585eba9251e1182db9cc49b144edfa","sha1":"8b67f50e91d987d821fbaae709677267cfa256a8","sha256":"2c7e60943477704cc4d6ad7635736c31be2415569b53ad6a88150eaced86dd20","sha512":"3d3cca1b1fd1503744b440c8b48f7a38bfd4f6dd026f7b6973aa761f4f611fdd09f2d57508f32367b95501ea541221128b70186be7607a948aa68a34df1a34be","ssdeep":"","tlshash":"c8716c8a8dc0fc97688c28ac0287ec60327fb79af055d335222029fa089608d53029d5","first_seen":"2025-12-07T19:05:36.408471Z","last_seen":"2026-04-09T12:44:20.860311Z","times_seen":2,"resource_available":false,"data":null}},"time_used":280,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":280,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/uicons-brands-XJPKRNBN.woff2","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:07.012Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /uicons-brands-XJPKRNBN.woff2 HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/all.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:07 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 37144\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"9118-19ae6074d10\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gYlC9ZFrO8kjd1LUx1ijVG446%2Fa6lG4z%2FCF05iPnvmuoE3y6s5SYtflFOsDC%2B0lqIg2osz3jvGp%2FMtHcEtMHu40wtVggwZkdZVsQ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9aa64aead94e568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":37144,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37144, version 1.0","md5":"6161f5491d9d0c0daac49eb1bbaa041d","sha1":"c1ec10773d2e5a617d5581a26ad4b65436ca85c4","sha256":"56ed19e76b19b70ef4eea83f63b7ef91c4e46ed5977973995a8227e5b9197d15","sha512":"114d496eb7d49a763b687659f234d235c2ac952628727fbaddb9572623cc487125354cd9d607487a4aade0135e10b5375eba1997749985f1b19ab89950550950","ssdeep":"768:lG7MFZITQ8eZV6M+xF+rxiUyvPsUxgLkcesFoMy3Pb5UOP/FUHZZN:lG4ZoQ8nPiiUuRRPtUY/Fo7N","tlshash":"1bf2f19fbb0d169ed2604a36b3134cccb274d7ce64ee443db590468b98f524939f22d9","first_seen":"2024-12-25T01:37:08.303524Z","last_seen":"2026-07-18T17:18:47.242123Z","times_seen":149,"resource_available":false,"data":null}},"time_used":345,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":293,"receive":52,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/secureproxy.php?e=jscdn/getFile","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:19.514Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"POST /secureproxy.php?e=jscdn/getFile HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://usecorns.live/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://usecorns.live\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: cf_clearance=_xy_M2b3nlctRh8LvibxxyQLpMjTfJUvKqkLFN2IND8-1765134307-1.2.1.1-p72Xpd.DEmvwHzne0uPAfXoUxRmRXQyMhMLD6moGgDgrRVZsgMLxZDhzZMyoS_z6w3G49V6IEMEK3kkiI9oqX1tJ9CxNfadqo7iY7SW8t6kAE5XU_PQM42qs3S31lyN_3QRjpgB8vgtGn1Af_Dqrr7phe2U4lyWboWD8rXFj3RsT3WVXHgvRk_O3AfYauXb7PBLKFDyHKfy2PwLBAqztRZ4mbPkT8.0oxZTg3qRj.c4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"cnr1ww7x1y7w44r9j0xj\"}"}},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Sun, 07 Dec 2025 19:05:19 GMT\r\ncontent-type: text/html; charset=utf-8\r\nserver: cloudflare\r\ncast-mode: default\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncontent-security-policy: default-src 'none'\r\nx-content-type-options: nosniff, nosniff\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BaJy%2FnNg%2FAXUedU80LY3nRcmPS9bKNfc0BcP%2BbeLEBhgVyyZUDa7lzu6H6J8XLKHZKZD%2F0Jdii144%2FHLzLgXtjiB%2FuQOelgbl8is\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9aa64b38f860568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"1473e0fbeabc0536900184482e5d7208","sha1":"2ce769b93b1bde1292be3652c0be40932c333799","sha256":"43e8a4807c2054a6e8518c19131cdbde7f69242707b4564df707dee30065eb5c","sha512":"b6fd2c422f5a8a4cd7c9f3c5c136ca70a36cf3a8152aea5fd08a9d1f282fc0bc667b850bcc4b56c8cd6b91e907578f5eb6d1c9e93394c2d21b0398174267f658","ssdeep":"","tlshash":"c9c08cea20000201893096047ac222a824977b8a20e28a44ab82e027ecd461ac886188","first_seen":"2025-11-26T01:11:55.349732Z","last_seen":"2026-06-28T17:04:49.020897Z","times_seen":43,"resource_available":false,"data":null}},"time_used":169,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":169,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/css2.css","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:05.886Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /css2.css HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:06 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"4f4-19ae6074d30\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q0hlgV%2FNF4L4OGOqOg5gqfCtcUAa15Uw6Ep3NWDr%2FyJpVYDj3UwPyP0l8ztl4gJIeks72qr3QOBaXreYhW2IzMf9Tr1CCts%2BlD%2FZ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9aa64ae3b8bb568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1268,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"c171a6b913393000a06f7013e0e8bf76","sha1":"08667a4ae9fe7ff7a19507ddea5addf2538589eb","sha256":"66cc6699c0afd47427e99d6f1c0af9e6187fec3ff7a4711a0c10bb29d292a98f","sha512":"108630610cf30d7593350690ecf7422748c2d8e3935baf01da6d0ecf0b05afa64943201adb489bc384964d0edb350db0efc67db6992689a6b2d01e1dbf56e712","ssdeep":"","tlshash":"8c213b410c39a604e3a32dd151cd7a36de0ef1446445ad24affa14d4fd41d566393b1d","first_seen":"2025-12-07T19:05:36.414346Z","last_seen":"2025-12-07T19:05:36.414346Z","times_seen":1,"resource_available":false,"data":null}},"time_used":314,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":314,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/8b54669db085020c.css","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:05.891Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /8b54669db085020c.css HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:06 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"5622-19ae6074cfc\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e5X67JqggwTusKX8fmPJQcH5hm%2B6M3N8ZOaepQ%2BtZSzn1A44cbitkPpGjk8VGAofmi4CSWrQBowYv5%2FybuAVj5qwj8anx7x1SCoQ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9aa64ae3b8be568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22050,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (21927)","md5":"14248cb55bdd81b8d3fdebc7106a797c","sha1":"c60f6f5ffd17b1ec97f50a874c5d4fd9d33ec28c","sha256":"df414592533f311eaa363c0f470250d699b6de95e0f3723e7f8ba25a1cfe103f","sha512":"13541faf0fcb6c0337d95e330543dae41274bc9f15b32e146d682341205602b1fca53d2c84ebc319bf29ddf486a73f367fa53a2ea4039b7a94b30c11e1ae8f96","ssdeep":"384:BOGvYvbvFxDn3lXzfHHfSBz0QyxGbmSwxd6GOeiuF:QX8BzHyxGbmSwxd6GOeiuF","tlshash":"b3a2b01dfd5728bf427a643ed14512d06fcafb73f0e3529af091e58916ee0680369a2c","first_seen":"2024-10-15T15:20:07.883199Z","last_seen":"2026-07-16T11:21:52.684174Z","times_seen":54,"resource_available":false,"data":null}},"time_used":438,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":438,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/alexandria/v6/UMBXrPdDqW66y0Y2usFeai3dAw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:06.997Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 27 Oct 2025 08:35:04 GMT","end":"Mon, 19 Jan 2026 08:35:03 GMT"},"fingerprint":{"sha1":"4A:97:40:A8:11:17:BA:08:56:28:6E:0B:93:8B:64:13:1D:67:D4:2A","sha256":"A2:0A:13:FD:98:22:74:26:3F:C1:44:5C:92:27:22:17:A8:65:07:40:50:F9:14:02:11:E4:87:7F:C5:D2:F1:42"}}},"request":{"raw":"GET /s/alexandria/v6/UMBXrPdDqW66y0Y2usFeai3dAw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://usecorns.live\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30140\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 05 Dec 2025 19:49:33 GMT\r\nexpires: Sat, 05 Dec 2026 19:49:33 GMT\r\ncache-control: public, max-age=31536000\r\nage: 170134\r\nlast-modified: Thu, 04 Sep 2025 17:26:28 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":30140,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 30140, version 1.0","md5":"106e7890fb01e7ea352d64e17921207d","sha1":"a5d4f37ad7173d36184f456ce23092a2bc9ad62a","sha256":"98ccec0bc3c456332f8fd0fcaf81d26a4e010b7fc093f9781938f976df9ffbc4","sha512":"31fb6940774b40b795da3008c6d9dc00748ea02bf8b3fd121d28b064b028a765f5e35aeca6c25db3ee29ed78fcc78a1e49124557764bdb05ac084dc032c3fa20","ssdeep":"768:nHadNFJECXwMHUxzhVRKY3CBAEnitbZUfPR:HadHJdb0xVLGriFI","tlshash":"a4d2e17466fc32118bee3d3155fb26d8a0a81800e975e45ab431c51bb1fef2a14f566c","first_seen":"2025-09-06T12:26:49.789297Z","last_seen":"2026-07-22T13:46:59.848649Z","times_seen":527,"resource_available":false,"data":null}},"time_used":483,"timings":{"blocked":223,"dns":3,"connect":29,"send":0,"wait":29,"receive":10,"ssl":187},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"corsproxy.io/?https://api.mainnet-beta.solana.com","fqdn":"corsproxy.io","domain":"corsproxy.io","tld":"io"},"ip":{"addr":"104.26.7.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:09.931Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"corsproxy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 24 Nov 2025 00:28:54 GMT","end":"Sun, 22 Feb 2026 01:28:46 GMT"},"fingerprint":{"sha1":"82:A0:BD:81:8D:CE:B9:C3:62:8C:F7:C9:61:E3:C6:2D:D3:11:DD:A4","sha256":"29:40:B3:AC:CC:AB:2B:AB:6B:50:07:A6:71:D3:ED:F6:1E:43:9C:CB:DE:4A:02:CE:D8:2A:DD:8E:FC:B3:2C:ED"}}},"request":{"raw":"POST /?https://api.mainnet-beta.solana.com HTTP/1.1\r\nHost: corsproxy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://usecorns.live/\r\nContent-Type: application/json\r\nContent-Length: 130\r\nOrigin: https://usecorns.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":130,"data":"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"getAccountInfo\",\"params\":[\"8ycauMwVE61B4uWz87B2k2G8mMK7iFjRoBHooaVAcP4k\",{\"encoding\":\"base64\"}]}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:10 GMT\r\ncontent-type: application/json; charset=utf-8\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\naccess-control-allow-origin: *\r\nallow: OPTIONS, POST, GET\r\ncache-control: public, max-age=3600, s-maxage=3600\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\naccess-control-allow-credentials: false\r\nx-cache-read: skipped\r\nx-cache-status: MISS\r\nx-proxy-service: CORS Proxy\r\nx-proxy-time: 123ms\r\nx-proxy-version: 2.4.1\r\nx-request-id: 4bc847fa-b1f6-4b03-8fba-6ba950dcaf57\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH\r\naccess-control-max-age: 86400\r\nx-content-type-options: nosniff\r\nx-ratelimit-conn-limit: 40\r\nx-ratelimit-conn-remaining: 39\r\nx-ratelimit-connrate-limit: 40\r\nx-ratelimit-connrate-remaining: 39\r\nx-ratelimit-endpoint-limit: unlimited\r\nx-ratelimit-endpoint-remaining: -2732\r\nx-ratelimit-method-limit: 30\r\nx-ratelimit-method-remaining: 29\r\nx-ratelimit-pubsub-limit: 5\r\nx-ratelimit-pubsub-remaining: 5\r\nx-ratelimit-rps-limit: 100\r\nx-ratelimit-rps-remaining: 99\r\nx-ratelimit-tier: free\r\nx-rpc-node: ams346\r\nstrict-transport-security: max-age=2592000; includeSubDomains; preload\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D5ygKR3qNpL%2F2WQ9DCPMofNcfaaxEiffOm1f5qxXYR%2FhpTG90TxLhapFSWGnCbzPy2w9lm%2FI4BanChO0z%2B8sJJcPuKQe7tyanQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpect-ct: max-age=86400, enforce\r\ncf-ray: 9aa64afcfd3bb500-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":327,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"f4d172f0b2357c76d158ac2d855faee0","sha1":"c62cc2b63c8ff603bb3237f4f1374314058af4d7","sha256":"d6f335fff0944d521c925c230f70041dc8302da357829ccddb5b1b78189a74ba","sha512":"61b42922ddbf15a54aac5f783f1d43f4a60685e03ae0277a5145acc5f36937f178911091ca59cbe4a560e65129a51366da2aa8a866e710cb50e4eff97986ae55","ssdeep":"","tlshash":"20e07d803d0a0bbfaee58f53ea1d518ef1c4199c1780494a56d4159672c04dd709fa7b","first_seen":"2025-12-07T19:05:36.420178Z","last_seen":"2025-12-07T19:05:36.420178Z","times_seen":1,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":134,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/css2-1.css","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:05.888Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /css2-1.css HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:06 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"223d-19ae6074d34\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=esTSS1l%2B8ndeNhoVozrU4aIDjstpj2T4LKOz5X5b61qkg0HT%2F5A4nxPVJIN7ecliR5tXYe15ej3HsmoLdoQxB%2FRd8XBkvTzYmbd6\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9aa64ae3b8bc568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":8765,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (649)","md5":"b329d4b0c87ba2ced572d07d36f4242d","sha1":"9aefeb819409071d364f18579a6cabfd07fb4c44","sha256":"11a8d231f5f81a7fd12caab14e449884e97c55358b11cc7a07a6e0d96316bdf6","sha512":"8ed59579a52cd6789ea6bff9b01e0ef0183e306885a33b5de7c1c84f66b88c12d9b44a3612b66d9f0cea6e916b221c8dd9b153769600138c2ba04f38614ecdc7","ssdeep":"192:4eCl0QeadieCl05Ta8leCl0GIanAeCl0fNaureCl00qahc:ol0rl07l0Pl0/l0p","tlshash":"c10248e0482e5180b7972dc663ce3e278d4df2987085882cabfd170bad5bd6572a178d","first_seen":"2025-12-07T19:05:36.421673Z","last_seen":"2025-12-07T19:05:36.421673Z","times_seen":1,"resource_available":false,"data":null}},"time_used":420,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":420,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/uicons-regular-rounded-J3WOUERV.woff2","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:07.006Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /uicons-regular-rounded-J3WOUERV.woff2 HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/all.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:07 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 385636\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"5e264-19ae6074d14\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xr8akjVGhi%2F0MAxTHxaqvBk339eALs6zBY2JljFvLDCPClAtc85y4etHVCP0G1VM8lSO0qT8bv5c6FCv02ALHcciVLBG9WNam9Lp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9aa64aeac938568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":385636,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 385636, version 1.0","md5":"b94a0c1ffbabdefbc6ff34592609e30e","sha1":"3c10e62fd82639389e8ca77ed3fb6bd70558abcb","sha256":"90bf775eb57e8d45ad4158f6f8f2f343d02b308aa13dc5c266d3fe13a0cd5658","sha512":"eca160a3a801b659f882221f97a9576ec3763ae0e9a5e7ae6ecd3b6da367335916e5c40cea954fb7737f26ceb8a14928e48b9778032d1c68e15a5d2be63c5c58","ssdeep":"6144:twSB3GzByzcwt5lhE/qy88JI60XJ8r5ZtuQtoJf981mhxCju5wUkZNwg+qYjkPx9:twZyDlIqyjOXKr5ZcRJ3gZN4qYjkPf","tlshash":"548423b614f1814df5233913a9adc72c22d6afb44b257ce76c17d64039e1bb02b8fa60","first_seen":"2024-12-25T01:37:08.284557Z","last_seen":"2026-07-18T17:18:47.272167Z","times_seen":87,"resource_available":false,"data":null}},"time_used":1117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":676,"receive":441,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/cdn-cgi/challenge-platform/h/g/scripts/jsd/5eaf848a0845/main.js?","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:07.113Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/5eaf848a0845/main.js? HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:07 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-encoding: br\r\ncache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public\r\nx-content-type-options: nosniff\r\npriority: u=3,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=5pRAbrauSIhsyRRPIefkCqR4fZ4VJpCad1waddCRzoQT1fEiINH1ZOh6E5IgvtZTgaW%2F7IVzMFpT2j1q%2BDcsfT2Mcw9XP%2FEATeYl5cD29wSyfuZebkIXBVpn5%2BBFxZf8\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 9aa64aeb7a29568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=1069\u0026min_rtt=751\u0026rtt_var=145\u0026sent=465\u0026recv=70\u0026lost=0\u0026retrans=0\u0026sent_bytes=517538\u0026recv_bytes=8819\u0026delivery_rate=20268710\u0026cwnd=30000\u0026unsent_bytes=0\u0026cid=77379a3c0ec7a346\u0026ts=1462\u0026x=1\", cfExtPri, cfHdrFlush;dur=0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10318,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (10318), with no line terminators","md5":"0f528a174e91e3871252523879146bb7","sha1":"09925b442b819bdc05d3c119ff93f95b7104fb5a","sha256":"4e9d3e507f19250fe7d4380061090433e8e9cabbe3bd8bb4944ce1bbda8363ed","sha512":"b6ae5b6579fd97ba532d69615e5c69b4c33413ceeba889db0cee760f27b1bbc9c40d80d86487f49428d91ccb068cbfa658ad396dd534d94d86693d2d120c491a","ssdeep":"192:lZlYDtHKrHGccVDIb4xTok4Hz32pkqMrwdyZB15sTkASDG:dYDtqzGr9IbuEk4Hz322qMrwdyMTkAx","tlshash":"92221b8f7d0db162e5385464983f38fb12347f9540886d039305ea997d6638abceae4d","first_seen":"2025-12-07T19:05:36.425084Z","last_seen":"2025-12-07T19:05:36.425084Z","times_seen":1,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"corsproxy.io/?https://api.mainnet-beta.solana.com","fqdn":"corsproxy.io","domain":"corsproxy.io","tld":"io"},"ip":{"addr":"104.26.7.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:09.854Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"corsproxy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 24 Nov 2025 00:28:54 GMT","end":"Sun, 22 Feb 2026 01:28:46 GMT"},"fingerprint":{"sha1":"82:A0:BD:81:8D:CE:B9:C3:62:8C:F7:C9:61:E3:C6:2D:D3:11:DD:A4","sha256":"29:40:B3:AC:CC:AB:2B:AB:6B:50:07:A6:71:D3:ED:F6:1E:43:9C:CB:DE:4A:02:CE:D8:2A:DD:8E:FC:B3:2C:ED"}}},"request":{"raw":"OPTIONS /?https://api.mainnet-beta.solana.com HTTP/1.1\r\nHost: corsproxy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://usecorns.live/\r\nOrigin: https://usecorns.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Sun, 07 Dec 2025 19:05:09 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: false\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH\r\naccess-control-max-age: 86400\r\nstrict-transport-security: max-age=2592000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FdWbnobF%2B2EAyBBl7wTgRyYVo3i%2BjJ%2FzlXwfQlrN6qHIHb4MxhpELR%2FecPLzto%2BSupEJhSUKGbNiUZQoN13AsP%2F0O8yzIcaAoA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: same-origin\r\nserver: cloudflare\r\ncf-ray: 9aa64afcdd2db500-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T01:50:58.104205Z","times_seen":17490279,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":47,"dns":22,"connect":1,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com/@v1/cdn/js/arg.basic.umd.js?t=29418905\u0026u=XQZb1c2NOiVpG614GDY5MjZkZjgwZTZhZDExYWUwYWQxMmFlMFxKbWRlJZ6R1VPM9w","fqdn":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","domain":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:10.080Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Nov 2025 14:12:48 GMT","end":"Mon, 23 Feb 2026 14:12:47 GMT"},"fingerprint":{"sha1":"DC:02:89:59:92:E6:29:BF:AE:49:98:68:B6:12:FF:3A:68:95:7D:8F","sha256":"E6:FE:45:C3:72:EA:6F:68:78:CC:5C:C9:C5:78:5C:33:C7:93:0F:3B:AA:83:6D:24:20:40:89:9C:37:A9:3B:EC"}}},"request":{"raw":"GET /@v1/cdn/js/arg.basic.umd.js?t=29418905\u0026u=XQZb1c2NOiVpG614GDY5MjZkZjgwZTZhZDExYWUwYWQxMmFlMFxKbWRlJZ6R1VPM9w HTTP/1.1\r\nHost: afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 523 No Reason Phrase\r\ndate: Sun, 07 Dec 2025 19:05:11 GMT\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: 3\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 4623692\r\ncdn-requestcountrycode: NO\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\naccess-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\r\ncache-control: no-cache\r\netag: W/\"3-jeI6quxhssuoG9FV6mYyJzfep9g\"\r\ncdn-proxyver: 1.41\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 523\r\ncdn-cachedat: 12/07/2025 19:05:11\r\ncdn-edgestorageid: 830\r\ncdn-requestid: faf46446591025bd23df68e0de99c90a\r\ncdn-cache: MISS\r\ncdn-status: 523\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"523","status_text":"No Reason Phrase","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T01:50:58.104205Z","times_seen":17490279,"resource_available":true,"data":null}},"time_used":1257,"timings":{"blocked":35,"dns":27,"connect":1,"send":0,"wait":1185,"receive":1,"ssl":5},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"afumyacvizccbvqvzkoxuqrhyuaqopcopwfygjv.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-07T19:05:05.584Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:05 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vNyYRMhsoBugKazUC%2Fj6ANIQjq7l%2BwhHAh1vsHZXPIKcALUWVtJBrcJfxFRvekmdXsa1exgOlaMt%2FkSOkujG%2FE%2Bj%2FcgPt5ZuHkRA\"}]}\r\nage: 172701\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9aa64ae2382bb4eb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":624117,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (11422)","md5":"7bd7eee228352c3afd9d12fd3bd65c16","sha1":"7d51f0a83160f4792ebf171f371ebd8074484af3","sha256":"81b17b5020f524bf1b8f3e292968471cfd4d6c1bdb1bdc4296152de547bd59f3","sha512":"c61efcb6de9766bf5b08fb1c480b33e544213eb0ae3ddff9b0a1d1fd5524dc85a8885db7f2416cd8fafc7c97e82b80c9a999e9bd566bc703e3189edc02221860","ssdeep":"6144:nqKCeZAW5haBIRvuKCeZAW5haBIRv2KCeZAW5haBIRvH4:nPCeTzxvrCeTzxvzCeTzxvH4","tlshash":"4bd4c83f6b14b638ba27c11d12a9628dc124dc04fa9399edb5eb4f158bd32d32f6614c","first_seen":"2025-12-07T19:05:36.426853Z","last_seen":"2025-12-07T19:05:36.426853Z","times_seen":1,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":52,"dns":40,"connect":1,"send":0,"wait":19,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/stylesheets-0a230b69-beeb-4d2d-a328-f337c50e5e4b.css","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:05.884Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /stylesheets-0a230b69-beeb-4d2d-a328-f337c50e5e4b.css HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:06 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"917-19ae6074d34\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aTNnCawYYg2zmmt1dOFOCKtPVd3T2NmOggiaYg%2BXsB%2F7Qa7gr2MIo9Sj5fy89djAsASG98GdnPG1lm5rVCEsYcVvDCXhYgRkoscL\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9aa64ae3b8b9568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":2327,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"e9d5a28c9ab694d127f6ac0e00d273b6","sha1":"5ca917bb2a8e273e76f2ca37e491032f71f2369c","sha256":"6a9eb7442189e9e84326f5a31a8cb493b0e0f4db87305719d14dbce8a9349311","sha512":"9f70bc33ef06991ff602f4f606b3f93e1a52c885320130b5bf31ba515e58fbaafeb0ec6543ad4289ea2da1cbf918e50a8d5da6c89958b814b91eb08a1250ec8f","ssdeep":"","tlshash":"ef418ef175c185ac3422911d7613ebab3bbe4841560e1c3a5fb4737c9b937f18a22988","first_seen":"2025-12-07T19:05:36.428286Z","last_seen":"2025-12-07T19:05:36.428286Z","times_seen":1,"resource_available":false,"data":null}},"time_used":332,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":332,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/ant-input-5.1.0.min.js","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:05.896Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /ant-input-5.1.0.min.js HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:06 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"27eb2-19ae6074d44\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pe8V%2FPyfaXS2Uru9pTwMBvesfd4Oix5fHwU97ebbljaYhD%2Fgrwa9uEgogBx1ksZOWElGMkmWAG5w9KSGhx81RD4QC49QovDeYtje\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9aa64ae3b8c3568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":163506,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64320), with no line terminators","md5":"8efc73123dcfe306663777d9feaa456a","sha1":"23acc79e943e6477857d71d232d79bf2a653f0b0","sha256":"23e34cebed1b892fce0d343cb2e51a2e847fb338e92b5836836f48971d2dbd4e","sha512":"6fd8a66444c291f57d2828aa0e1ad0b160d2deac5be5264a52a7aec8310abf613e250fa2d3815a1db88663c14a5e76f3d8573069497b8ee08b98116c6ae543b9","ssdeep":"3072:Vlse1BD1UtsUc/U2UqsUl/U1NPQr+SIu/mdBIjf3BcyRoG2EueK:X97B/4MSSy0jf3Bcy2UK","tlshash":"e5f30915cf09fcff9272c4e640fb320a9e52b450a069883ac76bf5c45366f62ad53a74","first_seen":"2025-12-07T19:05:36.429458Z","last_seen":"2025-12-07T19:05:36.429458Z","times_seen":1,"resource_available":true,"data":null}},"time_used":424,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":358,"receive":66,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/snag-logo-light.svg","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:05.899Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /snag-logo-light.svg HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:05 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"126a-19ae6074d10\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 172215\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n7puN%2B6D9Y6Icc3mSzRQRGpsTv%2FQoIEmQJA8WHHojaiexHCa0etXIRMUi61UtoUg1jZJgnyDZwBl4q9lC%2FoMUhUwHrXn5b13dsOV\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9aa64ae3b8c7568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":4714,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c2c24603ccafa4796d604982fb553818","sha1":"c2858262bd342ab7e440117a586fe1f95a3dcfcc","sha256":"bc2fdc50daedf3ae057ea6299c2e88509be53359fbd718225785bb11c86c45af","sha512":"15431c76141351826316249e5c59bb3e18ea478f3be2ef5a21db3eaf403096373ec1e0a5af4312098dc457d7603afc632837238d1f28a8d7e7419c6a47bb09da","ssdeep":"96:fiS9N5ACUWJyN3FWqIu3jJBqELns884u9yL3BTdc6F:fd5Ap/1WqIu3384vLtmc","tlshash":"67a142e91394a2dce802f3fcd91ba476a51a28ff3b65cbc582a05d5eb51103d0d9ecc5","first_seen":"2025-11-01T14:46:32.097155Z","last_seen":"2026-04-18T09:16:00.242372Z","times_seen":17,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/alexandria/v6/UMBXrPdDqW66y0Y2usFeai3dAw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:06.993Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 27 Oct 2025 08:35:04 GMT","end":"Mon, 19 Jan 2026 08:35:03 GMT"},"fingerprint":{"sha1":"4A:97:40:A8:11:17:BA:08:56:28:6E:0B:93:8B:64:13:1D:67:D4:2A","sha256":"A2:0A:13:FD:98:22:74:26:3F:C1:44:5C:92:27:22:17:A8:65:07:40:50:F9:14:02:11:E4:87:7F:C5:D2:F1:42"}}},"request":{"raw":"GET /s/alexandria/v6/UMBXrPdDqW66y0Y2usFeai3dAw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://usecorns.live\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30140\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 05 Dec 2025 19:49:33 GMT\r\nexpires: Sat, 05 Dec 2026 19:49:33 GMT\r\ncache-control: public, max-age=31536000\r\nage: 170134\r\nlast-modified: Thu, 04 Sep 2025 17:26:28 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":30140,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 30140, version 1.0","md5":"106e7890fb01e7ea352d64e17921207d","sha1":"a5d4f37ad7173d36184f456ce23092a2bc9ad62a","sha256":"98ccec0bc3c456332f8fd0fcaf81d26a4e010b7fc093f9781938f976df9ffbc4","sha512":"31fb6940774b40b795da3008c6d9dc00748ea02bf8b3fd121d28b064b028a765f5e35aeca6c25db3ee29ed78fcc78a1e49124557764bdb05ac084dc032c3fa20","ssdeep":"768:nHadNFJECXwMHUxzhVRKY3CBAEnitbZUfPR:HadHJdb0xVLGriFI","tlshash":"a4d2e17466fc32118bee3d3155fb26d8a0a81800e975e45ab431c51bb1fef2a14f566c","first_seen":"2025-09-06T12:26:49.789297Z","last_seen":"2026-07-22T13:46:59.848649Z","times_seen":527,"resource_available":false,"data":null}},"time_used":343,"timings":{"blocked":141,"dns":0,"connect":28,"send":0,"wait":29,"receive":30,"ssl":113},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/orbitron/v35/yMJRMIlzdpvBhQQL_Qq7dy0.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:07.002Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 27 Oct 2025 08:35:04 GMT","end":"Mon, 19 Jan 2026 08:35:03 GMT"},"fingerprint":{"sha1":"4A:97:40:A8:11:17:BA:08:56:28:6E:0B:93:8B:64:13:1D:67:D4:2A","sha256":"A2:0A:13:FD:98:22:74:26:3F:C1:44:5C:92:27:22:17:A8:65:07:40:50:F9:14:02:11:E4:87:7F:C5:D2:F1:42"}}},"request":{"raw":"GET /s/orbitron/v35/yMJRMIlzdpvBhQQL_Qq7dy0.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://usecorns.live\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 11800\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 05 Dec 2025 18:39:42 GMT\r\nexpires: Sat, 05 Dec 2026 18:39:42 GMT\r\ncache-control: public, max-age=31536000\r\nage: 174325\r\nlast-modified: Thu, 04 Sep 2025 17:04:39 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":11800,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11800, version 1.0","md5":"5d281085f7277a3ec9c7586dd2f24a13","sha1":"d686c7f2bfeb693a91baf3aaa3b6e70aa1a5bcc3","sha256":"c25a9f9da5d9f3db1bf2a01474722dc9b377675b7bbab6d0dfda6902794fd1ed","sha512":"7a31ed0d967a47d8f6135b5889c2af595b1ed3993ee3e2e2f522875e6384773b1f9f96ac891c068599580a543001443b1a1d565563a13010d40e1dbac4142220","ssdeep":"192:oufNGqi8O6lHWqR+OVLlB2AynsvBhJo/WO9UrApcn4UwLqJhPCGSlkeLlM:vCjKBBB250BhJol9UB48SeeBM","tlshash":"fc32c067623046e2fc22b53001fc4500466865bfd140f1bfd66349e7766e9606eb2a3e","first_seen":"2025-06-03T09:08:22.59014Z","last_seen":"2026-07-23T22:57:13.239163Z","times_seen":7991,"resource_available":false,"data":null}},"time_used":500,"timings":{"blocked":246,"dns":0,"connect":0,"send":0,"wait":29,"receive":4,"ssl":221},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/bb1b08ea-9abb-447b-be4b-2cfc7bbfc62d-1.png","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:07.062Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /bb1b08ea-9abb-447b-be4b-2cfc7bbfc62d-1.png HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:07 GMT\r\ncontent-type: image/png\r\ncontent-length: 8414\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"20de-19ae6074d0c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F798QW3739tG3S5wqJnK9VQqO5oldi3cFYi%2FTN2ciLD2%2BJsORfpN8djEYEFpbp9xV0IMAQpsckfVYWu1YporbDR2wpt6DSjoIKBP\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9aa64aeb29bb568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":8414,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 225 x 78, 8-bit/color RGBA, non-interlaced","md5":"5d38cdd4f0d0d278ea54507fb4a0abd0","sha1":"7f1ef0626517d2dbe94ea162aba70d14bfee0a29","sha256":"a8612e979fae6d9f478e3680f91f4f74ab16ae8f543d24272860d3f8f6990be3","sha512":"ecde9abc1983d242de09747a915d5bb41a0a6459b639bcdb3ec8839c4d1d16f5f6f285fc51a22a0ca951e39b2c4eaff6d2d60847aed603a93edd773d01080234","ssdeep":"192:0mx9btY47PZsV7gdBKSZTv1VXerAzcwuaNOIPXzfUcZ:0mtB7PZsm3ZDjerA1uaQQpZ","tlshash":"9e02bee44c4125f8a6354b07abc364ad462e9ce3a40d9385fdb30de7c7b3d0a06ca30a","first_seen":"2025-12-07T19:05:36.433223Z","last_seen":"2026-04-09T12:44:20.934271Z","times_seen":2,"resource_available":false,"data":null}},"time_used":274,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":272,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live//secureproxy.php?e=jscdn/getFile","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:19.690Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"POST //secureproxy.php?e=jscdn/getFile HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://usecorns.live/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://usecorns.live\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: cf_clearance=_xy_M2b3nlctRh8LvibxxyQLpMjTfJUvKqkLFN2IND8-1765134307-1.2.1.1-p72Xpd.DEmvwHzne0uPAfXoUxRmRXQyMhMLD6moGgDgrRVZsgMLxZDhzZMyoS_z6w3G49V6IEMEK3kkiI9oqX1tJ9CxNfadqo7iY7SW8t6kAE5XU_PQM42qs3S31lyN_3QRjpgB8vgtGn1Af_Dqrr7phe2U4lyWboWD8rXFj3RsT3WVXHgvRk_O3AfYauXb7PBLKFDyHKfy2PwLBAqztRZ4mbPkT8.0oxZTg3qRj.c4\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"cnr1ww7x1y7w44r9j0xj\"}"}},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Sun, 07 Dec 2025 19:05:19 GMT\r\ncontent-type: text/html; charset=utf-8\r\nserver: cloudflare\r\ncast-mode: default\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncontent-security-policy: default-src 'none'\r\nx-content-type-options: nosniff, nosniff\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xMu03xzTNIfqGhein18MeZaxcdoJBXa8RlhBchwRDHXSI6o69%2FrC%2BIyk4TQ4VTVBuft1XnXkmD42noZpXsOWblHxfGCrrnhjyAQN\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9aa64b3a095c568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"1473e0fbeabc0536900184482e5d7208","sha1":"2ce769b93b1bde1292be3652c0be40932c333799","sha256":"43e8a4807c2054a6e8518c19131cdbde7f69242707b4564df707dee30065eb5c","sha512":"b6fd2c422f5a8a4cd7c9f3c5c136ca70a36cf3a8152aea5fd08a9d1f282fc0bc667b850bcc4b56c8cd6b91e907578f5eb6d1c9e93394c2d21b0398174267f658","ssdeep":"","tlshash":"c9c08cea20000201893096047ac222a824977b8a20e28a44ab82e027ecd461ac886188","first_seen":"2025-11-26T01:11:55.349732Z","last_seen":"2026-06-28T17:04:49.020897Z","times_seen":43,"resource_available":false,"data":null}},"time_used":137,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":137,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/b18d94be4a03f95a.css","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:05.890Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /b18d94be4a03f95a.css HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:06 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"4c016-19ae6074d30\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=o4fJBfvTGAsRqfgT9qd56OH6gryhEtTAizR7HNYfT9iP8QAYImjCpOt2OQ3FaLx3vyfav7e2CAgOZKVK4w5ZZIqUdlThVdeR62fw\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9aa64ae3b8bd568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":311318,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"01329c9bb47bf6358333b64752bfc1ef","sha1":"d473004cb7088240d09496d4402d6bafefe4c696","sha256":"73a8dafe21bdacba723e66db8118ccd470a5d99e2149407080cbe119b7b33c3a","sha512":"cbcb8ba3bfeab7090123b0516d7421a42db75956b5f2c109e4520ce6afcf70992f90020f1c133fe8dca38abbda016a3d85dbc0df7f969944dfd6c2c67c23200a","ssdeep":"6144:OnGYXKBx8W1YkgGV6E7wLh7kVnz+bcWCiLjh+nRQ+rryVoc1Nitd+Rc4fKcyjODy:OnH+xZ5n/WaH","tlshash":"7164feea6224fd3dac37a015925cb96c5707f586ae332df5e852253743c3ff2682a118","first_seen":"2025-12-07T19:05:36.434554Z","last_seen":"2025-12-07T19:05:36.434554Z","times_seen":1,"resource_available":false,"data":null}},"time_used":433,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":357,"receive":76,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/40ac96b0-cdf9-499d-bca9-8b7ef72218d5.png","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:06.991Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /40ac96b0-cdf9-499d-bca9-8b7ef72218d5.png HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:07 GMT\r\ncontent-type: image/png\r\ncontent-length: 14174\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"375e-19ae6074cfc\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ae1qtKl9W0MIeMFP7MaTHzQt6dGRCpyd7LMvxbG9BktbBauZ3J0TMWkUB4f1ji%2FPY6FMGKr61D6O3eSKzBJxfLUbBThE%2FqnzKpBJ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9aa64aeaa910568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14174,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 176 x 176, 8-bit/color RGBA, non-interlaced","md5":"17adca0e0aeda168e8f8d8fd49c3d230","sha1":"95230496aefda22d1e8157731a8e16f72e7a16c9","sha256":"c7d348253a7f437084693396b788b4c62891b7139a8e120efbc5b9d8dba347e5","sha512":"3fc6a9ea5827e3adbab04c6ea80efa24b2a17737bebcbe0163cea27882a88866022b041aa0f9ff01083300bf791721d0fdb90a0e39f7ba76cdf05bbd4a81e930","ssdeep":"384:2nQnMjdgZzzVGEXBUErrBtzE6JjXzVKyHXOH:HM6lPCErfzdjjVKSXe","tlshash":"2552cff9daa4ccfc5244e10591e0c1fdfc5a2927e3093d761a0a2680cdca856e785bec","first_seen":"2025-12-07T19:05:36.435899Z","last_seen":"2025-12-07T19:05:36.435899Z","times_seen":1,"resource_available":false,"data":null}},"time_used":811,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":811,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/secureproxy?e=jscdn/getFile","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:07.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://usecorns.live/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://usecorns.live\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"cnr1ww7x1y7w44r9j0xj\"}"}},"response":{"raw":"HTTP/3 525 No Reason Phrase\r\ndate: Sun, 07 Dec 2025 19:05:19 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 7037\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9aa64aeb8a3f568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"525","status_text":"No Reason Phrase","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7037,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (396)","md5":"888c606b713b10a36c851562ee4b38d6","sha1":"215673f5ff649a7c6f79cfdb74c2abd8847cda16","sha256":"184f1f42a216b9fc902bdb68570ef49e6aa747b432e804a37f27e5946a1aa997","sha512":"f61a321d5ad87ec86e3c8eb15c64c6770f671c3e0d14511591da920aacdc00b13223e8eece18987a11969bdb86ebc0f961591ab8e647af2baff798af26e866cd","ssdeep":"96:1j9jwIjYjKDK/D9KUCDG4Fh8/G4F+G424FP+skKmoDmHRWS97RLl4aQxP:1j9jhjYjeK/B2DeGdVxD2971lDeP","tlshash":"2ee17772b1f5127a0093829235d5fb1a79e0c617cbef4594b3edc6632f9ee81e903194","first_seen":"2025-12-07T19:05:36.437222Z","last_seen":"2025-12-07T19:05:36.437222Z","times_seen":1,"resource_available":false,"data":null}},"time_used":12376,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12376,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Alexandria:wght@300;400;500;600;700\u0026family=Orbitron:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:05.882Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 27 Oct 2025 08:34:58 GMT","end":"Mon, 19 Jan 2026 08:34:57 GMT"},"fingerprint":{"sha1":"56:14:7E:EF:FA:D2:CF:DD:3B:30:9C:AE:7A:C9:AD:9E:A7:87:3D:E9","sha256":"72:DD:0F:82:4D:8A:09:2D:BB:5B:E6:1B:6F:09:F8:1E:BD:BD:D3:3E:B8:A4:8C:B9:49:13:4D:DC:D7:EF:EA:77"}}},"request":{"raw":"GET /css2?family=Alexandria:wght@300;400;500;600;700\u0026family=Orbitron:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 07 Dec 2025 19:05:06 GMT\r\ndate: Sun, 07 Dec 2025 19:05:06 GMT\r\ncache-control: private, max-age=86400, stale-while-revalidate=604800\r\nlast-modified: Sun, 07 Dec 2025 19:05:06 GMT\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12303,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (649)","md5":"b5783fd68293eb9d35b3fa39995ec3ed","sha1":"49601fdd575c6db89d7f439d7b7805a5215acb92","sha256":"af70e2f45d0fb8fc77ac0575a1b55891b77ad078c4d43843282520c05bc06c7b","sha512":"ebd7cb42800e5989014189c6d2e6cfa53b0265139ff58d09658c076f66d66804e603ed6a6153a631476393c767c53a7a773596664b0dcfd48f52fec0824d3220","ssdeep":"192:ShCl06/LP5hCl0bGLWKhCl00lL1nhCl098LMAhCl0+DLT7gwgpg6gB:ll0Tl0bl0zl0Tl0I","tlshash":"f342ddd5081f5584fb5b1dc2a3ce3d27de4ea1a93481842dabfd0b8b9c9bc22326575c","first_seen":"2025-12-07T19:05:36.438675Z","last_seen":"2025-12-07T19:05:36.438675Z","times_seen":1,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":129,"dns":1,"connect":20,"send":0,"wait":32,"receive":0,"ssl":113},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/css2-2.css","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:05.893Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /css2-2.css HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:06 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"25cb-19ae6074d34\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SI2tHGlpfcNxJH%2FQolk1oi3%2Bl5WUE%2BGtMOUQzk4RYmwROmLV3gZlmLVMNVEFi1nYN%2BG8ijRI7sFurvQxxMjEi%2Bp0Q%2BrgX1H6cw89\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9aa64ae3b8c0568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9675,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"a337b8b2d031b61bb92ae7c2a5bfeb63","sha1":"493fec7a9fc8e6b9121266a9e6be097ffa127592","sha256":"51094957d3f159ad78711b765beca0642b35888cffcc9ec0eb8cc61a67865dc0","sha512":"16613f02afb73f7a1573b3e844b3076b594bcf0a926b45536108c0d3814a42cdee0c33e8eb3ba32f30fe2fec0116577b0c9adcdb87ac545235754281321f933e","ssdeep":"192:f/Pq5t3ycaF7/qP4t331ass/BAnt3I+a7J/Ed+t3Fnayy/zG1t3O4aJc:XSs/IwYdkWl","tlshash":"dd124750042a9100a7832de173cfbf326d6d72447089d9395ff90998acdfc2263a1b4e","first_seen":"2025-11-30T17:23:15.586047Z","last_seen":"2026-05-29T11:10:57.837907Z","times_seen":11,"resource_available":false,"data":null}},"time_used":321,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":321,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/all.min.css","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:05.895Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /all.min.css HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:06 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"12a685-19ae6074d2c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0F3fLgS54zebuWmT%2BGFBVt%2BOcXg4vrTlYoBrDbvlKqryHLMeJPIHXgBHiIa2%2BFctiAj6%2F2uVRKd6pAbADJMX5FUnQduajRREYsCC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9aa64ae3b8c1568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1222277,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (65247)","md5":"92de4f70c24dfd84bc1f5c2ce559a9e4","sha1":"ad164af6276066b73a7aec1f3bc0136ae33bcc9b","sha256":"e471366fa760d376386f57499420695ded566200e91ad0af56db132c11cebd72","sha512":"404689e925afec3cea8565ae2a812743a5e48b05c3ce24514c90269a92045b924fb45a6d3cfe82bd734927164ff5c616e3d38653a457e1effa666f7654d21a2d","ssdeep":"24576:YUYlnKniY98VlpIWpWAhUthbmyEGQFNaNxgXZRREoJ:E","tlshash":"ad250cb4e48989d87b32c04bafc3735c72c6f77ee5994d44f22f521c2dc16680295eaa","first_seen":"2025-11-30T17:23:15.573285Z","last_seen":"2026-05-29T11:10:57.836901Z","times_seen":6,"resource_available":false,"data":null}},"time_used":526,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":366,"receive":160,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/istanbul.dark.js","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:05.897Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"GET /istanbul.dark.js HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:06 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nserver: cloudflare\r\ncast-mode: default\r\nx-powered-by: Express\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=2592000\r\nlast-modified: Wed, 03 Dec 2025 21:03:49 GMT\r\netag: W/\"6655a-19ae6074d3c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7UHlIwyCtA7iXcGF%2FfhzvzdwvJ0rjpDtrdliT8zN9rD73Eo1bgT%2Fha2OzLE4MNU9Al%2B%2BnC6UMomTbqAe86Dx5avQGxRicrSJNZvo\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9aa64ae3b8c5568d-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":419162,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65289)","md5":"7799b460d4f99f3f141860fff7c9fc8b","sha1":"5c92514ef1610b09cef888e3f0aa2f2dac882ed4","sha256":"ac7b7126fc77d204d1e0122b4846b4fa8bcc0a512a6f18ef3bc8e7efdc5c0565","sha512":"85f47fe46fc25274b8b0639dddb5ca11b2e6868abe369eef9bd13c224c5bb5bc865d0f43827ae3b4cb381420ad8af9f90218a6628818d7f090be6bf8c9c4d436","ssdeep":"3072:L5DxYxHS+hP2trWTLGsGyY2ayQ5KsmKHXkw+cSHIRT7P/fE60zZMNKwbcqgK23q9:L5D2F+6OyayQ5KvcoIFcqcqlr7","tlshash":"2e9440dc9e8a17ed8e3381a629561c48f4b428d4476d3e84fbd5d6b6ec0452323fe2c9","first_seen":"2025-12-07T19:05:36.442306Z","last_seen":"2025-12-07T19:05:36.442306Z","times_seen":1,"resource_available":true,"data":null}},"time_used":622,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":479,"receive":143,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"usecorns.live/cdn-cgi/challenge-platform/h/g/jsd/oneshot/5eaf848a0845/0.44409220458033494:1765131898:7BFGJmdPpeVY0FGVTtJo-9Y7w43sKv-z6GIXob67Myo/9aa64ae2382bb4eb","fqdn":"usecorns.live","domain":"usecorns.live","tld":"live"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://usecorns.live/","date":"2025-12-07T19:05:07.285Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"usecorns.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 01:21:47 GMT","end":"Tue, 03 Mar 2026 02:20:10 GMT"},"fingerprint":{"sha1":"42:66:55:A3:0C:23:38:E4:D1:FD:57:FB:22:E0:D1:EE:10:6C:1B:13","sha256":"A7:6B:7F:B3:25:A7:DE:AD:16:9F:42:2E:8D:36:BA:06:06:6D:AD:F0:3D:5E:14:B2:FB:CE:4A:3C:06:37:10:D5"}}},"request":{"raw":"POST /cdn-cgi/challenge-platform/h/g/jsd/oneshot/5eaf848a0845/0.44409220458033494:1765131898:7BFGJmdPpeVY0FGVTtJo-9Y7w43sKv-z6GIXob67Myo/9aa64ae2382bb4eb HTTP/1.1\r\nHost: usecorns.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.3405.13 Safari/537.36 Edg/139.0.3405.13\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 12217\r\nOrigin: https://usecorns.live\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://usecorns.live/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":12217,"data":"ZTqsdK2vAYk+2+2cp2UGdAskqsZAGZs2D2u1qGSsCDkMGrUllF$0HDkcqjyGksl-0GivIskuG1iiN8GfniB8GC8KSY1GZQCadGu-SAoCdaD+aaGu3W4jsP-XCGCUZhOACXAqkwapIobGZG8EtYfWGj0C2vfv0fMRFGCLGWUkTWYKapZKad0G-Y04YrM8cG2B3OsY+r0knq3LCIG2OpsGIGCEJ1b2Eu7DpxwOMi$qjTUgwUgWFFG2-vsGXFtJ7$FUlEsGV6Qc8MsRAGGB3qiG6CG2NXwSLCG1aGkNjkiCknoUaFGGEvJ2jpsY42tRraWGQGgdTYzZd6sGkAN2DP12Dl8DlUDqGvK1GXQDPqGCf2GqM5ZA+qG3$K+NKk3C$UPzUL0SJ+FKMELDv8YckDz1bFKdosGCbn0CG06gl15O0G0$z5OKA1zWqkz6z3fJpFfwv8p-WjF8MSKGugAxGQ11OXE5H4TbEUtAcMHTKBKh4NHxVEEMycnCEx8UDiBPSEYExGYBAu68QfY6tZEaGKCt0D-Wca5IkDXLwZSDYBR+fW2fcdf2plKNsEQuoilDgVRlZMgZ9zEyZyDFd-QGHCh0JYZBMBFhL1wpzwINJuBKazMi02uzP+pSnCrzOSKDE3bX1oLUVA3zGpB12bvEjqHFZhaX0pyHInObFSiyKTMkVR9C9nb4TxQzi+FKGPk4t5qTh+wM3NtuFywI8Mq8QxKDQ45aysDuc3Sr3O0iGv3qpI5$7Nlj+ltuwOzbsVIOn7+SkxY0AsGuyPcqWq+2TtkCwYOHzX$U2AQVRyPwG7KuYTrJhxgnpHSQ0UU2DBJVqUwqn2TvJKl1DkEGDGJ1ua-aTCbHCwu1cswYq7J62TLG+GqIkCqPsfjqPnk6ZbaGoqCLGKwGYaKAqqJll$jGjkbDGvcqDdnkA5xswYxdxuqx960Db6s4PHaK2TIiczEwfb+yR2KGQ96sdq01kkW5850QIkxGDi66c1R9144YQW9sDbKdbd6KCLHB5NLDSt-1185AZvfTHLxbfvZjA7FK5fxd052bt029AvB7c0$ZPatfx6S5ftISt0vs1aBLXBEgabUqsDtkvGQXb+ctMb+GQYcMcRGgPYyE0-lWGPt40MnR0GJr0FEswPAK0rAbJTl0yGj2bbc+YW5k0hkWuqWJ2SJukxZKKbIkOZEdkS+0yk0sDqB+6W6YxiWFixyfLXRNbLkCwGDgv-i2K1l7NBvl7E2mcGl0xMq0xPm4aGzRAPI$2xHfAv0RiAkdDSPzr7J3ms2sCakYaXZTDGlzJq24CROfOYCY3WwGMbBuTDkCH+DBJGQ+l8ADMx-X+-xguA1cqItnEpgDjZ0KLC1SMGDvn-Hg3WAq1SsX+zcn9sYr1kTc++GD5lX0Dwqm-0zvsABhxVGDGXpwAWiu8GXXjg0jGVW0dkAAnFZTwgMJpwYMSXfnOFZnrQ5LVbbzfnsGYAgDcJXdXEFzqKAbrM$wTr5zPQrMgoC8kgtG629gINsFEXtzGyqo2FSm98rbw9iq2KnTKiWXbDgIqzmLmIMG959WWkSJxkWq2BWkAsXxwGjGpGmyIiIthgUwT4Gqui+T4cvkPCsHttQG2MkswTYbBoCG2aIkiwIUDdcOGySZnztCq$-+G23IGaGY0Y4Pp0J0pkVibZ0WsOGwCwHqct4uyBbawwCZLlULxVT7LNE0USWWOGKGau0-zjG1Vzul+llqa2ak0l5XQW0g+k256AS$uVlSXGWHgovg8NaNytHYca4vDSoCGx8$Tya51uDU4q1IHaPQmHc6SGDjbl0-syH+qhFGCqQfSdblCVl5qCTluSg0V3t1BT7l84Pg0dGYEllGHxhly2KUxgVYbTP90wqubi7AflP0WxEkCXYYG2WtpBuKwxFG2PazP23t0Xaxq8p-MKHTpl+zbkvG2sfO8CzQxyHaH-fgUEKkz2V0DCQEYcGK2PI-g$c+HlTGugD6Qgv$rc6KKBY396Ak-HJsQ7-3fjknwMvxy-T-upZC5zGcCk-TzPC6ZPdpDSXJd9g$1sGPUqp0Y1Wx8szS4l7lzmAofPGnZ8FErx4iupD0yrLoKSCQuqZc4vWoMHLwKPSLkgkwS8ZNN7nYTTwG-3f-UC8kAbxRJAc3QSrrxGuUXp7tzYJmdpXKw17gG2cV8z3vngEYml7s2ckfHQAS+TgHEXZroyFaVxIo6Zu3iFy$RBBP9Mgp3UYBz0TfQ$zoEZ8ipqKVH0DsibYf$YTf1JEfLZrBMPdVM7r+JkpGf3WE-Gr3kLL7NCYBGY+rmXESAVjSP5ykd5ZV$TqO0x2X4o+sy7Sbbs38E85ZhgbA$aCvgaCW8qpddbYpgUDs7GgwXtcogj24c1MAAwQTlaqnw7c6xDBQSmoP+-cgvt11usV9-BUVs-Su-+kwfUW3c3FUqEuUYTzikSAZ+SzkCGobzJuJGgq9-r21Vvbff18NDsw1ywD6-N7FWy9rlkvpgcPl4HmdXOAvy7ScqUHdNM8$tG2pbPMzyFT-i8sE6HU8otFrKpxiCkYpsTigLTAnN-YGTDtDjiCGjmG6VQ1wkYu0ggk8hHCGnf8yKDGJSNflKwrSXAFkmunD67wy1aBtqVpaSMiZbnmXg0G60S7+TNq2lw0KTjHXyKlZoF+7JBwCm8jKXq14A+jsh09CwypSTPcDAoDFMKTOU$w2KtCG5EF8iY43a4TAy-Uuii-Nwv4nXSEvpE-EW+0Dqwhmx3Iad7HVlzcn0oOpaW3XVFAVBxzbCfhwWAbIS1S+gqsVCEaQWTHTIvG1ZEu+CDRyBhGgYytFwD13MSHAyEwKUrpw4SvaD0GwqSEQltVlbJ-s1fYsHtc1Zs$09x-pgrBNLH4oS1pFD8T57R61LlgG1LsMoYQv0NtqqTmzXkz4DfT4d0MWopO0TikpuvWV+CdIM2txY0Li2CwbOf-tFsjw5kQzr8iHAgHCh-s7M6RSvY6qWr3KdEUF$fO-3BY7D0v6CliAbjs8Y0i$iYlZDGGpg4AAbFGLRioMz$viOdt2Ox2pBfyVHZoCEBl3BJJHPo4kFaSUq2pKS5U5LYLU1lOH1BP5Kw68bun+$OtQ7PFG2f5oBtYqaIkdPzEK3ikgzCOLlcMbCVtEEmi2oku-6Pb$pW3-X2CHTi3zuwY5+ivYUL788wCt5cJY0V1gB8al$wx6fEaCGnEj2Q7gHzoddpvy-sbEitIJQUZTitU8Ep4Qq5yR0UzYwCznqCg-YPtvtyUXv7XzRNm2UyV+0W$0A-jxC7TzJ0-nXHWKqWJMsJGTXg1UiUNaJYyVwa$$fAU9vq3rMDN8-+U2K4hWv3UqOm1OcIF+QEXj00ApsyvLElfI-$-QH6l0j2hBBnk9lQo6dojo6uXdfnj2xm9$6sJ+0vUTD+HBKqGwOPL1VGZMGq1GQ6MSHviv5CISLxjOOV6OZlObzqdVBy0JiOXrzpUk98tdGb0r1GY06Tz89QAhZqwGY6X7+GubcQWQZsB-8Diy+-v32yEqrsz-fOx2bazA1GsKK-5firbDE-NGBp4bX2XADODpxCElL-+KsDGHc6k-Npkzxrx760JAk0Ei$ltA3a4-J8G-tkX2nTLzX6VqsdsHRy0JMA+2+TSrlhY3qKzrz7Yl1GQQKguhMfuyikCGc8SAjGsSSVv8Eyp7brzGAA+a56+CJrzODOQwWwz8sHZy1Cbw8Dglk-JypwZArlJ2-0LDV4I0o77hl-xibStyzdAz0h6g56Ub6y-KE7+fws6T0JRdvAlzMD9V1a9hQTJ3N3p64gbhz3IQwdY8bszTi82hEdJhMy$woO2TqHmgUHCCdiCA840S8-yl6JSwah2yBwIDiCU7PflA1ivACAk4rla43-TDZS$CjwtrjCskYgzJ8q0-KrxJEwATcH$0rSXk1-6zvqjrX2dDJHF8phM8ubW2XhthS7IThq+Qdzuls7JGfVU-fy46ss+26p1i7-2h6q8sP39CJ7N28APTDC-OPG7pthPzd3MydwZ2ypsoQD23EbWgUAny3zaagT2-ssM8kpM-i2Vk6dmdbCJh7f5hYoFl+gsStpM-fQy2ASFCIhpAmwfDLfx2$w5f5zkp2yfhYbHkYkzGT8Ip2yp3+0L6xbH4p7ng0sH4yl4hd8WxdOylrbjA4iGCbK77vhE6WUAoCA1GobICWyss4Cj2KJmg+dNOAA+d+qvaZpKUL0ywgGm2Ai5-UOWs7ivkYkXkZlPdmgWrrKpfTwtS43KD0-rhvGOhP6k-K7sxvo6lKK52mV0J5VvqOK-zCAsyVGk0KkYdH2iO5oxkNC4h1G$pm2Nax8Eyyg+lnk1kppX4k0uExxfpSokwmllU8x0DNkvkPk-x9pv7AwWUrQBaCDmkS6h-XAH-m2ShYbG85EsGybgk9iZxr3M4JgfyCoAzJoM06VgrvAlVY7NGQg0sr-SUrq6kxTnyK6tEa3qUbxyAI2-fS0nosQWppHgDaHrqLDThtylxtV1OWgXqF2kOqrKkZxKEmUQw0KkHUUqstOp2QExqmACGFy6QEGqCPCTpmolC-VG4moxJ+kdsY0ZwmEnTXT19S6Nw$bogEoGTBEraBx0ViowSCipGo7Krh0U2Pfwsp-+lwCBHUi90ffdEsBBT0cO4Og3O9iM3YhO4NkzBP2WGVAVodgPxi8GVJfT2NqBg2h01q4tfAfNwg9fGBbKCR6KwVbBbfoTQs2KsP2vau9mVp3+GXhz9mDEgfHPkfUQxEqHyuyPbfgoTLaiap8Xz+Ev1sx+H3d0K7iWDH4EpR07oJlxHdgaUMpGpbsczWAM0-hE6bTN2nkiGwkEVu-TrurnT5GzwNE0T$fV9nfmqa-tQ+yiioQt9uDcd$0mhjchd-k1OTk6y0q3B0KRT0UgqwAhwj4sKoa-663UH7gM-jccxH0S7-JTJjkv2PDg2qC73zakDk9t7KJiG7aD-66RH6qy212qcGyix2QVi22JiMQM86UAT7-mwwyT2-B40OQCxn8FGyG6qlzC2tH77k-72BG+A+1l6ZcT32zZO6Av9GUZA9hgoS9dqz9iwmEydZxGD71qHNCqzSkbx71B8kTu8Pn796wd0RD+M3bhl47CrNCd6AGRD29XoH1sK38kHRKhTVk0LK3J2$O6B-dLpzx20NCEq8Jy2grPBsd2bElCLA1Yo$zZBT-q8XgR32zsP50-k$0jGa0X-ZQuhCAHyPi$B$TrBSCuL$w-UVMxdFkkdNhkEWx91BaK3D33iY1CBK3ScrwUT6yhOzkpGdx1nRCJymTz-PkKAJkfAI1yAx0OBF9wKwOnrwsxoEaJaVxscMDyG7wPcB4qa+GfHdqHEOgMpkAGOGOCGACEoOh2okwU2JHMhMQZiXAfcvgPzjbooicUDu7DrPE1HN4kDRqN85--CyA7QGOo3U4qMzyDLKEDxb1-OLpSA69P2YOh2pySxzaDcwoX3Kgkb-caBc4P8l92rtizrFypkzrMPtqEBP0Ci5wxqd0gUEhETraWV7x2Ta9Eknz3VV6JD5n6kuK$S+xboG3qsbwPkS7BaXfpk986HgpRTl4V4uEmVv8wLI2yHuEEQqxCBWxtO0JMod-67nPcTzOLDLVTQh92omdBnqai2Nam9HB1Z+08SaLC16ysxgkxl50jBKK7irdFk-zLio3FAid7fXyJaHHoQLHZ8NVNCDEx8$PzCwGDrKZV8Pk84Z9L-foPk0MW74fWQpaqx-0bVmolT0UGEJat2tAFGgp38EyLMTbDds8g25Z8hcymEsKxosKM-prI9z2s7XfZqHwGOTS6dSJ3YHPs22MPfthzYjG7iYbmlcH6GH20Oh-$HMZnAqsA3cPGo$lJiZoXHNkRxsXDL3Mxlygyn1L2E71CnPMYPdd4LyGV2V28pU9+h2EAX0q14E1J9IpXyt7n37Vtrtr-EExshW9sT78Jak-bTqTwd4-p3GLnQHCyx9E40JuVkVAV9po+V-fYk0UPBydxShcmxEzdi1AofkG$HJLq838U40gmgUCynzZyxyAWpVyd3tx-HY8Eytno7gC+zVwck4bZxP41kPwmG-3Tl8AKaRa5B705-uuSE$x4nUDOJ+zXZcp$GGVmEW4YsoP50WkV4WMmgZn6dFV11CcXnC3D-piN-JkguWSi4Ac2pv8r4lpTYzY9Yg29ZJXkxDPK2SMUkjcMBRYogALd0rf01$9oQNLNLxaqtk-NwT3PBbhSJmYLDwAbu1AdLaiVocEwoPBB9++LP0-v$P9MrxXwP5BdQlb68ZZd3KgLyN0V2kOM74L1-ky+PCLpIAPC-g9EMmD79U7t2kD3QililK2kYlBPz7zd7BxLY-VvaNpw7sCVEYMyy1CdzXkX2Y4AYEGvfME3Twoln6d4uZG2BUhu9NMSE4C4MzuEnYLwE9UZ2C-46gxvDX3ZwkuZQlQOZWBshBoxK8yhdLUSxz1GZTPL+vwLy9HuLjQ4OkaxbInVQ96K2wuUk$LbwxLKk2k3VMO8UPAZhj9gysstrxyNz+A3Tvz1u+fnGNcDDm2wPOMbK3X-IXkIqSn1E4PP$gMEu+2MANEB$ngRASk$0bssPR7jGgPS$TruC6XM1nypk9YDZDu$bTX98AD+QN-axzTUAiAU2mcET+uTQynPXOIV3RugO+na+r0KPbvELEakxuLK3APK2aoxVp6mdar8dj6OHkpRLWMj9PAXd4I84KK8hjzDxwQnq9n8+nZmE4UAHj9HhLQyIit8Dt7wAEhqrCAKlZbiGwYW4P7wUMxmCCD+7AurqVjSaFEaxZSDDtG6O+flXbBEhcY+269+4L$9$DFra41EqfXI4u8cPjYZXN4lEAQKQ7Y3uidC40FwuUOaLcUzMDhrl8OvMaIv9ohUixlm2khzkOPNX6kPr$rqb-koU9-40V98OGtfXk9uJ7ZEGUGtj1Uxlpon6hUXT6Fj+sNIk0BTTChAtOPYNq18x9Ev7OcfdfdBr-tkXxK6o82OhwF21l06TfXmgWIuTnt67CihAvistxc7PFkaq4L5PA3Scp-8cmU51gFmZFORQR3yZqwFAyi6GmlV6AczYK1orZxwAWYcbqhj6r0U$2HrKL9zrCHmuP9Un2kWu26jZwOKk5y9IlI-C-k9+nPbQuapQ5IROngqcEuc4WI3gXGotTWLg2E3CBq4P$DjA1uQPzrxtQJYNvFtbx5UFxRnvsqCpcIXGYdBMg2AcbSMz30zRET-PfF62ncgGVH$p$UGccXOhRS4LdFTyHU5DqrSuyQpw0S8-yy+zbDO6K+WSrf5qcx3vaT+1ZSAKujB1T$o9l2kONEzi8x82goYT8h9b8JjAgGSfjfOMYj4I3vFppF5zBB8lVFhgOQ$m12$Ck3Nz8X8Z-zgZmGHta9X2NOREoIWgr7oxZEZEd3u$EhZxV-460r4ztY6YO7SZ2IkdZZJaRqkldrQBGmEz14KoN4CntWRRMWsAQMR2g+jjIyjvNqx1JQMYqFFiz7$CfWSrjoqCdCy2cBfmfO+LCLlUWDgW0Q6FEdcjrug2L4AH496d8P$z14zo2klWF2y3E4PNOYZmFJYqEPraZfG+k-wGvfW2NGLV5HF8YBJugVl0AY1jGcwMPGNG4uh+XHKTaSq$xDzZuvaHrGY2yts+99FSCDC$QvlbpCf1dE4xVOdqV224A-wsLu2Z1cc2glME9PoV2yZsJbzsZA9gKO2-1ZwA74n2H8oNZs31X9$RGYAO2WDWh2ESbiraT2ZssbHRwGHugU28xvsJDuqkjspPxDCwj0--PSJZ1QK8sUg4qq8AklZqx-w0u$0u8VASTAK1bgqxPSc6WG6k1c3QqM2UbfsCl2G3NP2A70jxqsZ3w6cPG0LK0Q05ZuCuxA6AqpwqdQkCl4VAyTS8AF8ZCuHAak2vO1pwYzAtJSyOYsqqQN$Mzw4kszbxlsfAkbQCBzSB0n3A8EdbZkKYiP6QX1g2AZAP2TpfGphwbC0-G0lYXvKPqMAg28sDG1Dc1gw8tAoQ2mDvw1qn6J4QzaccD-jfw2K2-31RXPw1g0-ms1wt4ZDcqAPyS7hzVSHDDPluH$0iSlj4qfxdzHZlTSM0IPA-wW3EAgzaq2KCXo+0OGISk+kTwWqMAP06G1XvoYzHpz-6WQrPDq6+GlKOqQ6$S0q6qul2bJU$dP90IBz7hM016YUZC6PZPlKTv6+22CcRAVkfvhP61qxFAX64I0PvXb$gGgM6D$6bQaq0DGbK$TEAs0++0Qp4AG7abDQsq2xzKsU0AKZshz2MgcEW2QLc6r0umuJCE4zT5+bTv1zaUu2wDxjTqW0Oa8-yXq06oY1Gf+uDa-yrq4YZp4wMHAQJPQa-k-4zqr8TkuD2-XiACq82cJfuaqDCFJMuCj20Maq20-kCRwckb6Wp1PDPHZ45sYQJbxYcwuNwNqt$Z8BqF$cQki2Uv+sSDN-GxlsG1aqD3DjUq+SDy+aCf1QOUgyS4PAaAm0CkKsn2F6SbXGg+fAdwkMkEASGCCGQATKBAMSMgAnqvgV4tkxSZFFGYBnkHUYPcFQBgukMb8Jks6O64+6$E44w2815yfcxgarHvGVaPTPCdVdO66xcqiDJvvukwGZ0NadDTxY$A+dRqjQS0oMA9xdCOG1TJypCgYlMDSZWGuDy8Ya23ChQIqCk0Q06JrzKKyGLGZsXNwxpM6FcsqGA12uTG0Pv3ibfaYu2fJWNlSrpwAfWY1GqYGMNsfvDjqU0DzgTsqw3kE9fSrCM1KDFTXjHCkTG2G2s-+pJP1yV0-uD0sbuoSz8qbaTUzgkH6CAAUGxvIUBK1NG6KuQZq3yC0HadbAp0FGQxxGH+c8rVqzxPxi9EnGyTURdDmzwCCb6gpP1c13rCEtgYxA+Rov2s6TlV9b2HWR8ZYFX71C9pBEtUY1-KBdswiGRkGi5NTGQwE0Pafpudfbd7oPam0oYLxfP-s1Q4qCG0u4pqYalSlMA1QjdD0A12QxwGGG1EPw-k+krGxIzRX3sCkcK3PDKcMEGfxOKGjCgn9zJf2$6yby2w0ca4DEWCOSKvFxm-dQY$f0s12$s8YK5noCZz3AwdusJdJD6cAts$hudoLggkBZFsbsqpp1cRQNf75-rDb6+Hfa+G57tCKM+uHAoNJSSWpOkoVC$7SvtYoqUsqj9NC7BK0JYDqgggSkEa1aFQB3p5nm4wG47aqqEggZvb$666NbqcKtAXhCsPDSGfUggZr4Jqo7u3-osbKjxc1Vco0nTZAAtlFf-PUI0CZy2LCBzH72w11vA422tJSbtxGaGSn9CbJUGnxH7dJYgwhK4G+TSV9-AfTxiK05Y$C4fYfkSsBq4l1hEYHWsDNoG6sZQCJJk81JF2c2zsgMusyJaG0Gs-pgqAB45S2sAQPDY1HNwc23U-QcskvGjGEq01OPsVCQCfAZB2qBDK$Z-k$2aNUsYlXc9$8EslNn+t4DM94PyK8Bi-Lxgs4iYgJw6a28iXGZ-CYSJarquxXzChgcJi2BqfbAMwhg94u2Q$7RBMca4DkMkrTLxcU4HdPkjG9M6owujP9gsaiR+svtK2WXkEc601HzNK1hg+Jv2QyOCAwX+Hf048byqGXc1bHRE2Y3yOPXtChZOw263aRvy$05ayrSiMyW1jTEndh0abX-kvyqk7iRlt8i3fvJKAEJdoFDo-1qNikiXrEpGhs7nfMOWEyyu8JGY9vu1DkLKcGo-DMp040uWrc0kyug40F9qXon0o-utp5zN8gJribyutq3H5KklUaOyKsCjNCw+JZGX86W7MfmXCGbSN-dGG26E2Q87804MI0WFmuLVgaVyQAsjfGQml9ibykC6AoyU+Sz2bTf+30256b1gEW4YsYmX9dvKaQdvf+b0NXYvoc6K59WEslLAxdSiEsDPlS6-z9EuizjMM132iHMiz2HsaMqMOoiCkbYu4M0HGxE9rx1zIPfAECE0Qs1VNmWgWm-CIsNsvd8vND7M-kdCkn0LACAbk$6US28go-fC1f2qIPhcJXyQKVPviAY9SiZqGWCRlsrBw3apDVYH2vTtY2mibyHYCTgD201xgX4RxwuuTtW1l8V4XKQiqs$Wc2gs4sWKlpr2hx0dCV+80l-DSf8X8IqgzPlcx7-HSi2sq+31OP4+9bdcs2z+c6+d+AtbF-vDKu9fGbBNbpEhAWupbC$aKDyAsKE7Fu9M6Ua6yKOwR2GLvBmWh4SB-UCPIrU1NRxCkZMYFZ1iRg8DEKL2NsB-3ZdcyLxXUfsBNztdrqmb7yS2JcBddZE9zS-F9Xc1ublEl2Ylg++394Dh-201bwyGWJSi8TS8ZtZ9kQ9XgE1qgw5jHu2wC2KELx-skQG+O22mEqAR7SG$833L+sujlMN0GKk0ibyGgQVtT+AJZK45UA+VkRuQC2g8KhMA2cYkRaxblvOul61tuQc0xcGag8CgMdCAC3d-4ghyF9uHKaDC5LxYk2tANoYr230v4ukoX-1diWl$xOSfWlQ17B5WfPD7DAAkxIdo7bxNTuaHu4z3$TN8sadSavs0K4BXbRKla2SGFWx0DbESzWl+KK8Ppx3JDlhlZcR2fGBzTvCTtA9iziBN3QiXZutcrkiBR507tLlMaU3p-Ni9BAVXq45SIGMwFy2cYABqR0LwbY7cJ1Jczi6-P+r0lwrtUCtK0O+WJCdXNBj8b6t3r$d0kRo7i1LdGkycYCnUB8EB+vsSfUQr182TyNG4bqc+Nc-8Gykpru1p7iE8rHDWj2tj1wIJErzygvStccIN1gGpy2poZjnYd9t8aEz33N1-xoBR7CEWVyq4C3Z9tiJEYVWjju+oExawLvWh4JAY$9diAL6g251ptd9VrtER5p6GjIDkbQI463P5j07ic98UTz3aEc5rIE2a2$63750Q2FUo3XLHWo76j+scm8xAsqh5NrLKc4r04KVoZpG$s9bOD40V8k6569Bgr04mK7Bcs$82uJnBcAaBFS3cSwQJB1vbtBHuqBgrz4sWfSJU+Q1k3VZYJCk0bQICyrU4jwUywbtOEgru4f9HS6$9T9OE2Sh3b2zqrDLKdgZqUnGDc7CA8gwZ63S6Nz7xP3g0Zncj6taINBpgN4qT7BFQ3K8Z3f4nywfOsX9BzOr48vW$fUI+cK16BP9BlvhsTLMO0ERV3JDC3bnTOGEKwPJDCrsc$O0EVwJipC$sPyrTE7suk1p$zcSOX1Iqyvf5+8B6pvE+cJkp1+t1BdwL5zLdv14N1-3h-Zzb-Dy+V17-7Lh3brcf2McOzEB7cyUg-rVcfgNLkUbtjvQsO4Opt485SzAxpPJg91NCCkpv+uB4pZZ588s2+33nOdMEnDQOzZ731LpcGFc7rcf2pn9gvtf41b25XLBzG$qxbUW6ttMUmxgaDbFSjfUWaY2lZlsk7YN3y8IPm08TuTHzulGNrkACG6YA12$2EgCLnEuWBtJwkQBZskPG0CFMI-pK4yUbg8q2dD6qKEZIsV84$bjU-OCL0uUC9wtWkIpqNG3MWfMPV2-6g6KDBbdYSCA0GGGRGfQmlc6uTqsupN2a$kci9M-QqxXjG06g0ZCZbN6Y7CfkiQJGuMwTuitP0W6CbCEXZ0GGlysnDjGZKks0n2Zs9xkbZufZk2NHAN1pKwYZ9HbshsP07z2BY+zOS4NtDt99sC0GO2YGG$sG2652ObGGzsELgh$Gi6B3QUG+G+2xqE$5bcGAlz8hcsW$soFr+ZLwhhNBGx0Gd3aGAVkb2$sGZbAhhNvAYXFYks6UV2NDQBv-AH7zPWbGo$EGdGGMGQ2TGa$U4HxSbGAh5xDMG9f5U6J12DRO6l8wqGlMQ2yb2$JXcswbGO21GG$aWxqHvK7hPRUjs9cAG1kpG3RgGwI-skrPZh1GE$JW+0HhJSlCbajtsw6qPAmOIGjUOpQUAPGG2pvxAxYBMGrtGbgivYI7D2rV$suG18lI$oshVisKDgsClCDAG3uGQCXG+uwMoPkZ2PQYPYKKIbjRJCQCg8w5lWs57CbWQvYAI3QKQ08yB6BcGpZgHJPQsaPPuNikv0L0pTKDkt0ftvAZ2RD95riQK4GqgizjoYF-2fI$gs6d3MbqbwpkuGDwbN$5iWGf+bAbGAN0QXKqsAkniSqGMGBsLc4GsP8+YZ1c8ZJrbGsQuNQPWW-zZGJGEk8SqPK6CCt2nG$QMs4sZbpQYsGJlIGCFlpw1ZjrzQCSIGlpHwH3rZQKYtsDUGGkCJ5JG322$PEycP-Q9Hc11lnChvk-ussy9+tAqaaGoKvTGG4WXk0GG"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 07 Dec 2025 19:05:07 GMT\r\ncontent-type: text/plain; charset=UTF-8\r\ncontent-length: 0\r\ncf-ray: 9aa64aec8b5e568d-OSL\r\ncf-chl-out-s: XoGmu2xo3sSHd7DwcHWHyZkYqlUnalJtmOdPqQSwvVnbh11PmAWO5wrlBRZa5SLeu4OUInUxBHQEwI+1T634JVa4fEmQbKy9BLkVDQLHCFGHxC4C3RlrKjwJgGUoGoH7K9aUNsph93Iirpx7pA/DhvHuek36pTtTw7HI7QsJlac5ejEe5PIK7dn2e4gO4z1SvwpbONCT8N+LMFAp7eDr/4QHgrMmk6gvii7nxpcamyGWqXx9BJT9HggQrG9haysJSv7U/scKk9BvHtUirDb96A==$bHnR1rSbwY9hMvGyvQ/nsg==\r\nset-cookie: cf_clearance=_xy_M2b3nlctRh8LvibxxyQLpMjTfJUvKqkLFN2IND8-1765134307-1.2.1.1-p72Xpd.DEmvwHzne0uPAfXoUxRmRXQyMhMLD6moGgDgrRVZsgMLxZDhzZMyoS_z6w3G49V6IEMEK3kkiI9oqX1tJ9CxNfadqo7iY7SW8t6kAE5XU_PQM42qs3S31lyN_3QRjpgB8vgtGn1Af_Dqrr7phe2U4lyWboWD8rXFj3RsT3WVXHgvRk_O3AfYauXb7PBLKFDyHKfy2PwLBAqztRZ4mbPkT8.0oxZTg3qRj.c4; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=usecorns.live; Expires=Mon, 07 Dec 2026 19:05:07 GMT\r\npriority: u=3,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=fXLn%2BI3MAwOi5A9SEJHboW5lR3c2IrjSC%2FKh5jcR93SQ%2BJEyLGSPSw0ZwQCq5SOtGrMl3BFzPYiUchyK1ZWNWyPmw9q4uO919V%2FmqzFgWmE7Oqc7wC3SgiVAfsjuOhoy\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=3416\u0026min_rtt=751\u0026rtt_var=4872\u0026sent=478\u0026recv=83\u0026lost=0\u0026retrans=0\u0026sent_bytes=523996\u0026recv_bytes=22315\u0026delivery_rate=20268710\u0026cwnd=30000\u0026unsent_bytes=0\u0026cid=77379a3c0ec7a346\u0026ts=1642\u0026x=1\", cfExtPri, cfHdrFlush;dur=0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T01:50:58.104205Z","times_seen":17490279,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-07","alert":"Sinkholed","trigger":"usecorns.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}