{"report_id":"d372776e-9acd-4d1d-971b-9252d4bb4005","version":0,"status":"done","tags":[],"date":"2026-08-08T06:08:15Z","url":{"schema":"http","addr":"sigma.metaeora.xyz/","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"sigma.metaeora.xyz/","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"title":"Staking | Meteora","dom":{"size":339247,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1117)","md5":"0a818ead7e86afe62391cc0f364d67d5","sha1":"53939b48c80fcc5233212f0e1079678e57520e55","sha256":"6f36a5a078506ce9470d2eebf023706979442b65a39f223e91949e0264f3b6a5","sha512":"9b7845558d81f6d25bb511f26f79c5d554cdc0398c5b615d4cebef8617e38f1c07dfd49fb9a9d932ecf62eadbbec931b4e7374dfa436e1f359e455376ff67f11","ssdeep":"1536:JjbC2wk/kAoYGBP/+kv4rHJlP4sOdVVi99BLGvOY2OsN8wof4MH+UwF1lmHaGic4:lDUCDnx","tlshash":"257478b4a1f519bba197a5d078328f2b3ad1fa0bc95b525136ac9fe00fc7c92ec13145","dom_hash":"domhash5af6dbf25871f95491273c12f993eb5b","first_seen":"2026-08-08T06:08:18.839381Z","last_seen":"2026-08-08T06:08:18.839381Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"sigma.metaeora.xyz/","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-12T06:08:15Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"aodefevrgdkhqltdnwgzbyjoywrlbntbhfwq.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"corsproxy.io","ip":{"addr":"104.26.6.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2022-01-30","domain_rank":175528,"first_seen":"2016-05-19T01:27:08Z","last_seen":"2026-08-03T12:35:15.605319Z","alert_count":0,"request_count":1,"received_data":632,"sent_data":584,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"solana.publicnode.com","ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-08-16","domain_rank":0,"first_seen":"2025-10-03T14:04:26.693295Z","last_seen":"2026-08-03T12:35:15.481981Z","alert_count":0,"request_count":2,"received_data":1500,"sent_data":1081,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"sigma.metaeora.xyz","ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-04-20","domain_rank":0,"first_seen":"2026-08-08T06:07:59.806123Z","last_seen":"2026-08-08T06:07:59.806123Z","alert_count":213,"request_count":213,"received_data":1550427,"sent_data":110302,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"aodefevrgdkhqltdnwgzbyjoywrlbntbhfwq.com","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"2025-10-12","domain_rank":0,"first_seen":"2025-10-22T11:51:07.746032Z","last_seen":"2026-08-02T04:01:30.77454Z","alert_count":1,"request_count":1,"received_data":954,"sent_data":589,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-08-02T22:44:21.067894Z","alert_count":0,"request_count":2,"received_data":221181,"sent_data":1146,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"sigma.metaeora.xyz/","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"2b8d255ac7fa98230df8646fb8ef12d1","sha1":"e32a7fe97c9772724c2062ec65ae22a48d09bbfb","sha256":"d2cff75c2b1f15647e752ec896ae07b260c932486bc5efc06455fb5715edb066","sha512":"d1ddd76288f844344beffe18171ecedecd618e5a79d1c2b61b0ebd7f4b4fe45cfc0f20969b9001996d0eb567037947e1cb4bccb82d17674ee3e33d92548bf244","ssdeep":"12288:gmaq2Ag+Jtq6K9NjPH/UQ/luSqXZ+Y3LNlWvYCnUfJDSUDM27OPVxfmbhn+sfU/v:g5qyuSqXZ+YyP","tlshash":"f084ec060dcf3407a34da63558636b7dfcb0ca0267a3ac39a942e2c7e8d4e8e55d917d","size":404787,"data":"","first_seen":"2026-08-08T06:08:05.740259Z","last_seen":"2026-08-08T06:09:30.258686Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/main.php?type=js","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"803c770958568df36604349f4c138e38","sha1":"b137a18a4c325cae854154e10574a0b2dad10559","sha256":"f29d175a5a550f27b665d83030569da410f979dad1d6fd81c817fa4bee4e232a","sha512":"7a9d30d42e421cd5f760237aa4209328b252949fe8a73ad436507a40eecb4ca265d7b8efd900c28298d6f7c7206c5c23d29f9509531c3c452db0a39b1c6cf6d6","ssdeep":"192:SPuyS6EvZNlFielilPwQ70GrlM3ovyE0ZEzW1tOhandDJnmn98ApTqt7gTSoYpKp:VIUfl3BQLlZaE0ZEykmiSpXVptg","tlshash":"1922719cb4b6217086f362baa7dba715373520077084c9483fadc1c41fc1aa166a7be9","size":10323,"data":"","first_seen":"2025-11-11T22:26:53.093024Z","last_seen":"2026-08-08T06:09:30.235127Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"b19b821de5e3ff0ba527e0b652f0a08e","sha1":"693f06f42ec4411be1184c1e52023c6055a1b0ac","sha256":"d79c2a7dfe8e16063e4fb2475445510d4f24a1200a2a6ecbb59b61b06c90986e","sha512":"0ecc8d20ac2d374868657c0a9314cdbeacfd58487191ec7168d0b764444197d1323f180dda0985a44731a1e2a6001d51992b9993c9293070882422f6ee5b758f","ssdeep":"","tlshash":"bff0dc1a307d12f086ba601fd3db37b8a1341207388ceaa739af52090ec2b21c5f48c7","size":493,"data":"","first_seen":"2026-06-24T11:44:40.330473Z","last_seen":"2026-08-08T06:09:30.257975Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aodefevrgdkhqltdnwgzbyjoywrlbntbhfwq.com/@v1/cdn/js/autocannon.custom.cjs.js?t=29769487\u0026u=BbCtKN-96j8Ci3xVGDY5MjU2NDRlMjhjZmYzYzM0MDI3ZGU0M10v7qMJXFJfV9Oc1g","fqdn":"aodefevrgdkhqltdnwgzbyjoywrlbntbhfwq.com","domain":"aodefevrgdkhqltdnwgzbyjoywrlbntbhfwq.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"723c25877a86786664edc4b643c08a6f","sha1":"995fee1f1a7eb3a2a935514f6a2573327568f3f3","sha256":"60945d49535300be8e42108658dba31fcd5d665fc40d6f186798e7e0682320ae","sha512":"09065d79c37aebd0059fc6feb4d8f73dd058755d5ad03c889bac464b93fbf53516add410b94af992b1892672f6c807b6c84c3b3815269be1c23f0f1865fc3577","ssdeep":"","tlshash":"ca500030003030003000c0c330000c030cc0003000c0c300000003000000c00f033000","size":11,"data":"","first_seen":"2026-04-20T04:40:03.433055Z","last_seen":"2026-08-10T01:54:16.192948Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/reach-router.umd.esm.js","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2bc08603fba4c1c4ec27b465fca333f4","sha1":"485d0e6614a9a373095bd075137466fafa6263e6","sha256":"9c183574da9b02c0288cb1a0034e17287efae5f0b149b3973b31b5ecc21f816b","sha512":"9a6fa39373fb755f9d08deb7ba8efedfa106501fa21b5c787dda8b1322895f9b5f3b127597a6f64edae058836889b7af33b9faa1f6ed2c377905ada2c38ca306","ssdeep":"12288:4iw/Ok/A2+ztu6u9NvPHxGQ5PugqhzMUHTpjkdYwRmffDS6Do+1OP1LZ+Pn9+sf1:4n1HugqhzMUiC","tlshash":"1794dc460dcf3407a349a53558636b7dfcf0c60267a3ac39a982e2c7e8d4e8e55c927d","size":411971,"data":"","first_seen":"2026-08-08T06:08:05.185614Z","last_seen":"2026-08-08T06:09:30.248045Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/buzz.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.253Z","timestamp":1786169267253,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/buzz.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:42 GMT\r\netag: \"68cb8eee-338\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=npEw8BZhhzDW59inRWTJcLiKzr28jfyf%2FfARCiLKsf7Uw8ciU0jy0dwu%2FoPbaJO9LXpCEBs%2BDxzNgSHHF8E2YtRgcDYtL8MSsXaAHDkY%2Fdczy59Gg%2BGq%2FtAPI2HhFUCjJ6qNr%2FU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c04d32c759-OSL\r\ncontent-length: 824\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":824,"size_decoded":1576,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x78, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5b16b2bc71c10cc639ebf2324ea4d567","sha1":"58a5e2420a5801d3060b8ebffc6b35968a2fad45","sha256":"69b5448d0c6f3e933190397223691a6c0453edc9eb80a4bb8efeafa8839c0b11","sha512":"576225587f76ea96f3d1a5fbc6ae2bf76275c43eeb9f39e9ca6b09d79f0f3ccab9cedfc0547467cfc1a4a0b1ed07f7872c29fc03829f98417d1ada15f185d70f","ssdeep":"","tlshash":"0101861097f748f5c16a866b3e627ba301e7cebd563e26400d4ab39ac9400a7b93813d","first_seen":"2025-10-31T04:50:36.900748Z","last_seen":"2026-08-08T06:09:30.248552Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/mori.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.274Z","timestamp":1786169267274,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/mori.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:47 GMT\r\netag: \"68cb9583-a30\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z3vf4RAbYzHpnuKFau4EAsEyqiV%2F4TVEDUZ52HKon7fUjK7ZEZ8W%2Fl7eypTQKYUtCDZSL8tvd3fCxjQ2fS%2FvMWELUEO3rV7uPv5tb3qAe5U3uXWDYiWIz0ogJRq0Jr2gHWckHCk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c07d47c759-OSL\r\ncontent-length: 2608\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2608,"size_decoded":3353,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"51cd1d70f32efec530ee7b233e833371","sha1":"6a421761ba953da7bbc40352b27c31d0fae9a487","sha256":"e41337aae65b1335650e93158f632a838ab25b5a47210d1e7cb43ba85a1fc1fa","sha512":"e7205a9608553e6bb43f331ce456e5593fad2a358be04061e8491c1eca77edfdbb315461862ee9fca2d9038a417d67976b0a8700065ae1b9383e30a4bece3548","ssdeep":"","tlshash":"16513cae1e528878d0d44e17c2c066b72881d533e804f9d334e7367b77c4b32a94c70a","first_seen":"2025-10-31T04:50:36.853391Z","last_seen":"2026-08-08T06:09:30.253042Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/labubu.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.305Z","timestamp":1786169267305,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/labubu.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:44 GMT\r\netag: \"68d0d400-7e2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p%2Fn0Pqre69L4XwMjwJWFf9IlsevXA3r9SqewtWwlWIt4gHrWQwZli2dEDueyyihaQi6izb3qQLfr9vMrVQC4G54QsJrxIlnpK44yIP7WYgG2DiDb%2BPJCPDjffeq8Ixi2Jf1Gx3Y%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0ad71c759-OSL\r\ncontent-length: 2018\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2018,"size_decoded":2761,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x102, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"66b92fe6453089e08c5aa34d124c3a71","sha1":"9b35ca779363181a605cdaea5cfab869b18f9256","sha256":"bff8360d01daa20c09f9b1c98739c124e3807723ff489ec7e802766aa93a2061","sha512":"fe7b3d1c2282bbe7dd0109c4b22daf5b1e5e2f37b6a3ca3b9d698c466aef596ce60e5dd1b0ddd93358a5f8276f4132cb7be5c897e4c3d05b2a1ba0a7e60596ea","ssdeep":"","tlshash":"cd412a11fdcf0d28fd82cb71797a8ee14dc15c937a2086dd0d98904a0a6b8387983b98","first_seen":"2025-10-31T04:50:36.743993Z","last_seen":"2026-08-08T06:09:30.211583Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/nos.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.311Z","timestamp":1786169267311,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/nos.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:49 GMT\r\netag: \"68d0d405-3e0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZwIjK403l9tuBVZePkXu72fIJKxZZE60xGJsJFWKSIQf60A%2BMsloVEKMp8l0uVpVIrDhIRKqh5D4H4RfbDa9eGPPqaIuReihUl8UzMyN2UbWhlZGOuSoYt8tFqnUI65oUZj9scs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0ad77c759-OSL\r\ncontent-length: 992\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":992,"size_decoded":1732,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"864b2323d8987ab96d61d4166059e55b","sha1":"0f491b8534524aa916953c725d870bdd1952ed95","sha256":"391029cd327a3d9eba39afbe211545b89c32069bc4f74e33631aa1a53d461704","sha512":"77c953a7d0965f1b2e9f9d2cd49419bd564edc7365a7dcd143ded780b9587dd06b0356df586806cee5d4997ce24c935ef95855877eaa17ca1f72ae587419345d","ssdeep":"","tlshash":"e5116549ffb03b1aac1776a864e91dc78c721105065b058e55fb843398b02b8d505b02","first_seen":"2025-10-31T04:50:36.876461Z","last_seen":"2026-08-08T06:09:30.215839Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/gohome.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.398Z","timestamp":1786169267398,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/gohome.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:03 GMT\r\netag: \"68d0ef7f-3b0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2RB93UAkerrGnKRvylG36y6qzXoCMkTmjlm6U6O9hrklGewPWPZdeVr%2Bv1eBllP6j0xTOMKPy0oJPDNOcdZbEbWFnCMR64vHcFigXPVAzCZJpFaHua3ErSAzeuhWcBmB%2BmW2bVU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c13dd8c759-OSL\r\ncontent-length: 944\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":944,"size_decoded":1686,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x73, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"884c88aa96c856f26b9a9a564040e3d8","sha1":"3cb647235b98095fec96073a6668eca4ff1ae4f2","sha256":"fc82eb1bd48c752bf692264fd1f4039ed1bc1880029872d93abdbcdd3ad9346e","sha512":"25c5b0134293899c8fa633ecc0753533468edf662578b2488a9cd6c7aeac1c5fc18d47f0b1870fda98f3de24be946793ec3f2537e81be120dbc5d65b1b203101","ssdeep":"","tlshash":"f011545e56200a40e5387eda8c6b768816d66174c87e2dcfa1789002acad9faa041c28","first_seen":"2025-10-31T04:50:36.995667Z","last_seen":"2026-08-08T06:09:30.169187Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/testicle.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.446Z","timestamp":1786169267446,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/testicle.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:42:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af362-848\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ccRWcJ5RMAmpeulOXMDPKkGCU0rppXbJS8UepCgxXznaFngGDIsHREJgogFyjBqeZUb1Ds50BvhGT6iC%2BMga4sBZyUZfOcb1iGlKI%2BuOck1wsaptFDM%2FgZj72Ccr0BUwstbmI8o%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c18dfcc759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2120,"size_decoded":2899,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 90x90, components 3","md5":"e250743b37ed158b96195ad30e9055e3","sha1":"0d3b7ebf555721631d3bb39e3284e20c870c95cf","sha256":"3422e69706a1e68851a0f71ef34bd4d7c16d815c8a87f424568862d9890bc5f1","sha512":"856721741a6330d227debf93f8bdf08dbc5542e5cce056a2d6e07d37c6e8d5be91ceff8fda1e0bd2d697111bf75969063b7771fc6a80c29732515d7bcc26d74f","ssdeep":"","tlshash":"194118576a4db090ebda0d38dd6b5b210e987a201c8bfa3b3450671489adc354e0a391","first_seen":"2026-01-30T00:58:38.196017Z","last_seen":"2026-08-08T06:09:30.108772Z","times_seen":43,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/$hachi.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.473Z","timestamp":1786169267473,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/$hachi.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 07:19:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca2408-a4e\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Cf%2Bwse%2Bi5LHWpBaAtXVT1CZB728KCZnwlTluxAgaiAmRr4jF3p7vLZmd5TBF7n%2BEPgffe0%2BFghS7tSgVZW70FkNWZl7V5D%2FXHK8K3%2FQySNMUSY4XIlH0V1ekqoURIXJoe6Rfnok%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c1ae10c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2638,"size_decoded":3391,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"a011e11e8368bfaa195f01a82f21bcde","sha1":"beb8cbe73b0ef6c929615233e28984d26ed7eb92","sha256":"44e7db1bb94bfbe44e474d1c73a9fbc2d050f0b9d190d0e50990102a6e8c778c","sha512":"f3d4848f6e1a93d3c872d7543ef493be5a6822d3bc963959fa49219bb5945b1b4e2bbda55670ca59cf5bb4c1119a04a2fc08df21e3d8d1e0e989a3e0bac23ae2","ssdeep":"","tlshash":"1f511acf9e654293e11a44b2279dcd0cbac3882ca0bed654b7153960d70f0a12e979ec","first_seen":"2026-03-31T13:47:07.210768Z","last_seen":"2026-08-08T06:09:30.244099Z","times_seen":21,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/snai.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.294Z","timestamp":1786169267294,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/snai.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:33 GMT\r\netag: \"68d0d3f5-23e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c53Nzg5iYADp5Z%2FVCXl17JF%2BbJpFGuHwpATsc9tRQKD9GvAbDkCENDRm1UM9LUfey3fR4C8U1Rsnz96FIlqZs8%2BOAkoomvgOKLdOa%2BbDtIFMqwIBpj%2FDNKxzTtAaKojwXpwzLtk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c09d60c759-OSL\r\ncontent-length: 574\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":574,"size_decoded":1322,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"e06b796b91efe1b0c8c7a6bc9b98d17a","sha1":"e64a69c8d79dc8dc2a48b4d820727bb62e803402","sha256":"9cdec18ac22f628cf1bf0a56a9594b93ee7f110c2fd58dd81ba44a824c86678c","sha512":"96002bcc32561b722fb4c892e2243298f9bc9318d5649403601ccd556b4f9dcde95114909d37b51d986b0dc7d918797bbebe85bc1bb059deca6dbe4158c9a4df","ssdeep":"","tlshash":"aef0415188fcd885da204e313159409ee46b2408ab88d16c181628844dff3537b60222","first_seen":"2025-10-31T04:50:36.753929Z","last_seen":"2026-08-08T06:09:30.152562Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/monerochan.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.416Z","timestamp":1786169267416,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/monerochan.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:15 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d2643-bad\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7M6zGQSvvmY9iI%2BE41LW4djucu8SkQmECvLRAo8elN13pM74ou0RPuJ8NkdXXcJD%2BmVZb3W9zzoV%2FoSHl5POEDw1RPe5%2BS1T69uOwRwUfGtkUqkSfPtzll3udPhERqDVya4WZ10%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c15de3c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2989,"size_decoded":3810,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"d7520ef343a05170c6eaf0d5b591220d","sha1":"2ed73f29cbdff6cde754e682096b37695cabcb2e","sha256":"51fe70b7b44ffa9fbc5f4c0e2507f9fbe27ce75a743c94232d3ee78b2b64e033","sha512":"d479564fe3cf0629c99b259c959f6340dc42a90785e02dd195d9185dbfd9b22d2e751b94461eed7421c6dd09045d8ad45b33c92239c984e17af017e99a6444fe","ssdeep":"","tlshash":"e1515ceab0b39d8cc73f1e89b71da6fc4bac59550591881db2404ca834d188edcdde48","first_seen":"2025-12-07T05:18:33.948407Z","last_seen":"2026-08-08T06:09:30.169973Z","times_seen":83,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/skr.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.450Z","timestamp":1786169267450,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/skr.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:42:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af361-46c\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0qPAmY7%2FgjxUj6jevYVhxH78ZHhJWrlW4oNPwZYZ5M7u9iLOyM8adX%2Fu97KrxZ6knOVTzFmH59AJ1hXHfUCwWH7OwITQbYNFq1lSL%2B9lOKQjsfWrjf5094KQY%2F4rSrcgZYjhsn8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c18dfec759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1132,"size_decoded":1832,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"aba255f632ecc62edc6db500222819e0","sha1":"c3ab5539bd2956d6ca28e2dfecaf93222d2323d6","sha256":"8007e7e4954feb9ada1f5b898c7370e27a2d4e89ed785f3e9ae96e09d0c68036","sha512":"3c6d56b15c2d5bb130a548e876b1575d576925e5ead242f95ab48461a16d8e2a05645ab094d5b085120420d57f5cd71fb314704947f54b9605ab872b0a1fe83a","ssdeep":"","tlshash":"312186db3223c00bf82f0c734ed9e6b4a6769d15e410275ca757410ab8de3c99441d50","first_seen":"2026-01-30T00:58:37.96949Z","last_seen":"2026-08-08T06:09:30.233558Z","times_seen":43,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/triplet.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.468Z","timestamp":1786169267468,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/triplet.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 07:19:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca2407-bd7\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nmFNGfYJinl5RNFPcty81mw%2FRoBkq9oZ0esQgSPRKyNyiykDCJq9pr%2BauEGiiPvyZ%2B37TPkDZXrF%2BKS1tTgcyZdGNQUrMQrnCtd8OvA36%2BUBUtm4PSmEZmztd%2FYg%2BXr%2B%2BsxjLBU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c1ae0ac759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3031,"size_decoded":3821,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"ecb8d582ec3e7174c90adce5e2989b2a","sha1":"a48bbd9665e7504c6448df07abc43cf75c8b75c3","sha256":"25e562baf9eb2d3eca527ee5c4b4408254eeed7cc16bf57961d8cb89f100c4e3","sha512":"1b20be1ca36eb3731071a8bda39c4b02a884775fdacf97a64686750fbc108c8bc83448e198a7cda0a09749933797b30c2a5935925dbb7eaf5ed47554af8393a4","ssdeep":"","tlshash":"23512d7b06b21117fca9433d0db29b219243ed27990d8759748fc3c5257d7dbcca46a4","first_seen":"2026-03-31T13:47:07.145541Z","last_seen":"2026-08-08T06:09:30.173871Z","times_seen":21,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/nobody.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.258Z","timestamp":1786169267258,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/nobody.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:52:00 GMT\r\netag: \"68cb8ff0-3a4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iu1s4f7wS631Sum7CjSMghvi%2B8MkdKFXY3DxL9ZT82FwVXZBZEyFxn9Sf7X5lMv7M7%2FE18L4sJ8wtVnRWWRbBHc0wz8USK2vmx7rBm1RK6eYcChNKVYiLNGasaHqhGrOGAh9gxI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c05d37c759-OSL\r\ncontent-length: 932\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":932,"size_decoded":1674,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"50cf234ca25e823f1c35bd8259c9829b","sha1":"31ba9af4ec48a240720cdd3264d647ab2bf9deec","sha256":"0113257d43eb4964175378289a0bf014658fb1fba853ffea076ccbc1d261329c","sha512":"0cf4b1d1d2c00ed944c21c9353779ca3dc9f636cf1ffe9c931616fa6695aaebef5abfe1cb3a74eda062db05f0e3fdcd0c9fc353952a7a3599d36d4dc0f711325","ssdeep":"","tlshash":"de11fbc69a4f504ced535f187d09cff4240f19749ed24534c60ddd054a3a753442fd64","first_seen":"2025-10-31T04:50:36.725158Z","last_seen":"2026-08-08T06:09:30.249009Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/moby.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.301Z","timestamp":1786169267301,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/moby.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:46 GMT\r\netag: \"68d0d402-5e6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U%2BFlpN0wXijWxkWPmfHQyfAdM%2FlxfDMt2zSbu5dmXNE5jT3%2Bx%2FV%2FVrIErGlqivUi%2Bfp9k2bXpGWOxKusTPl%2FE8ejqeKD5clLtHhFPRzFp2%2ByE4yD0q22aTacRaEkomWAvvuTHck%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c09d6bc759-OSL\r\ncontent-length: 1510\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1510,"size_decoded":2265,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cd66a95f7bdff38a9d7700ad6612b76f","sha1":"7dcd562d055f4b028ff4583021c1beae004f9580","sha256":"cdada8aa788d4ef5d72ad7f361fb60414b48cc9415859ec6d897aaaf080ce0b0","sha512":"1e7b158eb61381a948d97c2f074343a5a01e939b32e6f39b3631d9903b033c07860b88156ab3ff51e0cbfc97dd02766d7010f3049f717652360ec26f3e834ce0","ssdeep":"","tlshash":"3c31ccbe3961d8009e2bee1481fa799c0f055c0b90502f1d9378d5c9d394b37501d5e1","first_seen":"2025-10-31T04:50:36.986636Z","last_seen":"2026-08-08T06:09:30.137649Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/tdccp.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.239Z","timestamp":1786169267239,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/tdccp.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 17 Sep 2025 09:08:25 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68ca7a89-b8c\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wuC4KuRcgnOGAbouasVg3Oc%2FFcwTBDdRTqob0yQzu68gCC%2B0S6ikob%2F4W4aNTUtxiBrLaKffRyBQuKLwC8BKYEjuqk5K9%2FDKWnn5nYoagAebohkgabBn0vzAfoFMmMR9qgbwRHA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c03d24c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2956,"size_decoded":3777,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"917b7e8b3651441710e8e7a841e57019","sha1":"bc232b09cc496ec5fd10b9d957c4bdf7334fc0b5","sha256":"82fa67f32191e0a48f3d4037f73146c8563bb7bb5ead8e88865a3ba937827893","sha512":"075dff3021dfc2bb9429faae2a40a86c40d41d4d61c26662a3db495897c346aee95a437622b7854b324ba21abdf316161d1b20ae9e7c41b41b1bd0d2f0227f28","ssdeep":"","tlshash":"21515a6902a30e2caba327f21dbeac4079a07048df27c2685723097b25b46c3a218810","first_seen":"2025-10-31T04:50:36.871786Z","last_seen":"2026-08-08T06:09:30.199971Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/goat.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.248Z","timestamp":1786169267248,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/goat.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:44 GMT\r\netag: \"68cb8ef0-5d4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oZOWJ2L6M3FknzwIGcUkc6phrNfyPoR1rHSZQgGmPjMo1yyRcYrv%2BaJ2gx8y55tPElQIv%2FdXlItGdC4SSa1YnOI4BxlYzSz8zb1R7lT%2F%2FiC2koi%2FOpAXQmW9B6Il1A6N4ZFKcn8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c04d2dc759-OSL\r\ncontent-length: 1492\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1492,"size_decoded":2241,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bc8b2af6e2767846e8ce460afa140163","sha1":"9749e1ecc8e3a690f82e9234e4b155d2dada5fba","sha256":"cf1e9c8b224416ca3fcecc49d8b99258e2886ec0fd3c741d854624d7c59a1e9a","sha512":"33edf74311bd16007d03aecf2d7da037fcf7317ff4b5f9b4bd764c1de613cb5a109282c61613675c1408e560f4800a89d28665a198bcb009f9a49ab1705a308c","ssdeep":"","tlshash":"0331a591e39e272dfd002b34b4d48bb0c6fa3e118fd6d366c64405659eac9c0da6c79b","first_seen":"2025-10-31T04:50:36.922382Z","last_seen":"2026-08-08T06:09:30.110542Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/gear.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.175Z","timestamp":1786169267175,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/gear.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 06 Aug 2025 13:59:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68935fae-4697\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Y24lUlDqpiOXSTQ0ZIm3gpIaU5OZNzc0M8IzVwKoHOF5LMGGA3R%2BSjSumqko530889%2FiRkzPAkx2Kw1wNG6k22trVhZ1%2Fe6EKiftq3MKtjIxpeouZnjxbOzuq%2BZe30UQUoAOcck%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57bfdcf1c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18071,"size_decoded":18862,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"f9cea30d1b25657c2bd229c771ecb32c","sha1":"f0e6746ad83a0c2ff4e49ca97dd909349d840475","sha256":"6a214077be6204ab5810a7b9982fc21ba7f6e3ef204dd006cd5a3be6ca597554","sha512":"78a559836815b1ced3d56a76cc79220376f1bde4fea7b4f07c921464d0a749fc3336645de35a95c5962c4f37f255c8c2501e06e76bf871d4d671b19f8e07be5a","ssdeep":"384:qhQR8rD5LBuQQyii+Xu1zvGsswHJSllAGUqsuyN9AihyPU:mQR8rD5LBuQQCv7AHUbu+jyPU","tlshash":"ac82d1e022cc08d2ffb74b6196091af08262cf8f459a9b39cd54107757adf7521bab49","first_seen":"2025-10-31T04:50:36.96906Z","last_seen":"2026-08-08T06:09:30.129979Z","times_seen":91,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/wbtc.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.201Z","timestamp":1786169267201,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/wbtc.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:34:49 GMT\r\netag: \"68c92f39-892\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=emer3BkrpHgimewT12YOmqIzjjidP%2BZ%2BBNYm7gq0GCZ%2FkS09Sq6R%2FXYZiOC5ZY4RHHJAHoZadGBS%2FDQGCgY%2BjzMeQtmUfUf2hOB7pRu9Ly3zWYmy7EB8I6ZFEEtnfZwDEmcmw5I%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57bffd05c759-OSL\r\ncontent-length: 2194\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2194,"size_decoded":2945,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"54dfb6ac3eb5dbdc2886736a8a8ad40e","sha1":"f91f72930f84d572dfaa2ab433ea9e2ce6dd72da","sha256":"b2db9e930b0fe28ebfa5de84dea96e95ed97e007aca760112feb6e57d872e9e1","sha512":"1747e7bff68a5a0dc555befcd51b2b0a3d47b531001a892aee616519b1e83e88de525b7e429da4aec699e9784cacf79603b14ba69517dc4e0c66e28179cb61e0","ssdeep":"","tlshash":"99411a3b06848da4cf10077d493b179707953b982741c1b31becbf582c3b1ada7d8aa1","first_seen":"2025-10-31T04:50:36.990276Z","last_seen":"2026-08-08T06:09:30.200848Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/fartcoin.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.225Z","timestamp":1786169267225,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/fartcoin.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 17 Sep 2025 09:08:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68ca7a8d-ff4\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EmQpaTt24TLJUQIq3sgmLsl2Ld4noSbWRpLgch2PJYthM1LMDW%2B09s45BezO8y1GHLl4IhvI75wHGke3khYWtxst73qDxuEtcIQ6aqER5H96uNx1cRPaU6HHgaBzj5szf7mka0I%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c02d1ac759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4084,"size_decoded":4727,"mime_type":"image/png","magic":"PNG image data, 868 x 245, 8-bit colormap, non-interlaced","md5":"7d04f03fca023aff1dcc6bd02d391c17","sha1":"e5beb1e748fb24fe625987be9037dc5d79158030","sha256":"a050e7f7dc3428fb27367f316eed4699fbce70715f5114ccde411da582d079ca","sha512":"1e4e317c5f2f1103674f8429e0775e0ce8604bfc6930e209571f44bdc241b4a468fcd513955ae7e7b342b018e482f08a432776b8ae0635d6f9a7f4a5e9ca865a","ssdeep":"","tlshash":"4d817ff0d5f4d051cc038a3408378fbf59526c3954d929fe8650a7df5993e11a942f93","first_seen":"2025-10-31T04:50:36.824141Z","last_seen":"2026-08-08T06:09:30.22439Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/fo.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.231Z","timestamp":1786169267231,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/fo.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:31 GMT\r\netag: \"68ca7a8f-780\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 21\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f1t1VgZlR52VFuK6vJVpme3O5ZwwRJH6V0N0ZViW5Iwbg%2B%2BDlKoJUzyDsrlt7y3MqQ4DGCmj%2FRGI5m1Aaj35JpvdQE4Qw8GiLmzD7TUgROVaWm%2Byh2EHQR6Anx3xR8aTzG0glCw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c02d1ec759-OSL\r\ncontent-length: 1920\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1920,"size_decoded":2667,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b0792696a40fe30e6118f0c91c4d9080","sha1":"00550fb3d0d63da43f28c80518fdb2f5f5f9d2af","sha256":"f79b7046e19d7c864c73d4b9de69efaa4f771620b0efb376ad0c1f638af15ed1","sha512":"6608ef60312a193ac9ce90afd7d159cc60bb3f5d3c6d3d4929bc520c4d431628168ff3e28c2a7968bf7a14217f452a24c06c67cc77e4794af3131898d8d8eb67","ssdeep":"","tlshash":"0141394712275a70dc07e2fc982327cb12bd8e0b9c48c52fd16a601ecd4a49f87985e7","first_seen":"2025-10-31T04:50:36.913797Z","last_seen":"2026-08-08T06:09:30.162848Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/pump.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.194Z","timestamp":1786169267194,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/pump.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 16 Sep 2025 09:40:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c9308a-3497\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UP4ufpwZYB2FDVJipNRqXyFNRb7JM6023EbSpWTfiqBbTVFuQM0qtdhVc%2FpKv1zE9W7PirKTm9%2B45qIdpZGJQhWsv1FHO83BiCJBxzn5fqBc%2BsgUSfr1nsGm43sxHovvvOjF37g%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57bffd00c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13463,"size_decoded":14281,"mime_type":"image/png","magic":"PNG image data, 700 x 701, 8-bit colormap, non-interlaced","md5":"e68fde5ff4ded2664bf71a6e3336e8d1","sha1":"111a98f1ef40ffb09ce69280ba1e318caefec307","sha256":"e73711710685d169e6ef7fa790a7c20820beaf283fadd69c5f62e6c03969fc40","sha512":"3b9287fb604eec089008d170d05e88ee5c748251f9949b7dfd1554ddb7f8e7bf9ea233e4197667b38b57451154c4ddefbe649501e566ce373c8e2c4d7d666164","ssdeep":"384:KjLuBTCSd4F+gmy5F7tarso1GpZA9SoS/lErGZnu:55fYxb6rdRAiSu","tlshash":"d152bfc0077fd4449a3b3f8913d8b7536e41a3df3a1620ae51e29d957c177176019e4e","first_seen":"2025-10-31T04:50:37.016495Z","last_seen":"2026-08-08T06:09:30.19897Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/cards.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.229Z","timestamp":1786169267229,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/cards.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:29 GMT\r\netag: \"68ca7a8d-518\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jDy%2BvkndKY4psegLgtFZigO%2BrOiTsYfsm0Pkn5LUBxz0pLPHapyrg68NEC0dWlv%2BPXF1HDeqyVRg8%2F53i1tZgDWrSDv6ar2ItkIsWzhCXd492azvaDJiRpY%2FsJshTTXgi1%2B%2F2zw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c02d1dc759-OSL\r\ncontent-length: 1304\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1304,"size_decoded":2057,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8330dd5f2b43db360089e59908119673","sha1":"bd28be6d93fa6ce3975e2b64f2ca2bd8af2c152c","sha256":"7565226b687289596b23256419a737621abf325107589b8ec682b2be80853efa","sha512":"a32c4f06f4c7a717bc62b1bf2e2caabc080206d1023f3716274a7fde6cd249f2f32de54c9d2d1371e4406f5fbff5db31d4d645d0b5068854a1523fcb78cc12d3","ssdeep":"","tlshash":"4c21b76f4170c352c04b043ce7a52f5aa613501507a5e29793a93e42cef6e75cf28148","first_seen":"2025-10-31T04:50:36.722449Z","last_seen":"2026-08-08T06:09:30.228758Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/main.php?type=css","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.237Z","timestamp":1786169267237,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /main.php?type=css HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kIooSyOASLOM%2BV3DZhER8vw3Xt3yyC74WrUhQE0CjiWQeq0dAmLm6gCVULLKYoT23%2FWnXjGVwwP73n5za77fWcLV8W2Yx376tdcocEtElDIxOHAgHA2qEt6YGcl61%2BWyrQ0px%2BU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c03d23c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21014,"size_decoded":6647,"mime_type":"text/css; charset=UTF-8","magic":"Unicode text, UTF-8 text","md5":"0021917f529d7856acac89ed5f06b9e6","sha1":"69711804796a713931bfea8becc940529d0ced07","sha256":"6104b718fbb632f013d6c1128ca3980703429b77b1b6a1e1ebd3928c9a1ad38f","sha512":"46eb158441dfc7c690c5829d2d702234721a6a53f1761bdbedbccdb0c19e8e3a9fa5ba6ba10e2dbc4f886bf5fdd2f3380a3da94d953ae756cc0072d38778299d","ssdeep":"384:R2WY8YVUwvI+QMxy+xnUIhgfsrFEzuupSLX:R2WY8jwv9I+xUkgfsrFEzugoX","tlshash":"259295da2ba60001352794b477939fab337c8507c10addbc7bf5605c9f893dd91a2789","first_seen":"2025-11-11T22:26:53.037657Z","last_seen":"2026-08-08T06:09:30.224988Z","times_seen":17,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":159,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/wlfi.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.318Z","timestamp":1786169267318,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/wlfi.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:36 GMT\r\netag: \"68d0d3f8-56e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=figH2iPok7d0LeRU7Ct8HG0OmuV1r7wAeGYVSeJ6spA6hnyyGyf5FyLrw9n0mpdNJ9hln4YGQ6elK18nPnTpee%2BVSXxAQs3G8Ipao0VdQU01%2BuNO1rHQr1pczeYN%2Bc83SX0b0kE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0bd92c759-OSL\r\ncontent-length: 1390\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1390,"size_decoded":2135,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0c599110e07cce7a82b546ee3c40dac1","sha1":"bb2616be2186d422483b94d1d3d61c4250ed2050","sha256":"d61da012182060326ba3ed5c8274e0b0375f271be3e03abdd43c4029a1678bf3","sha512":"9694643d50026d4699f371978e43b74b31fbe4195e1696364a6e1de6e084b992c8fc43cb95dc5320d2bc13fb22a151e660ed8e0cdd4f8a595ee6bb704f840455","ssdeep":"","tlshash":"30210b9d443d8030dc3ac0042c9b01878e57ad23f6657712db773587c30403e5e1242e","first_seen":"2025-10-31T04:50:36.802584Z","last_seen":"2026-08-08T06:09:30.251524Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/pwease.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.345Z","timestamp":1786169267345,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/pwease.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:15 GMT\r\netag: \"68d0ef8b-932\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7cAUMSZYCVZT3dQ46ObgCqxlAA94vc9GBmXfXzRg4RDATM4KApFv0ZUtV%2FkWoFFpefapgKCP%2B4IWY4OxxBTNZhr9F8RWT3VmtFkl6sTGFiEfhI5JGVLwtx%2BYH8BLVzbFMXXabeA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0eda5c759-OSL\r\ncontent-length: 2354\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2354,"size_decoded":3099,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"20492f42b6e0c44ff8fea5a93dcebeaa","sha1":"f17224e2403affa95fc3c14234e5c750b1f5f5c3","sha256":"1ab8c6426f3b80c42191c35f7fb76c97eeb44ba6319ed62fc22cfd44fc71c682","sha512":"ad6a5cb7e7b1281d184f7f220b1ff139e9d0ee9dcaf07c0c35a7bee98f18db6fa0c6134b4ecc2fafea1711dc2bdbd47fe430941602ae13a7d5c65d96ff343b11","ssdeep":"","tlshash":"10411a3e2a658cb76d36439c214f28807f0126d9142774ebf88a2245fe12d093768db7","first_seen":"2025-10-31T04:50:36.896886Z","last_seen":"2026-08-08T06:09:30.23229Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/mlg.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.400Z","timestamp":1786169267400,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/mlg.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:12 GMT\r\netag: \"68d0ef88-584\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PH2VGlLRV7aJGl78YPC56zVbdp4c5BOpEZFCaAE9HVXJroH3c43%2FivBBJAlfxsszG7Ei%2F7%2FPyB8PjP8GhnHVkqexBVJRPMOiigJXcm6TNEbMfNwspoaPOgkLujiO%2FSagOnwbLIs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c13ddac759-OSL\r\ncontent-length: 1412\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1412,"size_decoded":2159,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2d0197017c923224b450d723188e130a","sha1":"71977059b7a8bd03d4e814605811a7d5040c617b","sha256":"fd24783d813b0bcc8758dc95d3721bed91dd1414dd4feedd17e9e4e5932bd808","sha512":"be2cb492f1e15d85f8d7019309fc699c40b1ca660a7acdccde43c336d0fa2a53b6258ec676bb806220b5564389baf2898ceed56bd9cd582f6c7af7cb60a4b46f","ssdeep":"","tlshash":"7221e9e6c726b8e014d0dc5a6f5cf91d33e75bca6241e2141b4f95b778daa805524241","first_seen":"2025-10-31T04:50:36.842417Z","last_seen":"2026-08-08T06:09:30.159634Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/wet.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.442Z","timestamp":1786169267442,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/wet.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:42:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af363-80f\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jzg923YR0GS4pfd4ETfHltiBgjW5yUpW3Try%2BoGA4fVzDh0YaDA1nw928pFTcTAImoI4lXkW081HSeKrpy%2B9ivBOMjbWldVSSjN8mHQZ0XnjS8e5BUhk%2BJbtRli6uOj8KavsogI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c17df9c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2063,"size_decoded":2516,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 90x90, components 3","md5":"cd4fd80487ee42f2b2306f90fbc67d56","sha1":"47cc04d0626587244cd5d08806b15ccbfa6bdafe","sha256":"9d5b2ac3d1897964d56c6b299dd5f96ebddc44aa4895c681ead78f18bec096fe","sha512":"2d769f503b5d72f7be2f8bd7333d2df730f9cb7b2974995ff25d9fbc820fb8b4c076e36c4185165cdf3acc4079a1f27378c675b4278dc44bcbf989ed04a5236a","ssdeep":"","tlshash":"f541d9921f995308df1229b816d057a4eb593e368ea6cf7d40825706ba69cf08d5c14e","first_seen":"2026-01-30T00:58:38.099158Z","last_seen":"2026-08-08T06:09:30.15422Z","times_seen":43,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/dreams.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.465Z","timestamp":1786169267465,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/dreams.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d263e-7e4\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OW%2Bka%2BwnNptHVVCQRDfcKtJd%2Fp5DbEYJa%2BlR72q2fHWSHKLC8fecNPtUi8peyOlWMXiWoUc8ZbeO289qvGmYjtihA1XpLFhIy6ODn5Gk7ureSbYujgY9OQ4w%2FVsBpkNYdMZUFWo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c1ae08c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2020,"size_decoded":2759,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"fbdacde8d2b94ea861382d8d53a843a0","sha1":"a0970eaac2cacf399d4dd9e5d9c511521cc33d2b","sha256":"6975d95ed82b3547470049cd979e9e3fcd6b20aa7fff655e764ddfcbbf810206","sha512":"bb4af9a6922bce0e7b96ac1eb990544129ad89896adc83d50fe377cd61758b0d2cdcd6c7c9e0396774b65a4d1cba6202ef6de4737a1749718008d7bfbdafb47c","ssdeep":"","tlshash":"764108bfb381102fe71ba07455e5ad28aec95c15e820839372151abb78857e2b580655","first_seen":"2026-01-30T00:58:37.962425Z","last_seen":"2026-08-08T06:09:30.109348Z","times_seen":43,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/dsol.svg","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.197Z","timestamp":1786169267197,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/dsol.svg HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Tue, 16 Sep 2025 09:36:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c92f96-1f37\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7BkYzR9TEJ%2FcYPMDEBm9JGoa8Z%2BPc8YwIJaxtUhlEBU9RNQq0hoKxwO3QUczC8SFRZp4%2BFd2RIDIyxppNSGPPqWvItp0cSp3HT8RxYAShURosJw1ZmuQO2L8hIFHV8bn2H3iuCQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57bffd03c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7991,"size_decoded":1885,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"53b1389218ef221834c9c151014a0843","sha1":"386fcac9a2f6d9e8107c7b7383f5194cadb588aa","sha256":"3f8b6763ca76ca895c81bbf33aea58855e9a3a1e27530351c4ad7b0c2ace5290","sha512":"9bd422474b5f293c5561005ef15f21122301db9d63495c2e7acc59437c01718316fd43385a53b69a4c26f373dceed6a7b6c59db2eb9d335d65fb947bc6102f1a","ssdeep":"192:UWpGFsOZSB69c9WpGFsOZSB69F9WpGFsOZSB69Z9WpGFsOZSB69G9WpGFsOZSB63:0949t9B929Dt","tlshash":"31f1f1f6d28c83e990078778e853d9cd68882c7e9f915d8502c6bfab54b00f14e59df9","first_seen":"2024-05-07T00:26:36Z","last_seen":"2026-08-08T06:09:30.150287Z","times_seen":96,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/slerf.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.219Z","timestamp":1786169267219,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/slerf.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:25 GMT\r\netag: \"68ca7a89-35c6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wIWj5Gxkc0oRdeJ1WXhsZCd1FXiH0IEe1HOSKa%2BQIQqSNsEYsIUyrfuvHGDvydtK4CV%2BC4dNwufjqMAB04q%2FVaBrzAYwFXaIRFxovFAanQZzTIemuQzpHDuUR1VIpq6Ws8drnhk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c01d17c759-OSL\r\ncontent-length: 13766\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13766,"size_decoded":14513,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b17efc7faafe7ce6ab289c344cb5a7d6","sha1":"6f30ebb535f02d9875d83f0738fc6e608daf43ee","sha256":"93518f3827ee1246006ea0d2e53258fcdf404bcf877251171dda6a34e8667079","sha512":"7cf9f8006a7dbd13d2ca4fa8642b0ca12150ea80d285a2d81c70685affcef42fe6e6c4a25fa1c9ca418361a878358ea4ec570e663f92827b791313601bf5e122","ssdeep":"384:fjeRUjDcDJykI9J+yPz3HKBPa0KUxfVFI41o:wscDgkIuyPDoCWfVFa","tlshash":"e552c085a2b5ca65e80082ffd0565cafe6232087e73937cb839f87af7510fc2e644155","first_seen":"2025-10-31T04:50:36.991077Z","last_seen":"2026-08-08T06:09:30.155903Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/slim.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.290Z","timestamp":1786169267290,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/slim.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:33 GMT\r\netag: \"68d0d3f5-810\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kiySPOKn%2BCV4enSOcsc8utlJaS%2FT8WVbgKfA8%2Faa9ELrU%2FX18cDVEH0xBzG8yPD3LloD2lUd7uyMBC8E3WlUQWHg0kcxbHdkrczW%2FlSpUMr4NRtsdwZdzThXs7gONn77XvKElzE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c08d57c759-OSL\r\ncontent-length: 2064\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2064,"size_decoded":2813,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a29018d05b5cee800553ed788ea334fe","sha1":"fba8ed888939e7fa59f4da4592905ad897799c1b","sha256":"6d40dd40644687f109cc8cf548b75b538e2a8b5a4a3c5c4319bfe37467410301","sha512":"8556f7f70a7d0ae7c2a859026a7d3a65c56ea874ba7476676cc646d46aa74b6a5e5468eb03bb928102fa1ff45d47e44bf0bbff06faa45ebdf091647e9d44ac04","ssdeep":"","tlshash":"71411ac6a898cc2ae9a0fc7480f139f1009f7054fd619e31484f29966c6eed0a5a9871","first_seen":"2025-10-31T04:50:36.751966Z","last_seen":"2026-08-08T06:09:30.250364Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/zera.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.419Z","timestamp":1786169267419,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/zera.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 01 Dec 2025 05:23:17 GMT\r\netag: \"692d2645-330\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y9aj9Dgp%2FDdSYHsF8VNOaIpAyTJYo6cg1rM82tuOT1mni9nPxJ%2BRzPggpE7SsnsNy3Bf0K0u7IEfE7DPlxcgNGBmqlv72YlgGhJVHyeU0DNS9%2F%2Bf1kp%2BgWbBSi5s0dEvC%2FpdimI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c15de5c759-OSL\r\ncontent-length: 816\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":816,"size_decoded":1607,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"24967dafb8f4c81ed6af2f31abb43167","sha1":"253ae0783cdac31820d429661493cc4b002b9166","sha256":"dd13de447f206e54403e29c07265e1f138ec8fff4b2f17bbe59a4659ea15860d","sha512":"f8d23fbb5405ee3f220bd1c2d41d6c963bff893eb7371ec818582c03217b478493fcddcff3f5e598d3d8dee78a180f916b248b605d4892562826c4fb5f37e5eb","ssdeep":"","tlshash":"990186761388bb9f8552645218a5b4b0f93e4c0160301542eefa2abf39e710d8136560","first_seen":"2025-12-07T05:18:33.96531Z","last_seen":"2026-08-08T06:09:30.232962Z","times_seen":83,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/psyopanime.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.470Z","timestamp":1786169267470,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/psyopanime.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 07:19:39 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca240b-70e\"\r\nexpires: Mon, 07 Sep 2026 06:07:27 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HNYlP3SgXNLEFLlRycfmATsh64a4DywzMMu%2FZix%2FhcVxD8UH2YjGumvGZbmvTGQlcvkXKWwM%2FeqaLqu%2FGAODE3%2B639VN1vIXXc1wyr0vzXwfAlyZWcBvfAp39q4RpKPlz4PuPmY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c1ae0cc759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1806,"size_decoded":2552,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"83c445bcf02894682b263dc0532b7074","sha1":"33f5b0482545ca031b53f01faa581ba79a5343a5","sha256":"4c2af63121479e1ad931aa1443ffcab94aec2b4db34b154c6b217d80a7730967","sha512":"c7fe1d221880ac50d74aeea871fe9d71f636aca319ffb8ca971d666ff6f95adbb7b8bc751f394d0d503832ea90d20dc0e01069f64ee0b1c1769cc9cce09b85f8","ssdeep":"","tlshash":"2c312b9697948513da3f00f30db154b853021c9dd71347578e89e90f355f4a4ec441ee","first_seen":"2026-03-31T13:47:07.10204Z","last_seen":"2026-08-08T06:09:30.223094Z","times_seen":21,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/SpaceGrotesk[wght].woff2","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.853Z","timestamp":1786169267853,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /SpaceGrotesk[wght].woff2 HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/main.php?type=css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: font/woff2\r\nserver-timing: cfExtPri\r\nlast-modified: Sat, 03 Jan 2026 08:42:27 GMT\r\netag: \"6958d673-c068\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s0KPaNvEL0wm2JPMq37n7C9l89m%2B0ZwFldHhT4G0nGK4PihrCjiKeUGNb22KLvU%2Ffwl%2B92u26irQeYCB4gGajUVyETaQiCYLE7g2uYStalY5r7mSlkoNioNgtVPkdmbsw06r9KI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a27c57c40e8dc759-OSL\r\ncontent-length: 49256\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":49256,"size_decoded":50006,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 49256, version 2.0","md5":"0c62a8f36c27538912ccbbd5de747927","sha1":"b4509f04a2bed1ec04e7f9ff4dc33c69e8e263ec","sha256":"8e085aa438094f11487a836652edd5c054fa6a96f63fc7c282105ee3a4b08c07","sha512":"a67cdcfd2c433321dac9322b221ffa7aa0eab3f0258d7975c84e891eddea41fd456ee3c6f7e67762853e023ba0ccd3d0586d5d549a63fc0ae4ac62f7533dc074","ssdeep":"1536:pKXTCNqIqI29JkBq+zhVpQ0n17Bwnfen623:pKXGoaWl8y0nPwnGn623","tlshash":"a123f1ce649a7d788870eaa31dd73f146dfc984389d6e6e1e1c2da8d21c971809e434b","first_seen":"2023-05-23T06:00:59Z","last_seen":"2026-08-09T20:23:41.296145Z","times_seen":546,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/dq0_efaS.php?s=%2F%40v1%2Fcdn%2Fjs%2Fautocannon.custom.cjs.js%3Ft%3D29769487%26u%3DBbCtKN-96j8Ci3xVGDY5MjU2NDRlMjhjZmYzYzM0MDI3ZGU0M10v7qMJXFJfV9Oc1g","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:48.007Z","timestamp":1786169268007,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /dq0_efaS.php?s=%2F%40v1%2Fcdn%2Fjs%2Fautocannon.custom.cjs.js%3Ft%3D29769487%26u%3DBbCtKN-96j8Ci3xVGDY5MjU2NDRlMjhjZmYzYzM0MDI3ZGU0M10v7qMJXFJfV9Oc1g HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:48 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-max-age: 3600\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD, POST, OPTIONS\r\naccess-control-allow-headers: *\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\npriority: u=3,i=?0\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6AVPsd9LXH0pWGzQZlANjvKGfLrTum6hBEAJwaVEXmAGCacwGf6wR3VSGelc3KcZoB1GktuoGzqKUgHkeYHjPxNsrdfc58WXHU0gz5TrUtvo3eWPL9jZmuSoMtuvuWHbTAae5ck%3D\"}]}\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c50eabc759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":128,"size_decoded":924,"mime_type":"text/html; charset=utf-8","magic":"ASCII text","md5":"454849b5a2a8e4cdb50867d0c6919bdd","sha1":"a5406bba92da1bc4c31e1c927f5200722639ddd0","sha256":"f4d4834d204588a6cb7c4ec3387ff3e258f7397766ab17874d8faa33242176c3","sha512":"eed75aadd45aafa4500aa1dcb0d5af570d8b664fcbcf103f427174307d3e6df293056242946b101bc5c9e7fd8c6dc5a6b29888eada367cd8aff993fa3d65b602","ssdeep":"","tlshash":"a1b02b38f43041b4916400c73309f14202414872c5031934a101c5c9cc3e8109e7048c","first_seen":"2026-08-08T06:08:05.124173Z","last_seen":"2026-08-08T06:09:30.136894Z","times_seen":4,"resource_available":false,"data":null}},"time_used":350,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":350,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/style.css","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:46.928Z","timestamp":1786169266928,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/style.css HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 18 Sep 2025 07:17:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68cbb1f4-4fc0\"\r\nexpires: Sat, 08 Aug 2026 18:07:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5uML8KIeY9qasT5lHvjLTLxMKAjAReCIdvkBAoXpTjjNgT54SD%2F6tGBw%2BL2HatEaOCEcn9yv1xgSkCmaFeW%2BQBX1LeZjJUZduAixBTyrCDoZJFxaXwWJpf7333krfv%2BV%2FaH2x98%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57be4cc2c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20416,"size_decoded":6676,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"de57fbb0bc552be9449edd1a3a8d0190","sha1":"c95f541631725f2b1a7daf284f904ddf01d3af29","sha256":"ceb9901c21505decf74b8dec868485e99a0ef9301cb638e3baed368acbea59cc","sha512":"ff1708cbdc6d715299db18c3497f66d523e28eb92128947f1ef3f959aa704cbd4e13cde4340d7c3fa91efb4cfdabd232967047ca34ba2132d8cbd299bede46e8","ssdeep":"384:GnWY8YVUwII+QMxy+xnzvgfsrFEzuupjLd:GnWY8jwI9I+xbgfsrFEzugfd","tlshash":"0e9295da2ba600043627d4b477939fab337c8507c10addbcbbf5605c9f892dd91a2789","first_seen":"2026-08-08T06:08:05.33965Z","last_seen":"2026-08-08T06:09:30.239205Z","times_seen":4,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/jup.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.182Z","timestamp":1786169267182,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/jup.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:44:24 GMT\r\netag: \"68c93178-7ee\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5%2FE7kfIaOwSpcmvZ17BkhsuXf3CkWJpCN0V5g0CqgEbYdOz8%2F556P5p0CaF2ozX3g%2B6rsZdZIuEdAJ3WOWpEh%2FmATJTMb9T6gWppUThvHDefQWBbZ0M9MiSNxo1YH%2B7ToZ5GG%2Fc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57bfdcf7c759-OSL\r\ncontent-length: 2030\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2030,"size_decoded":2781,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"361e9dc3e4608f1b01f718d9e10bb756","sha1":"8392084fb56fb3d2a622a458a63d8b900b381a14","sha256":"33cc093532470e1cc1b61f14357789eab408147cbf01431784688ebff3ed74e5","sha512":"0c70628f3b92d17f4a4d76456826983ec700c84349a02a8a8da56df3ea6c2cd4e3ebeea0b987fe7aa902c10e519b4cdc0dfef1418e944b52f1f5cc1ab2604131","ssdeep":"","tlshash":"5041b6493bc25bc1c02964fc19adb70ff54db7a1a01697a8967d01219cb15158ee4784","first_seen":"2025-05-07T12:19:22.463101Z","last_seen":"2026-08-08T06:09:30.202581Z","times_seen":108,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/me.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.278Z","timestamp":1786169267278,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/me.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:47 GMT\r\netag: \"68cb9583-3c0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1vNw7x95aLqbqmOXMSV36b50c19atylUwqV5JKC0lPq7jGqSnWncQ9DGNV2rsW6XSCjqA5W19zdXYK15Ovg8WSRhKKww4tA%2BDqO4gr%2BrAbz7BAOMbKZn2ldRTNqRyLIkwEgvMOI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c07d4bc759-OSL\r\ncontent-length: 960\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":960,"size_decoded":1702,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0130c3f750a129088a5033fc0f5712fa","sha1":"87e5a1a36df391d9eaf76c188df1cac96f2d2aa6","sha256":"90b50a4cfa3e1aab959f841dd001e9a55caa9db7c2592cb8c73ba5de550c4d55","sha512":"1932496793ac9db6263a7bf17d176eb955857e5d9e63c3725bfbfca5002b0045398a5a6a53d8f4d89c670259b5211c9e12ed1adc3832ad842b21163f906fcc22","ssdeep":"","tlshash":"8911c887d24aa12007727c362c3965ecac38d07c80a864b38254d94a5d620e1b7af0d9","first_seen":"2025-10-31T04:50:36.776833Z","last_seen":"2026-08-08T06:09:30.146316Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/lockin.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.344Z","timestamp":1786169267344,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/lockin.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:45 GMT\r\netag: \"68d0d401-548\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8TTVo8V%2Ft7NcGhkT1qLlBPoOOeIX6bRbl3GBTUf1n35ZAG1%2B2zgx%2BoQdLEegpsC4idl6boTCpU47Jg9fKvqxCAJv2zj4kjy%2FjG05Exmh1e1DeIppZUMPIainZdAM85c9blgGGmo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0dda4c759-OSL\r\ncontent-length: 1352\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1352,"size_decoded":2099,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4cac29be575138c633b92bf3b8ca7dab","sha1":"51261b4aee9febb55ce3f25c08b7177edd94f8af","sha256":"35cb82fc5d9ccf5361ff72e19636bccd9024e26215ff586eb7b3573b2d121ac8","sha512":"411ea7ba31c76a78806d93d6b2a621e1149e556aac51f2001fd03ad8ae6e753b088b99d11af772449a562102340feca35d4d8dfca7860eca724f0bb8283403bd","ssdeep":"","tlshash":"6721db1d312f84106f81aed7205ed664456d747c33f7c9b8599ac1862fec89d616c23c","first_seen":"2025-10-31T04:50:36.941171Z","last_seen":"2026-08-08T06:09:30.126393Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/SpaceGrotesk[wght].woff2","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.793Z","timestamp":1786169267793,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/SpaceGrotesk[wght].woff2 HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/files/style.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: font/woff2\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 28 Jul 2025 13:47:50 GMT\r\netag: \"68877f86-c068\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UG5oin7jn7HVukcuFkMn%2Fi3TB458ZI%2Bwj8augtOFd1T5rQvsV5mK1dyucrWU0E33euYe30iTjJMHcixOOSgqF4y3s1gop7uIOj0%2Fpkk1fatkFIyEh14OmcDQwA5mDY8umBjlExo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a27c57c3be82c759-OSL\r\ncontent-length: 49256\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49256,"size_decoded":50006,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 49256, version 2.0","md5":"0c62a8f36c27538912ccbbd5de747927","sha1":"b4509f04a2bed1ec04e7f9ff4dc33c69e8e263ec","sha256":"8e085aa438094f11487a836652edd5c054fa6a96f63fc7c282105ee3a4b08c07","sha512":"a67cdcfd2c433321dac9322b221ffa7aa0eab3f0258d7975c84e891eddea41fd456ee3c6f7e67762853e023ba0ccd3d0586d5d549a63fc0ae4ac62f7533dc074","ssdeep":"1536:pKXTCNqIqI29JkBq+zhVpQ0n17Bwnfen623:pKXGoaWl8y0nPwnGn623","tlshash":"a123f1ce649a7d788870eaa31dd73f146dfc984389d6e6e1e1c2da8d21c971809e434b","first_seen":"2023-05-23T06:00:59Z","last_seen":"2026-08-09T20:23:41.296145Z","times_seen":546,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/trump.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.189Z","timestamp":1786169267189,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/trump.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:41:18 GMT\r\netag: \"68c930be-5ba\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XVMn6QcbIAIwLgJIli7irTZiLchLpLHYTl640p0yVQ6PF%2BR9oXR28%2BdlQsWP2vHWVL4lNUOkTXAhrgEgyxmxsUE0CBJV50xIYFm0GjrbceFkYSgt6Mck%2FvFeHx6%2BVyTqfJQ%2FXNA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57bfecfec759-OSL\r\ncontent-length: 1466\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1466,"size_decoded":2215,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5b7b68c9acdc17a186862f56a620be7a","sha1":"57961a3844c4515be40b722cb3ec5810c40c9114","sha256":"edcdb92acc20730cff950c0e6dd19126243cb26ec8d7661630e67f1488c84fec","sha512":"9281323ce0bce6546a0842f4b7134cbef2744fed833333bb581694ac7eb0a9e0ee714e29c0f6ef3359ec866ea58a81109f5ff1a57c036e2f15f778e4656e9566","ssdeep":"","tlshash":"2a31b97dba818609e06445bcbf3723557495e0c5408891ab241e0f18bc9f88c5d958e0","first_seen":"2025-05-07T12:19:22.490812Z","last_seen":"2026-08-08T06:09:30.093009Z","times_seen":104,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/giga.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.252Z","timestamp":1786169267252,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/giga.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:43 GMT\r\netag: \"68cb8eef-2ce\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bvSC3504kmvhxxsLBfpe%2F7C42ZndmXNEbEbDrPeyGeDnAWEY%2F3BlZVyTsaixbkxxseiuyK5z9sltY%2BjQtYxZkckvb%2FhDMnGrUx2CJXphqibXdNGj%2B0UtpOhXUCW7DQiAex7yct0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c04d31c759-OSL\r\ncontent-length: 718\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":718,"size_decoded":1466,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x91, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a2815d0bc203f23458b39054b6d80b13","sha1":"fb25e27dea490102d3ce8e5984ca7565a1ed8f3b","sha256":"69fed72f9cce7d8ad1128f893b5e06859812725e75ac0a7c983ece5dbe723f3d","sha512":"1f72a764acfe765cd699e5b74ba9cb24f91e30c68915573a560f899533b044fd5ed5c30f39b5d0d02090b55f9fa30154009332d5973a29c1bb11ab5240e0c1cd","ssdeep":"","tlshash":"300165a763935444ed3ff8781bbb0a292c02651f50aa0e55d48029005a627a1ae0961d","first_seen":"2025-10-31T04:50:36.991991Z","last_seen":"2026-08-08T06:09:30.19318Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/mnde.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.374Z","timestamp":1786169267374,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/mnde.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:13 GMT\r\netag: \"68d0ef89-7c6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hlR2zhBSQ7wtbOSFFbrZkxjeoYDbObqobg2qcfpMWjAnjmzZUeFgowPfbYIkXEW2ZvaJgxgyg3nWceDutmHLXp%2Bq%2F3%2F4rGRF1KSMGGwj8EwaYCyyVbqH4hvS9bzhcV2%2BRwXccoY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c11dc4c759-OSL\r\ncontent-length: 1990\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1990,"size_decoded":2737,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f7913fb42d11902f4930eaa7de026dc7","sha1":"d8711710d2f0fdefcf153bba150d4db5f1bbf5f5","sha256":"874bc1811ae613480506c3c7a6bee811bbe0477a54312fe7a131c173ff599477","sha512":"85a49dca22b3b236af107f4fe8212adeac6f77943db89eaf3d1a938137ed8dc5b3ee5695a317770692ac053ff152198fdc9aeaa266a684437c6eff11c0a1b56b","ssdeep":"","tlshash":"e2412c59b17862074d23b1defa9f63e36c2d2ac26b405740d4c17088a8f2d3629459d4","first_seen":"2025-10-31T04:50:37.015501Z","last_seen":"2026-08-08T06:09:30.2545Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/tnsr.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.425Z","timestamp":1786169267425,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/tnsr.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 01 Dec 2025 05:23:16 GMT\r\netag: \"692d2644-15e\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2tnWPGuxB707XvyyAgDiXhp2%2FmplBakDNA6Dw3ov%2B0fgVT64YFSCelQIL9%2Bbn7Up5UW%2FOnfJYtVj9eTGICFFt%2BGEdL0i2uussN1qSpOxx8fvSk3y4u0X%2FF85%2F8hHvXVT%2Fy3843w%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c16de9c759-OSL\r\ncontent-length: 350\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":350,"size_decoded":1145,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"41daa1caf9ce620e589050865c3bcf02","sha1":"48479127bd71fcdd2283734231217cd6510c3d53","sha256":"bfe68d9244419c6c3cbb720e42ae91f01a7b3a3d1a40d586ee67dcf2daeefb6e","sha512":"9c905cfb351a2c5bfbde73a97d7ddded2e6c5e85aef1992847a2530224e0ae1914f2535067cab8e2a0f5240f5845137e2e09f7a278939a591fca4c3c3810e8a3","ssdeep":"","tlshash":"0fe0c09353195c2ed97724073905f0503ee275aa106c200158835f9d7cc7c020fa1983","first_seen":"2025-12-07T05:18:34.133906Z","last_seen":"2026-08-08T06:09:30.212034Z","times_seen":83,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"aodefevrgdkhqltdnwgzbyjoywrlbntbhfwq.com/@v1/cdn/js/autocannon.custom.cjs.js?t=29769487\u0026u=BbCtKN-96j8Ci3xVGDY5MjU2NDRlMjhjZmYzYzM0MDI3ZGU0M10v7qMJXFJfV9Oc1g","fqdn":"aodefevrgdkhqltdnwgzbyjoywrlbntbhfwq.com","domain":"aodefevrgdkhqltdnwgzbyjoywrlbntbhfwq.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:49.386Z","timestamp":1786169269386,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"aodefevrgdkhqltdnwgzbyjoywrlbntbhfwq.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Jul 2026 21:06:03 GMT","end":"Fri, 23 Oct 2026 21:06:02 GMT"},"fingerprint":{"sha1":"5D:70:AB:12:B4:52:5E:67:ED:1C:A6:DB:ED:31:3E:DB:E1:45:B8:60","sha256":"4D:BD:67:D1:77:DA:39:51:79:68:98:74:46:0B:B4:D4:AE:7D:EC:3D:98:D7:34:B7:13:70:F1:73:7B:31:23:69"}}},"request":{"raw":"GET /@v1/cdn/js/autocannon.custom.cjs.js?t=29769487\u0026u=BbCtKN-96j8Ci3xVGDY5MjU2NDRlMjhjZmYzYzM0MDI3ZGU0M10v7qMJXFJfV9Oc1g HTTP/1.1\r\nHost: aodefevrgdkhqltdnwgzbyjoywrlbntbhfwq.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sat, 08 Aug 2026 06:07:49 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 11\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 4623665\r\ncdn-requestcountrycode: NO\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\naccess-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\r\ncache-control: no-store, no-cache\r\netag: W/\"b-mV/uHxp+s6KpNVFPaiVzMnVo8/M\"\r\ncdn-proxyver: 1.58\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 08/08/2026 06:07:49\r\ncdn-edgestorageid: 830\r\ncdn-requestid: c5e66883eaa4022e61e60a2d904a903f\r\ncdn-cache: MISS\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":11,"size_decoded":954,"mime_type":"text/html; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"723c25877a86786664edc4b643c08a6f","sha1":"995fee1f1a7eb3a2a935514f6a2573327568f3f3","sha256":"60945d49535300be8e42108658dba31fcd5d665fc40d6f186798e7e0682320ae","sha512":"09065d79c37aebd0059fc6feb4d8f73dd058755d5ad03c889bac464b93fbf53516add410b94af992b1892672f6c807b6c84c3b3815269be1c23f0f1865fc3577","ssdeep":"","tlshash":"ca500030003030003000c0c330000c030cc0003000c0c300000003000000c00f033000","first_seen":"2026-04-20T04:40:03.433055Z","last_seen":"2026-08-10T01:54:16.192948Z","times_seen":7,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":2,"connect":1,"send":0,"wait":23,"receive":0,"ssl":9},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"aodefevrgdkhqltdnwgzbyjoywrlbntbhfwq.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/chillguy.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.259Z","timestamp":1786169267259,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/chillguy.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:44 GMT\r\netag: \"68cb9580-3a0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qJr3yb6WswSwgZk2IgRU0QBEJyaLKqNySWvz%2FJ9kQvf7LgPO%2B5TCvLXoc6FJZBYdQ%2B%2BzDZ3lNokaxOkuow7ZmP1eaiVknO9K8FbhN4xwK2L0Lj%2BKub70eSYFmLPZwGo3Dupn6mE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c05d38c759-OSL\r\ncontent-length: 928\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":928,"size_decoded":1676,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x99, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c1c65f1d46ec29a88119791ad4fae14f","sha1":"5deb47be2e0d890c5243336cdda2bdcab4121e55","sha256":"2ba51302119a769f6022765727576f772cfe052b7b851697306c17768c8c8728","sha512":"1f9f225bd91f35e3a1c2d4f6960510495584d623df399205e8dd43bd9640445fc77b14cbf5a48027beba772df14de5210e0234fc6cbbf70bc4b8ae32c4418987","ssdeep":"","tlshash":"7411f77ec2460ad0cd5ced401df84e261c904e0bc2222f216cdae0d93c5605b228fc08","first_seen":"2025-10-31T04:50:36.851565Z","last_seen":"2026-08-08T06:09:30.150878Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/saros.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.334Z","timestamp":1786169267334,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/saros.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:52 GMT\r\netag: \"68d0d408-900\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nxTHdmXRPDkQxiLwJKiEJwWLUgCJZ%2Fc4rlBBhAzyDv8E2RQCTgHXFshOLvBYLs9k5LNgtXxJ7suI4vrYG%2BUrVabYqeDGbNl%2Bt1SK0hLXguvfu1LEIBrLDl%2B8oRnCKhR1LhPUmsQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0dd9cc759-OSL\r\ncontent-length: 2304\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2304,"size_decoded":3051,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cbfff9c0a3b39e7be46ddfdb279dde0a","sha1":"bbf263f9025a3c4a25a993d85df178bc9fc78289","sha256":"cc542a218eeb8883c2a01bdcb663954a80abf34b5b2b5d7d8219ac84fc3003b2","sha512":"4e15274c6d4a1b1715f23d8ec3bb5a3ff464ff1c895c4f85fea5204a8ae0adf273274d143daf7fd95e9174abfc3ff5d8b85aba6abd2f612cd7696f50a63334a6","ssdeep":"","tlshash":"b0412b0e644c37acf0964caddf2e41636efd95b204d8d2a1a48dc8829e894ccd067e7c","first_seen":"2025-10-31T04:50:36.790405Z","last_seen":"2026-08-08T06:09:30.166987Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/cudis.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.354Z","timestamp":1786169267354,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/cudis.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:28 GMT\r\netag: \"68d0ef98-4cc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eIaL%2FK9gaPEfIQ%2Bv594KldDiYVOXHOFaG%2FYY0KdJMmPdDOfEEBUIseFUrnUbjNJ5US3XBlxoYIkVCRL5SFZVObJ1w3Nj8Q5oUKMmQr2nG2qKb%2BEh%2FlPMsMqUWya7C6hKOyRi9yM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0fdaec759-OSL\r\ncontent-length: 1228\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1228,"size_decoded":1977,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cc2c7519f969353a6575c9030c3378c8","sha1":"35c1703a8ddf204feb3ade6dafb025ef17482621","sha256":"b14cb07d6868ee72a36e62edca34df685c61e2d4e1d41778809fd10a273787a5","sha512":"4dec32f1a7c43384e3dcd9152fcafed78aa06f3c6ba1091b1fc0d46469a63b807e703d0d18674be799ae190ca35512c4991c60e9faa4d4f55b1d6c9ada3f3e0d","ssdeep":"","tlshash":"e621b796ea80c0edc552171d56b48e30b60aa4887f1999a971b103f3384783ae8c2294","first_seen":"2025-10-31T04:50:36.944031Z","last_seen":"2026-08-08T06:09:30.196004Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/popcat.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.228Z","timestamp":1786169267228,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/popcat.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:25 GMT\r\netag: \"68ca7a89-266\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=amF9TXyqkcCjEg1bVK%2BR3gozTiBlIm9Xh98Iq36Y5uovTSAnGBRtiNLzDbCms8IZGOt53oz4m7S71y477LqNGsCxfHK2Qqmg6J8m%2FCoMuYbGRgMaxCDYy2cuPy1xJuTsGrL0uGw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c02d1cc759-OSL\r\ncontent-length: 614\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":614,"size_decoded":1356,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4e45b43e204d98ae45cb279b25e2ffa7","sha1":"0c6fe747c24f72cb8a6617dcbc64dc8a5cd0e501","sha256":"f712a5ed3d701cce3e39e9bc37372b1d54e16c655260cc0ea31b4c3deb052ad3","sha512":"eeb5fd0d9ce3aafccb526bd5aaee044fb6c6600d6b59d791e217fca8ed44a6a17c26abe5d2b1dd55ffdadfd837372e3af4151257d381f4b7621e62ba08b2e38c","ssdeep":"","tlshash":"67f0414287a87a40d47c4276c29227618090f092f495d507a3ff6cf39ce7291b503168","first_seen":"2025-10-31T04:50:37.010117Z","last_seen":"2026-08-08T06:09:30.199458Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/vine.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.244Z","timestamp":1786169267244,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/vine.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:26 GMT\r\netag: \"68ca7a8a-3b2\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=v%2Ba9pLtnMO83qIRY4ATJErQmrnSJBR8fL6Rq6PYyKUHoPK8Y9tpMPi8mUALlnUxAWtHE4iiX%2Fx73G82Q7HrAm8nNmBLS4HuUvruPkxRsUNM%2BE7h4Nl7FmCdqjcECWb83pPWVasA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c03d29c759-OSL\r\ncontent-length: 946\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":946,"size_decoded":1731,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"53b3a7a7d29c9ab3866fffa023f23177","sha1":"fbb7803171a6d3a0d4c1f5cd02b79c39d6ceb764","sha256":"2ba50e8139bc64cc8dccf01f27df386f470f8f385576d7671b4b35141311470c","sha512":"ecc492c21cb9b5c8e8207fb252ce447758453802381be3fb0f5beb1eb1ede6d93a07b3ffda797dcc382857d8f1e8ab46492d7c2e1174187a114571a81ad8b55e","ssdeep":"","tlshash":"4b11c8d903585624c879e1e9c15311f08b61ccfa19bb1c3c2ad7b2b13c28c0f629f292","first_seen":"2025-10-31T04:50:36.874463Z","last_seen":"2026-08-08T06:09:30.177673Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/pain.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.269Z","timestamp":1786169267269,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/pain.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:49 GMT\r\netag: \"68cb9585-89e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EqeGTG8lWlyyDmvGxAYPka669K3%2BclY2qqT7kWlHkVXhMm2soy%2BSq6eTE2Gg14FazpwVDn0Xx4sdRiffTAvNRoJe1%2FfPECaq8AS6Lfs9wMPTqd2L7qQlum1JkoNR%2F7GG9m0ZDeM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c06d43c759-OSL\r\ncontent-length: 2206\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2206,"size_decoded":2953,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7979c67362a2918d99ffa17518249545","sha1":"14d79496477c099bd3dfbfe3addfd6337966807a","sha256":"6989a3f292d792d419c7a9f47a64206653a9492a272e7dd92b1d0cac4751e9e5","sha512":"d50e9cee92df8d3ffa667e89aab92f246c95dd1115039f2b00b7342b3e3a34e3a123b2d4f348d39ae5da5a3e6e26039a3abc7ce80e083aa499d0e939b0864f12","ssdeep":"","tlshash":"bc413a068386ed228d52cd40f1f636c7ac2498a81ee454ff9ef650fd68e4d452d1dee0","first_seen":"2025-10-31T04:50:36.675999Z","last_seen":"2026-08-08T06:09:30.145644Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/kori.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.291Z","timestamp":1786169267291,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/kori.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:43 GMT\r\netag: \"68d0d3ff-7d6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4Wr37VAs2gXaQ2A5imQk7uQOJFZgkI%2BUVfq1%2Fba3Pn05rGmZdhO%2FolHYuqFGVCZDuNHeCZWVtkAZ9gCJotECHmvyBAmR9gbZwkeAybkI%2F4E2mnZeBPaD0%2BK7FOxcBZtJi0IUTDs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c08d58c759-OSL\r\ncontent-length: 2006\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2006,"size_decoded":2755,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"8a3c366d36806dae646b72414832b6d5","sha1":"5e9d97533f99ccf7fe374c850831422c992d5ca0","sha256":"60ceb93a5f385fb5f6dedd334eb4ef9d5d2b3d564c3793545bc106fb19dccc5e","sha512":"55fe3e8f3e4fab0fd29ccfbced10f95455ddb8691c4fa0a5fce31e81b359cc99b08c6ed4fe5fdc6067a10e1e4d12f284525662db79b93f7ea2b615db0345e52c","ssdeep":"","tlshash":"e5412c1ce2e8c2a987573c4ed1640632752beadfac34eb6b0895cf325cc0f461a01d55","first_seen":"2025-10-31T04:50:37.003894Z","last_seen":"2026-08-08T06:09:30.230643Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/look.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.345Z","timestamp":1786169267345,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/look.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:10 GMT\r\netag: \"68d0ef86-392a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XMBFnMzLzlTPzxxYNthFpH8UXsyTdobBwyLswy7salMpXzFoW45pzYdnsq5d%2FmMU%2FsfBdX9SnjvEwR%2BRPNIt0btLnkrr%2FtDO2%2BP6nkR7AE491bxl%2FOm26H93T1wKEa%2FjS1OO5vs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0eda6c759-OSL\r\ncontent-length: 14634\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14634,"size_decoded":15389,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ba05eb2fbd6ee81042eda9d7280f2c96","sha1":"9d45f1f34041e9abbe444dd0833d1d64cfa0a4b7","sha256":"910779c1342238eba4a30617754c35c018a414c6b069bec0fc1ac6c68cc49c33","sha512":"e696aabbe259d5459bf8ede9ce5ec28b74e4d78401a89127af037f4390cdf9fbd439437687b52aee78d1e4a0b1cebd1466a4715a4f3a99a113f40e5a77a9611e","ssdeep":"384:q47YGBcIWQVcee94aA4rkczENQgA4EI28xQON/:qMYypgJUwz4Q1i2vON","tlshash":"4762d057f329f2e2d8ef1837db1a3b28d5326809817ba4c67d67f830610d2357151d8a","first_seen":"2025-10-31T04:50:36.912263Z","last_seen":"2026-08-08T06:09:30.148266Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/natix.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.360Z","timestamp":1786169267360,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/natix.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:14 GMT\r\netag: \"68d0ef8a-500\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QWuB1qkAft6cQ71EVoK5c4GMJNIlFPpiQ6iB9S1DX9pUjD6boZT9j3eWedzLNAIXsi2d1XKJFxyTPtrnRcqB3L70LkiZg7DvqlFcA90SfaSfDJhuvJfjJoPjxwFAgoJ2BeMPIbs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0fdb4c759-OSL\r\ncontent-length: 1280\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1280,"size_decoded":2019,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"eec9fb39920259f780a7f043b6fbf91b","sha1":"208ad11ca8b9394aad88cbb9c79a34bc5b67e573","sha256":"c024cd77a0ab73d32d876352d5e629fff45ecbaaa9b377772471b91a4eba63c4","sha512":"1cb25472e4ff5e3fdc1cae7d31babb9e197ed99708504c10beb21646697d767ac3a924cdf6ff0abae036710a385152830bdc9e5a3bc5395d36651175eee252f6","ssdeep":"","tlshash":"b821cb4ac21221d7ab6305e423c51505ed1fecca96c1a11704f72664c9a4f2c6d6c2f9","first_seen":"2025-10-31T04:50:36.779868Z","last_seen":"2026-08-08T06:09:30.219951Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/2z.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.410Z","timestamp":1786169267410,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/2z.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d263a-5ca\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hNF4P3JU63spCW5EoMFs3nVOfLFsBs4GHOeK3fqtnzUbBhkvE2pSI8kRXAdzUWFcnbJKmbeKhBIVOPzFDA1%2B9i9cEmCH6BFuKEcMBdPszPj3wTcGgALmkdmrUcAlE9RrV%2BxIvUs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c14ddfc759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1482,"size_decoded":2299,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit colormap, non-interlaced","md5":"26612ab4bf155f79bbe938865a455d7a","sha1":"1c2071e54355b2be50a95806632efa36b87c19ed","sha256":"4d9bbf0da36cbe68f66a902a495560f0473018540a61631b84f585f6ad82618a","sha512":"0035f9d08b6d87bf63e729212f802590d74d27098bfaa794ba60d2568475e939c5dbfe8f47b79c0c4bbbf31c1bb92f919ee8ff2faf6703a2fefd60acee430d88","ssdeep":"","tlshash":"7231ebcb1757caf2b31595f5cc7de2e908063d642a767a036a44fd91253b10cc542153","first_seen":"2025-12-07T05:18:33.941797Z","last_seen":"2026-08-08T06:09:30.111767Z","times_seen":83,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/anb.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.443Z","timestamp":1786169267443,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/anb.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:42:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af35e-5fb\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WgAxco6h5YgK7mOVUB9j1KhObi6e5mo2XttxaX6OqhJ2GDEseL7vrn2Iy79kX0%2Bk3gEFJke5s51EpqQ3G25jd7XMFPiK%2BEr2mVOFoESaQRhUf8sbo6Ci3q%2FpiP9%2BGlQecYDEPeo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c17dfac759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1531,"size_decoded":2340,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"ce9827ae5c4b8ad41749e9adb091531f","sha1":"5c96abafc5c3756d2c2289d6518b5b9cb895e0e8","sha256":"f451714bfcfb2ac1a209da00d85ff3999f2fd42e23b842e5ad7790bc6910dba4","sha512":"1793c00052e6cea39bb1c37d011b53f731d4b27ed1767eb1266d2a9f1bc0d884865d1e4d3b968cc781bd8bb9f55a613a968c347f0332d2ea560ffd61138ae378","ssdeep":"","tlshash":"393129628755fc0ccb1f4136cd4a8d64d122f4c82374f6b6250c9cfaa8b240a72dd40f","first_seen":"2026-01-30T00:58:38.053368Z","last_seen":"2026-08-08T06:09:30.121009Z","times_seen":43,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.121Z","timestamp":1786169267121,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.5.0/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 18859\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Tue, 28 Nov 2023 18:34:15 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FKowCBiai4W0STvGpcJOBoFNkzw5beEqNQ4UQm0%2FR%2FlEidwognwC%2FrgfZvW71mN0UGkyZfpLhdhhR4GmDbQlr5xSJnaT5VSB7HqSZLrGk%2F%2FI28z1jLjdIehlClKuyz8RL%2F0V5MtG\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-ray: a27c57bf9f578deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":102526,"size_decoded":19856,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (52276)","md5":"c43cd173eeeba2f72aa6b431d06b8c07","sha1":"427a692f7f39eabb3d5b8510aee2743025daf813","sha256":"c880eb3d25c765d399840aa204fec22b3230310991089f14781f09a35ed80b8a","sha512":"02f6f6422b83104bc1e1b64961d7edda63635528417ed2dd3c6f0527457b8ab4cb43c528d2a70fc61e0f96aec6e6d1a6d2b53ed523e1568b6d78ba41111c1393","ssdeep":"1536:vwMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPG9ZpgmLCq:P709gMGFiyPG9ZimLCq","tlshash":"4fa3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2024-01-04T18:36:36Z","last_seen":"2026-08-15T10:14:48.996452Z","times_seen":14687,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":3,"connect":11,"send":0,"wait":22,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/main.php?type=js","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.240Z","timestamp":1786169267240,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /main.php?type=js HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ttt8cXktmFVkufPFjNu2vcezLzdgsdZVoYMSw%2BJpsqeIPZGfOH5hlFLjvieo0g2m4Kx6TT2H%2Fz1Mg2I7TkHunI3jmpOkIHjNciKwS6cywvi01tR5pPW3%2BSAhdVE3L91yWEdU%2BnQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c03d25c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10323,"size_decoded":4029,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"803c770958568df36604349f4c138e38","sha1":"b137a18a4c325cae854154e10574a0b2dad10559","sha256":"f29d175a5a550f27b665d83030569da410f979dad1d6fd81c817fa4bee4e232a","sha512":"7a9d30d42e421cd5f760237aa4209328b252949fe8a73ad436507a40eecb4ca265d7b8efd900c28298d6f7c7206c5c23d29f9509531c3c452db0a39b1c6cf6d6","ssdeep":"192:SPuyS6EvZNlFielilPwQ70GrlM3ovyE0ZEzW1tOhandDJnmn98ApTqt7gTSoYpKp:VIUfl3BQLlZaE0ZEykmiSpXVptg","tlshash":"1922719cb4b6217086f362baa7dba715373520077084c9483fadc1c41fc1aa166a7be9","first_seen":"2025-11-11T22:26:53.093024Z","last_seen":"2026-08-08T06:09:30.235127Z","times_seen":17,"resource_available":true,"data":null}},"time_used":157,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":157,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/verse.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.283Z","timestamp":1786169267283,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/verse.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:40 GMT\r\netag: \"68cb957c-40c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kO7hUwyS9MzisZUfPDSljijCRblz%2FtRWLlAtkCH393b%2FRd4I93sVVv9pha9F%2BXO103e5cksU1jgl7n6VV3PJlh8%2FFOjRdmjMGfQbF4tBg7IuUOsToYXPDdN2xyf1hJqqi%2FWfjQg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c07d51c759-OSL\r\ncontent-length: 1036\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1036,"size_decoded":1785,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x87, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b6b751ee59e040efa6437cba3d655229","sha1":"b42fdc0b1de465d88d270aad472082bbb4f2aa74","sha256":"d583c540e6a901b07dec948da9b7d81180ef5af63578bd9ee16cafe647b867d5","sha512":"7dbf58df10042829fba53f0429028cf6eff550a440f99816323953d61a8ed6ef25a1e6c0876c812fe3a6b4cb0625174988f09c5ccd0ce09402011463c8a6713f","ssdeep":"","tlshash":"2011d8035bb7f67700002ce966b895749b9584e0060264770abe4d15d94b71f0af7a7c","first_seen":"2025-10-31T04:50:36.984841Z","last_seen":"2026-08-08T06:09:30.134012Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/mumu.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.315Z","timestamp":1786169267315,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/mumu.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:48 GMT\r\netag: \"68d0d404-5b8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4wyodTZ9PyYf9EUSNXb%2BVvJxbRs4lvnvYt7eD%2BTYlfB3QKnqFq1BTxt2D41E37c0vKkoqR7UBb7tNbl5AGDxGkslUphLbLEjyclWqaWT78Ytz%2BAOQRkWy%2FHlVl1Z0kgB4qzJG5o%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0bd8fc759-OSL\r\ncontent-length: 1464\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1464,"size_decoded":2211,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a65b266d57b497052b76e0e4198c1c5a","sha1":"ab644ff17b3e2637fec74e78ad24c41a59a19508","sha256":"6ccf85b4c76d65e6f7206dbae03abe3ed470c650b90365990c4166118d132ba4","sha512":"fafac2586586f4075fec45040ee1822f1a482c84c9efe76faf580716ab4273fdcf608c6fb370dbcc9614951d76acc49941fc0af576454225e9ff20b5d48c7e11","ssdeep":"","tlshash":"59313b28ef6909e92d3ae915dfedb182e58500481371074c81730efa8105cea62c6f93","first_seen":"2025-10-31T04:50:36.96392Z","last_seen":"2026-08-08T06:09:30.124207Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/aixbt.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.340Z","timestamp":1786169267340,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/aixbt.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:37 GMT\r\netag: \"68d0d3f9-a58\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DglPDZ7dk57P%2FxwBIVIS1gx9pOqXF1Xcvb%2BRg%2BM%2BAqVCER4flx2mkMBTdjZlQV2FqB5krtQ2s24nvfKjxeq20bc5JnwaBPq0LmCfkX69%2FW2WkYbEHk7j%2Bo5nyFHXycsHbU5nwPw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0dda0c759-OSL\r\ncontent-length: 2648\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2648,"size_decoded":3399,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ba80d8499e7a1839b58a51f036349658","sha1":"037cca9a4e95739b0af0a9f54315a13788e345d6","sha256":"60ebfca1c62cf79b9e64c8fc0bb76750567d3672773e229e8d469a41db2ffc67","sha512":"98ea48fcc95f3222db5f26bfb996d3f3c8ea1d0fa11bb5b024852cca705aa43437435f7c55e6d2c28b32476b95f8cb2bab5c18e97881f1c89ff7da5c935920d1","ssdeep":"","tlshash":"9b513c6b091649fd4e32fce77b9cc7002642156f6444ee46701bb4e1842a86979774d4","first_seen":"2025-10-31T04:50:36.703863Z","last_seen":"2026-08-08T06:09:30.240402Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/fred.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.358Z","timestamp":1786169267358,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/fred.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:03 GMT\r\netag: \"68d0ef7f-73c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8aHUSIgmTZRoVX26N50vd0IQDuq8NSM9RpTtWZh9YdG31aWMYNB%2Fg2pvTCS7vk9CBD8m4h9Pg6HcQ3QPqF2YX%2FhXPdlJhDAj0TqkQc6RbyN3sWqaaWefajWLq377pv5ssaaxcVc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0fdb1c759-OSL\r\ncontent-length: 1852\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1852,"size_decoded":2595,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f7493da8e714519249d8802cb754c408","sha1":"e96874641df148fc109d22755c37d45440651098","sha256":"515a61d471ac9cc8b15a8e38acfdcf7bb645bf5a02d22627b0c461abf769aaf5","sha512":"4331f6687e836bff6b07021bb1dcdf9ef98192edc6811b8f0b808ca3c30b6ed90233536c9dc663d9d5dce807d0f025dd717b513d16243c9e80e567084f828011","ssdeep":"","tlshash":"723119e128e75605c7e5e27ec98242e2832be00c184e08c5c8e16593ea3d822ed5f9a3","first_seen":"2025-10-31T04:50:36.815774Z","last_seen":"2026-08-08T06:09:30.127355Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/mirai.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.401Z","timestamp":1786169267401,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/mirai.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:12 GMT\r\netag: \"68d0ef88-2e2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JmdzeQZOpqMqW8lO4kBxq7ZIdnjHQZUpRrrYi9yC7v%2B31VLILS1ZF7%2FC0AUW5qGkucFm4TQsMd6%2F0PTnV06bY9Fp8M67YFOOHD0qyoDpQE5dgMo%2FyxA%2BoFigN5e2nzhZhA8RQNw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c13ddbc759-OSL\r\ncontent-length: 738\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":738,"size_decoded":1486,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2820876af1e6e646f6730e4a5fee192e","sha1":"202dc91599a9d7204cb6bba34f2712b0fa2f2fd3","sha256":"a9ee50484732061b37a05ce619e7c119090c665614fab1567b3e2ab59176f438","sha512":"f246e44b632aa8f474643dd11581e588256fce2a14b33f9c4f9bb2a7dac47bc615ff2647cdc2282ac480a1f70325e3b66b667237b5a770573b301afc02a8be35","ssdeep":"","tlshash":"60016018a4a31f3fbc4178b7a23d9de19596c3b4c220ad09bc03532563688232b83e0b","first_seen":"2025-10-31T04:50:36.844332Z","last_seen":"2026-08-08T06:09:30.221936Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/san.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.423Z","timestamp":1786169267423,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/san.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:15 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d2643-5d1\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=j9mIgAeyuwUwd0MiBgndGNetKi5zRUylcYO8VCvOB%2F5ul5jNfjTN7FHlymk3Z8xE7gzi%2BP5Jqf8G4MebkIXOeE7XEWyu7%2BzCiSPGypLpcujbxamAmgyqTXVuvdNOlsRpig9LGE8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c15de7c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1489,"size_decoded":2221,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 78x100, components 3","md5":"ee087a6165361c81b5fea558c5d7448b","sha1":"5119dfc27d25ac56a2ded4feb644b34f9fe62bcd","sha256":"7bd7eec8bff1d4835084ff53a6ef1b83525ce74cbea28ac87979e2d6ec8f735e","sha512":"c4e5ad4dabc266c6ff54f9885b994914162220e25b04039d61a107b2bb7bd557a81754658f461bbaf29a1f700334513bfd0982c511df7d078e189a4f4235869a","ssdeep":"","tlshash":"d931c9fb4a765203ec2a20b616cf85303254e614d3cc4395d426d3564a167da0d01fd8","first_seen":"2025-12-07T05:18:33.865434Z","last_seen":"2026-08-08T06:09:30.186805Z","times_seen":83,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/pyth.svg","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.212Z","timestamp":1786169267212,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/pyth.svg HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Tue, 16 Sep 2025 09:27:07 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c92d6b-4cf\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p1WdYjMaUhPaXBZkpu8XwsqMZu4g9rCTEe0fBW6wzLndeD%2BBpFVJIAoJ9Dy4Cp21ygKB1%2BPo5fIM4qMG%2BejBLjoGNxtDkHEsuW7t28aCQxMzuQArZvhMgmgzE0BifQe6YSocn%2BI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c00d10c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1231,"size_decoded":1339,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"86ab8498d12ae85a981c736f4c1ad7d5","sha1":"ac8b4a5ba8c357cb0e039ade01a9bb5edd15d2d1","sha256":"f3c88fd9f75cc92e361dba733d133ef55072a63d70d3bbcb37ed7b8242cdba64","sha512":"7e5519d9d8197b21a46dc62a5e0bb85ab1f3861fd3d69cb53f06762164fd4555930cc0813d08d46659cade0ef25cd7dc08a91114fa3859d75c8a219bf42366cd","ssdeep":"","tlshash":"152132e83358054a41d9c3e35b20929c1b7774d7e80d0a9dd3241f298ce6caf9e96682","first_seen":"2024-08-20T11:34:03.163097Z","last_seen":"2026-08-08T06:09:30.23711Z","times_seen":94,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/mew.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.221Z","timestamp":1786169267221,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/mew.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 18 Sep 2025 03:50:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68cb818e-eef\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sK%2BK5U5P5R64bFR0Vj%2FXA%2F7DeEZfdfQeJyekdRiSL2Yt4tHsu1fGGgC4HQLY0wtq7HXt7TGLxbP%2FoICaUZ5TdP086RnlievEA3Mx6zQByxS96HxrPlHnuYCzb%2BMKg6r05pO%2BzBc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c01d18c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3823,"size_decoded":4410,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"c68928f589405abc4ecd6bc53c28958d","sha1":"d99491e86f5e76c981dc5383698cb5f3f63029cf","sha256":"3093e3a988753fae305e52cb8208bcefc2908143c58e7088faf6f382ac0594e3","sha512":"bb6833f6c0566a5196a38146417e08791f50a66311ad673ba3bfa8e878680fdc9d87958e7ddd0d1a4dccd06be53d7bb591a15b5718ef1885ec85422d13aae1a2","ssdeep":"","tlshash":"4e717e3245d9c0b4f59608ff385a127ded0c9f601602908b15dd7d9f7db619a84d225c","first_seen":"2025-10-31T04:50:36.696443Z","last_seen":"2026-08-08T06:09:30.22366Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/kmno.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.262Z","timestamp":1786169267262,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/kmno.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:46 GMT\r\netag: \"68cb9582-306\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8nJsZL%2FRkC104fOkDoo7K4xMiHZXqrUnqJyAPVjVQPsh39fiABUk9ZPeYlX7g4BaLTiDmYUtc43bHgVxbCYnxRUGpiSVRRVA7V2%2FBhPLn2hQsDJwnZvn5lIMXBZ4WDfna0HQA0M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c05d3bc759-OSL\r\ncontent-length: 774\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":774,"size_decoded":1516,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"8d087375b58ed9f89c5fe8645b9e243d","sha1":"d40352c1a7a1a82e2d5154a74576cc8082a86ff1","sha256":"2e5af2b1a8a1be971f6c5b2d6f9862692c6872fde421138b2370bbb2b9373bad","sha512":"ea2f32726997061c2b57a105784319e4554115cbd19eb89b30e72ebffad0103a604dddc94c93c59607caaa135dc976598c36bdf55317f43b3a0adf3f453a341b","ssdeep":"","tlshash":"d801c59803a02ebcd6249262075f3bcb0ab024c384f3dc21d5f68f9603032725d82912","first_seen":"2025-10-31T04:50:36.920895Z","last_seen":"2026-08-08T06:09:30.181731Z","times_seen":91,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/ufd.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.266Z","timestamp":1786169267266,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/ufd.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:40 GMT\r\netag: \"68cb957c-5e4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I%2BQCLHSk%2Fwk7I5WKlWfWCrcDlciXmRSVIrPKyE%2BH9OmiAd%2BtCivR97Z1XCUFddDTfP4W4qlL2rk6duxp5NCEGLDFeqPNo9Sxca402ecxu7y3VPu0i8ouSU5JwoFY0DDB7pSPW2Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c06d40c759-OSL\r\ncontent-length: 1508\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1508,"size_decoded":2255,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"42ccaa0797229532db809fc0e93da9d8","sha1":"bb60ee0d97e72951915f41be44e3fe40e7793951","sha256":"d7565a86ee13408d6e7a31c2be07c167f8180e3607da28871ea2fe939dc7ea74","sha512":"02cc9fdbd362e0bc70cce6c1dcfa812a8cacf46d08aa2e6ebf6852f882fc761fc948205f74721e14be400a02103b0780bd64c0cee9b5e70f2122f5e0ac8c39d7","ssdeep":"","tlshash":"fc319535b30623d8da022fbe31c91bdea6783c7a7248573b8f0052235b101e5945c69b","first_seen":"2025-10-31T04:50:36.76016Z","last_seen":"2026-08-08T06:09:30.230024Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/hustle.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.431Z","timestamp":1786169267431,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/hustle.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d2641-67c\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8YVm35qCgeuqSCTHQPvPtWoh9aEaYPOn5IE5t79ITZoo3kwC62Y2rSMZM1RCVxIs8Q4FmPMPRw9F7GEi7AK8rmRB%2FqgI0YvwOfamuCKqa71l7imPJxWprxCgMiILudyQlwSqE4I%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c16decc759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1660,"size_decoded":2403,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"bef6a462c34189c595eb1f5aeacd82eb","sha1":"2256e59fd787587d78319d03a4d8d898c87e9c9c","sha256":"ee77a41f88664d99441c9e58cd34e2e90433827b3c0007d1490c96c52b966ff5","sha512":"226e15470d4ce6b9536e387f43e5ad569a5fec8d7a05103adf0bfc79843e63a1d0f81aa4292915293c6b99cda76b9637b2bdf56f10e8606621b99a0e65680b9f","ssdeep":"","tlshash":"9a31ea6347385703f6952533accee9b802d7c5029d3c41eab38a7505f4e64c16c62a88","first_seen":"2025-12-15T19:53:25.005906Z","last_seen":"2026-08-08T06:09:30.228233Z","times_seen":82,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/hehe.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.432Z","timestamp":1786169267432,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/hehe.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d2640-6ca\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bNPWrPuDUhqaVF2FLAFyx7pMUaZ6ivDAbbft3ItyVvF1aIxggjV3gySwvNMM%2BVdtdol1L1LG9HNteGLOZY6NnYw9A1OkxsdmUnT8nyVMicyPIpmqhl32V51gdASkpteJvMaojmM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c16dedc759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1738,"size_decoded":2478,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"82b8d514d6ab6c35d7bf468f4da5b6a0","sha1":"8225fe612ce47554af8a45c2690c60dc1aab979b","sha256":"f1ae8a4214e3d2b37fc125488050b0cdda1dc74f447da0bb213f12a5c05e1af4","sha512":"1e56a0fe8db6d65de91b3c47bc462c645ce48bcb43faef3d21e49acd1ce4d92c889c420ddd13172d20515af6d6e1582ca55f9023ea38ca968a7e5213437cce4e","ssdeep":"","tlshash":"7231d8ab97335017fa2665f34480de28626fd6c29248438ad1665b2474f8bd70c55ae8","first_seen":"2025-12-15T19:53:25.147832Z","last_seen":"2026-08-08T06:09:30.246962Z","times_seen":82,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/jupsol.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.184Z","timestamp":1786169267184,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/jupsol.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 16 Sep 2025 09:44:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c93161-3e81\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=70C6kwNvijSIxiyv2VM65vQPnj%2FrjEhbWFA2%2BsGMGFibFkC3M%2BUk1SddTe6INPojI7ZmGVq0abohE5lgA%2BfOcSKGR%2B57oWOeVVq9sBevobAQFzw%2BJYU6%2BIqB7zOMEdsdehPrlAg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57bfecfbc759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16001,"size_decoded":16620,"mime_type":"image/png","magic":"PNG image data, 360 x 360, 8-bit colormap, non-interlaced","md5":"fddecb361b3a702ca8d67e5bcf2c131e","sha1":"fffb0129b548b83f4b69c39a706b0da09fbeef5c","sha256":"92469dca2b99aaa5ccfb7935db4e04ca42e2764361c17c15b41e8dd8ae902241","sha512":"3bc5cd172abdc4e2a10ad2caaadd26be333d73be0eb0cc422cdf37b3670bc2983c61396296296059f92904116fcd275e7d95c282b155d24fafbb048b90983ddb","ssdeep":"384:Cvac04X9fxg1AqtR7g+Z307mm5DEb4a3LZwbQ+LLtM+d4a6DgDGL4s:CvX9xXUu5v5DE8a3LZfMLtM884s","tlshash":"b572d08b0bd3f510317d1c2359a7845e4bce3d9ca8272a768607b7caae327ca8653615","first_seen":"2025-10-31T04:50:36.934872Z","last_seen":"2026-08-08T06:09:30.149691Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/w.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.217Z","timestamp":1786169267217,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/w.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:24:22 GMT\r\netag: \"68c92cc6-680\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CAdzd58b8HbRG52a0qFFIsmY1ztO%2B16mfb4%2FzL2%2BMRFW9Df81B3agwLE2NxsLuDQz0Xfyr1bNFZuw4w6OFU11ugvRG%2Fq%2BaYRWNh7AOmKwExg1nSSuv9Zkil3uxRzQxxq4S3tbXo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c01d15c759-OSL\r\ncontent-length: 1664\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1664,"size_decoded":2413,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d880092e094fa134138ef428e3c89f9c","sha1":"a1ce979f319a7228c67f086b2f5032c4809d767b","sha256":"eab40e12a58df1c2654e388f72006257d37247bdf2a7aaf0746c4ebf40f19784","sha512":"388a03f6b21399dc4205a5f9c3ba1f8e3283c486772f209a4a643801073d394416cf625d6bf178b3effbf5d86af0a4eeb49e9169dae5cc5caa763fe9dc13c6af","ssdeep":"","tlshash":"f0310a5aab120285eca2647c46d3abe152412e02921cc6f0d204ab420e17e213c7a387","first_seen":"2025-10-31T04:50:36.695043Z","last_seen":"2026-08-08T06:09:30.143659Z","times_seen":93,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/pcule.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.281Z","timestamp":1786169267281,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/pcule.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:49 GMT\r\netag: \"68cb9585-5c0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9zyrN4Rbljmei%2BeFRuC6eKefIKFpiq27tEh1BL5pIELNBojJq%2BxewNaqGbbVtOZZK4jJ92wKuprMrl%2BkV%2FJ5IA7Fx%2BdIETrEPjwzTnlgg%2B0SQm2FJzAjKzhq%2BUsgUU4zFZGH4JU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c07d4fc759-OSL\r\ncontent-length: 1472\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1472,"size_decoded":2225,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x91, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"560dce60af9ae8c07e01d284a86c7b22","sha1":"2a5a876211e55692205a461c5cb1742dd9726c6f","sha256":"211d7c0f1df78daf4139733eca3983efb2386b09f2da12fe763145c3f95434e7","sha512":"cc101f3219a5cbde846dcf1483545c5a50ae6ab9a525d18d295dfe6c0df82d89699c73516f5a36c93facdb74f6125e8865a339af5a8c3e243aa99f141dc3c236","ssdeep":"","tlshash":"d931c9864c5324bdd9957ec885f9f2e4eaa671bec528f684132d61318cfd02193140d5","first_seen":"2025-10-31T04:50:36.701042Z","last_seen":"2026-08-08T06:09:30.226385Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/spsc.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.463Z","timestamp":1786169267463,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/spsc.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:42:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af362-1039\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SC6Brj5u701FazZshrXRUC0CrHLzLSvrsoMz1EKAMf9YfJOThIxjJinDSJbx5h7YmQkJLleZl06bb%2Bal9s6lMU6bjcJBagOEWNWMisIBTtcYRhQurDvqC4emzA%2FqurLqmFKe3II%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c19e06c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4153,"size_decoded":4710,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 200x200, components 3","md5":"bc55575598827aae34061a445697469b","sha1":"3fd9fdbc152959b79bda47ac31721744d4980b7b","sha256":"497b18cfbd8a38a26867722141802d09e15319604e97d3f72bb54253ad0b7cd9","sha512":"d927582c1ae57c769d0cfeb3130d57830f0140b1425363e4a6fa14d3e0bb37dd5ba63d6d80d803184deb400a7b510194025a060f8fa874ebb85dda4b50b0f77a","ssdeep":"96:IElbw+ik7CUpIdcMcGAklrl+ccGmH7PPfsofE230jXx:9wCLyd3rY59PfzFkjh","tlshash":"ca813b8d6368071ecec3993958a3ebcbc73b1b0c944c965f66416214af209f22cb7587","first_seen":"2026-01-30T00:58:38.080417Z","last_seen":"2026-08-08T06:09:30.209037Z","times_seen":43,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/crclx.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.476Z","timestamp":1786169267476,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/crclx.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 07:19:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca240a-803\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Qgn%2FiQcbYY0mFs9eiPFWxQpjHfgA90gWOpmAX%2FuHb%2FAjXNZiv4UNxRP6SciRgow1E1Cupj5roaygl7ePHcnXtbq6DgL9YnUFfD0M9ZJbjkIAI%2Fm1SpvFmbf7n2ZebPRRYw9kyXM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c1be14c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2051,"size_decoded":2867,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"2f7cb62b1bf09b2ed0883636ce56086c","sha1":"02fd71c4416b947446b9daa5d1d2c9cc85b89504","sha256":"cb527b6514ae983597ca9e451160b83a3f0181ae64af5de2fa26bb1240967346","sha512":"9068ac58fb5f065e30fee1c57911850cb4614d838daae192b22fe21f3baba0a65080665cca610bb991d49324b777e6380b08c6abdc6fbf82a227630d3b80b427","ssdeep":"","tlshash":"92412c707cf51219d43a8c2bd7846106d6b59e8f307dc63242618c7553e3d7098de25a","first_seen":"2026-03-31T13:47:07.064388Z","last_seen":"2026-08-08T06:09:30.192071Z","times_seen":21,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/webfonts/fa-brands-400.woff2","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.795Z","timestamp":1786169267795,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.5.0/webfonts/fa-brands-400.woff2 HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://sigma.metaeora.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: application/octet-stream; charset=utf-8\r\ncontent-length: 116672\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\nlast-modified: Tue, 28 Nov 2023 18:34:15 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CXp7byksAmwOar5JGpYuTxRBVKItntbPObAXO2Dj1aPDAysC760drkRZ%2Fm4LHlnE2%2BmAIx9JDyEJtc6904THUTghYbGIE9c%2FuwSMQoNz3ysfylCli9hy1YeJNe9gdQZe7NuOs49W\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=5,i=?0\r\nserver: cloudflare\r\ncf-ray: a27c57c3cf8d723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":116672,"size_decoded":117658,"mime_type":"application/octet-stream; charset=utf-8","magic":"Web Open Font Format (Version 2), TrueType, length 116672, version 773.256","md5":"0474ccd4d3ec29857f1e7f8b9c56df8b","sha1":"3e8f0f46b2949dcc309f65fff1372b9a05e8f480","sha256":"b66b3da5ff7b2db79b6cb5a22c3e762e2bf16958a11987e69eeb1980bbbcdfb0","sha512":"2ab61a54ee830519d0aacba1e12f1ad920aedddea8e682cebe51bec78ecd7bbc403343f8e00b45afe804a954a52eb5dcc70983bb01239c36422f8e6f18e0bb5e","ssdeep":"3072:y+cQdfEX4HdgCsxZhk8minCk+uU254aiRt3kLVzLm/j+G01Z:KQdfjIiib+uUe1EK66G4","tlshash":"0fb313cfd4276bdf0a65cf3fc2034e4f3b586c1254b9bcc540b3617826a6862274aa5c","first_seen":"2024-01-04T18:36:36Z","last_seen":"2026-08-15T00:25:17.572255Z","times_seen":5100,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":10,"send":0,"wait":59,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/reach-router.umd.esm.js","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.235Z","timestamp":1786169267235,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /reach-router.umd.esm.js HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 30 Mar 2026 07:19:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca241d-64943\"\r\nexpires: Sat, 08 Aug 2026 18:07:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BHoFYQwNmg2mFYXuaHtZo%2BOSE7xH7XyvWhmSnoGX8l2zS4vPIzxyUG5tFo5b%2FOkPe3Sjl9DyB46ky95TfHMY5zFJgC3h4M3joF53Jt7DlP%2B57cS70aFoQPvs5iBOEw%2B%2BCyNDStU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c03d21c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":411971,"size_decoded":90156,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65159)","md5":"2bc08603fba4c1c4ec27b465fca333f4","sha1":"485d0e6614a9a373095bd075137466fafa6263e6","sha256":"9c183574da9b02c0288cb1a0034e17287efae5f0b149b3973b31b5ecc21f816b","sha512":"9a6fa39373fb755f9d08deb7ba8efedfa106501fa21b5c787dda8b1322895f9b5f3b127597a6f64edae058836889b7af33b9faa1f6ed2c377905ada2c38ca306","ssdeep":"12288:4iw/Ok/A2+ztu6u9NvPHxGQ5PugqhzMUHTpjkdYwRmffDS6Do+1OP1LZ+Pn9+sf1:4n1HugqhzMUiC","tlshash":"1794dc460dcf3407a349a53558636b7dfcf0c60267a3ac39a982e2c7e8d4e8e55c927d","first_seen":"2026-08-08T06:08:05.185614Z","last_seen":"2026-08-08T06:09:30.248045Z","times_seen":4,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/$michi.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.260Z","timestamp":1786169267260,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/$michi.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:41 GMT\r\netag: \"68cb957d-3a2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AciltEAQMxtVlQiYaky68NOONRoejuPyB6n20lYJ4PLyo50I%2FagZQuGcskzmU%2Be927dGKK202UbT6Om2nl9obDyoek%2F8vu7kEEBE9VI2R1AeydMpTthgsTiZ63FBRfJReEMdYNw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c05d39c759-OSL\r\ncontent-length: 930\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":930,"size_decoded":1674,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"276be821e3c9d3e547b2c7f44eb22d78","sha1":"568e97675c67225c31163d73f8281c39adaff44e","sha256":"999788f2ed8ef804fec140075f6a4c055f4a8cc69ee8baf1c4c19da2e30a20a5","sha512":"b823fb541afa2fc2421b28cf67fba8082333feef0c34bb7f18500c5dd10c9782a854d0d0b8e45849508c7a5eeb34dfa519aab60fdf2020ae463bd38a5cc3026e","ssdeep":"","tlshash":"d011f753f5e314919ca4cc2728987fc671baee9082def1220597ac520bbd63c3291377","first_seen":"2025-10-31T04:50:37.007462Z","last_seen":"2026-08-08T06:09:30.194096Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/gork.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.309Z","timestamp":1786169267309,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/gork.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:41 GMT\r\netag: \"68d0d3fd-596\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HGfIBQpfcEN%2F2clK5cX7VLwP%2BEHIkx%2BhI9I8zUoE9N8tsBgTgRm89pi%2FiwgBJC7uzh7KS86iq3n41jZu2G%2F9j%2BWpEH8nhUprBC3SFhRBqmhSUK2M8UjpapWebnf9sOImONVXQ8w%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0ad75c759-OSL\r\ncontent-length: 1430\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1430,"size_decoded":2181,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2c76d5bd59cd926524ee5dc3f9a9ac24","sha1":"7c7ae35e266621cfe3f22513647f46f6936e00dd","sha256":"8cef1bf3625b09ff3ec7e45e21e88665424ca5be31f73913185eddffddae6b3f","sha512":"05fbfb16eaa61f2db730211d045605316638656162b0f3bf34125fba791d6606b292549966397760281fe0b5e1cdbe41c2b96351d3d5421676ec6f6f03503bde","ssdeep":"","tlshash":"5621986287897758e545677060c04f54d7a57f398beaa73f4540485a1f240818c1467a","first_seen":"2025-10-31T04:50:37.001313Z","last_seen":"2026-08-08T06:09:30.138116Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/hnt.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.337Z","timestamp":1786169267337,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/hnt.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:42 GMT\r\netag: \"68d0d3fe-966\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JMF9uJUj4YZPhmGPrPeXj69S%2FpWzeErqcWhq69psvN2iS3IVk3sRVPVeEdVZq159IhUOZBfqhLzd34yEFdzVp%2Fz%2B8MwFA%2FGbnl5j7pmTlwaO8YBr%2BGbZT%2BHQ1sGtVZfIhawjRp4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0dd9dc759-OSL\r\ncontent-length: 2406\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2406,"size_decoded":3157,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bec99f9b7ca50eb2f86eac372bf70c84","sha1":"cf949397fc1bfa5738afc9f10987c675acc7267d","sha256":"78689338b5b79482a3d98a589893f30b2a8cb1907731a90c2dd3d92be40e5108","sha512":"436088e7b406314b4058724e94e74fe7e2e77f4e0fd74b31ae564d7a412d9e7cbe6719c75cfe2558f3acc53defd7f8c313bbce2f4ed6c787a58362feb378327c","ssdeep":"","tlshash":"eb413b7f09f138b4e8d17eac8ba2b6038637a4142c660071d18a59236016a3daa37f89","first_seen":"2025-10-31T04:50:36.935949Z","last_seen":"2026-08-08T06:09:30.147751Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/melania.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.339Z","timestamp":1786169267339,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/melania.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:46 GMT\r\netag: \"68d0d402-1380\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JYbWi%2BWyXf2GQqogjJYziySuCWJofHnTzhlYO4UgQQsn%2FLA%2F2enT5op%2B02nch1BbR%2BemkrPlc25hoBKANT343A%2BCZkh88Aee9h983iO%2B%2FIJEPEhNjnGHLzTuIUhEcwt7WpaM5Cc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0dd9fc759-OSL\r\ncontent-length: 4992\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4992,"size_decoded":5748,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bc5826ed1187ede2943cf39114cb5ad5","sha1":"ec59c551e72de1e83ef0dfc9234e1ef23352a492","sha256":"5992dbc7d89e2e615ce581c3b74f4ab27dcf2e985dfbbbba7e2f678c3eec65dc","sha512":"e65c6e8d46394008731e82eb574be2221ec32c685809b06de3e6a14fbc95dea06161853e9c5d8006497f50f5555dc71315c57a54ebf3327dc8723ace6d9ee22c","ssdeep":"96:c6MT0D5MdtbZPAVwzVwm+HaMKOQg5P0MqFoOrZ5tTAH:yYNMtKwZ/eMzoOZTC","tlshash":"31a17e75bf166281fd7f733454b05f6090a7373dd72289842a6513151287288ff8910b","first_seen":"2025-10-31T04:50:36.689047Z","last_seen":"2026-08-08T06:09:30.216374Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/soon.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.342Z","timestamp":1786169267342,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/soon.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:34 GMT\r\netag: \"68d0d3f6-4ec\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SWgQ2IG6%2BfNbmqg7pK%2FJHvecrLH4zMb66DvQHmPFwBa2GQGPK1t%2F5gxy8YO%2FQK5szgrWj6hb3Rdq33vJbn%2BgSRpVC6C%2BKWyT20J5J5SSn1unqP12bR4AdnaXz7zmsHUfvUGNpn4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0dda3c759-OSL\r\ncontent-length: 1260\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1260,"size_decoded":2011,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"88006edfe59ddc9697a4fb7882b2b547","sha1":"ac1fc49a0c1752bcd8dbaace476cb0d5c8e06a0f","sha256":"71d6c69accb539de223e3bbab09401de33194ee4284b65481940dbee23988d74","sha512":"44b5acc78e79e501e17c698c8116b29d1033a9536fe893711cdda7c55c5edbd90652c6c96edd01490dffd10288ebb8f1af913138c05f511fbbc8cfab0e1a9cc0","ssdeep":"","tlshash":"5121b7809e7f7b67e8b39566b18aad1091a6113db64f6250c8f0b87d12b9c11830c19c","first_seen":"2025-10-31T04:50:36.830931Z","last_seen":"2026-08-08T06:09:30.205089Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"corsproxy.io/?https://api.mainnet-beta.solana.com","fqdn":"corsproxy.io","domain":"corsproxy.io","tld":"io"},"ip":{"addr":"104.26.6.163","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:48.984Z","timestamp":1786169268984,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"corsproxy.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 07 Aug 2026 04:26:04 GMT","end":"Thu, 05 Nov 2026 05:25:37 GMT"},"fingerprint":{"sha1":"E4:23:68:78:6D:77:45:06:32:7B:54:FF:CA:B6:E5:3D:3C:C8:66:AD","sha256":"D5:EA:22:C5:67:CC:DA:97:A7:79:C1:55:DA:3F:6A:C6:F0:9D:1C:DB:2E:1A:B1:A5:07:78:42:7B:DE:6D:29:50"}}},"request":{"raw":"OPTIONS /?https://api.mainnet-beta.solana.com HTTP/1.1\r\nHost: corsproxy.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://sigma.metaeora.xyz/\r\nOrigin: https://sigma.metaeora.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 403 \r\ndate: Sat, 08 Aug 2026 06:07:49 GMT\r\ncontent-type: application/json\r\nstrict-transport-security: max-age=2592000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4KKPvKXwLQ1KYaLfPSR4%2FWGC1TrUdlAM4UJP9EtbJ7CEjmeUjeTCkpejzI6aZL9PhusnuLEYdt%2BvzcpTrwRQKQsokEcKx9YsSNFAa4DVv04DjX1AViKqfE3vuZHi2Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: a27c57cb387256c4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":632,"mime_type":"application/json","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-15T10:46:18.4937Z","times_seen":17901663,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":2,"connect":1,"send":0,"wait":17,"receive":0,"ssl":11},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/bonk.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.209Z","timestamp":1786169267209,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/bonk.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:24:22 GMT\r\netag: \"68c92cc6-46a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uqAc4bgtmWOsMdAp8SAyeKbEQTdiRh9RBHl9IYKIqtjGtYdIpVJfUJsAAuQr8pnBN2HAqmRoEg5kpndwAl47%2BJ90LzRIikOYjvx2OegNAC%2FuG9w5oBi7MEhwvLK6iqaYCMXC06M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c00d0cc759-OSL\r\ncontent-length: 1130\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1130,"size_decoded":1873,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"675b3d39c61152966c8b8f9f2147be7e","sha1":"21e4f6b3a60b92d655ac77c8b9f9bd696faf7ee5","sha256":"804ac5a4dc8ccadb08d85872421f8d87572ed56ff328fcb5bc5f530080d62dfc","sha512":"bd2c3985fea1f302a7f20245c59b2a731e32497e96aaa9cc574a2152117e87b4238d7a0a7bf84bd02f5be89aaaf7e902f62fe78ad5a6692272af82ac4d87991b","ssdeep":"","tlshash":"7521b612a7634e49c72c153c846a7b1aa099f5610419788f02bec2513efb84adf289ae","first_seen":"2025-10-31T04:50:36.659286Z","last_seen":"2026-08-08T06:09:30.244631Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/sol.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.178Z","timestamp":1786169267178,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/sol.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:42:43 GMT\r\netag: \"68c93113-26c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TZjQ2y1Se3eeEmuwdNHkEA4lUaZmOpFn4QIF%2FY1yeLn8gj8jhcR4KVY7UuQPV3ZhGzzyVYh%2F0Uj8rFR9gLpfI8M6BwuhDJsdY7CnyZf11s6aN6pvOQVPe5al8Ng1S%2FQ9Q%2BrSJz0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57bfdcf3c759-OSL\r\ncontent-length: 620\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":620,"size_decoded":1366,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e8547fa5ccc4675b4f3208fd43d51590","sha1":"ba297bf4e08ffc4c3994a29c1c0a4ed4751402fa","sha256":"797bbd8533cf1c0ae74b78afa4b44f23dae4596b47f4d784ecfaa319c68f2d8b","sha512":"3fbf3bbd6331e3b00efeca1c492c5212d9960dcb8390edc7b425d0ab9563d38f285974aaa47cdf69b3a67ee4ae383c2b5b32aba873ce9c930dfc110e47585f17","ssdeep":"","tlshash":"95f0e12a5b714927d429e53c0abb1396101cd8b6d03852ab52228e565f8be11dff58c0","first_seen":"2025-05-07T12:19:22.461777Z","last_seen":"2026-08-08T06:09:30.213129Z","times_seen":93,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/arc.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.272Z","timestamp":1786169267272,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/arc.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:42 GMT\r\netag: \"68cb957e-160\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oS4twfAYxQec9ZRCyaZv4qSka%2FeydqoFHntt8ICaolSw29uOeh4CtQWhk%2BFgGGDVl08K4cGYFgOhpvSpi2VOoDxoaj7vgpd2iiC7DquP4HZ4KKMbpjuceMnjYvhCwx3uaMgyJgQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c06d45c759-OSL\r\ncontent-length: 352\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":352,"size_decoded":1094,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x89, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"886213ed584f3096f4116db9bd2c253b","sha1":"dae4b536768edd0568ef755a4c2eb33add4bad38","sha256":"cf989a0d0add7fc5f7b4dc42b6031de28d3554e699fd9d8f06123963660d3260","sha512":"c28a5920b940ca4d1a31d4d2b68721fb511a1539424072253f75fc340eaa8745a493a6ce1af1e0c4e270b4d739c2129e5082c6b47ecfd4d89da1ed4a71f77f4d","ssdeep":"","tlshash":"2fe0c0105b9de48cd09bd99d4100912944debc256a22f07ab89cdb8520ba212b660b63","first_seen":"2025-10-31T04:50:36.948185Z","last_seen":"2026-08-08T06:09:30.164097Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/spx.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.359Z","timestamp":1786169267359,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/spx.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:19 GMT\r\netag: \"68d0ef8f-77a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ySLRuL8MruRJelenp7c%2BWQ1ueyejG4oCJRFaDxEe96OgKEBOvepISn4dm%2BsMemduew47XKaEWGJn2oQm42J70UW0nJV%2Brtme34zPa1nUElZjCDM6h7u0ROI6eYHxEAhK8qJqwpk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0fdb3c759-OSL\r\ncontent-length: 1914\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1914,"size_decoded":2659,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2864e037db297bf245236475fa5868a9","sha1":"57ffd3d74cbd2313c04541c5088d976b63c8ee72","sha256":"9addad58453fc3868216b604db7ba4de7a02de6fb5cab3d73a9a56968dc4b448","sha512":"d1f1aff81965e6a6105b90f7a63a0e0905e1f4045235a8c957d6f887e9dcc4119c4d521537e4605636ff09c234c00168910ffee31c5235fe703adf6b0d13fbb3","ssdeep":"","tlshash":"b7411b714f70f385c99c1a2e37a02f1202416dc936145317c1b00572a7a3a88d19bd7c","first_seen":"2025-10-31T04:50:37.004766Z","last_seen":"2026-08-08T06:09:30.240987Z","times_seen":91,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/gun.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.426Z","timestamp":1786169267426,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/gun.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d2640-599\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SjSOtT3aXuEaxmS67NUGSLFRmxTuDbfbhqWt0%2BBlyk2%2BiO1D80TaBA5ibA9ywaiKf1cJ3rax7tRfnv6ddsS7h96JSOnJLeB6Ph%2Fv8e%2FZ%2FDcyE7mqFqiNuv3LknPscC0x%2Fz10Kis%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c16deac759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1433,"size_decoded":2258,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"81aa3aa51f52e6cee21535a8242d51d2","sha1":"4ee8b44f0dd346ddfd664ca780635e4ec2293bbe","sha256":"50e68afaa5caf85910a8d411ddc001d252c175f25497fe5718115701a34d89ee","sha512":"5ee6c0276e41542e4c396327a7901620839d54a1c7aa7f3cf09ef9b16b40e11c98585d5bda069829c01ce29cee820ee6d7ea56fd7d8d0a97ea62886a06062453","ssdeep":"","tlshash":"aa2108c038227e36c6612475da01ad2db9163a263027d2412ebf85227c8dbb796b61f0","first_seen":"2025-12-15T19:53:25.21971Z","last_seen":"2026-08-08T06:09:30.222554Z","times_seen":82,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/logo.svg","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.170Z","timestamp":1786169267170,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /logo.svg HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Sat, 03 Jan 2026 08:45:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6958d71e-873\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TzDrc78IAaqC4R9UgrX4g0dhechVQn6y1kX0LtITASbWZQXO7acps9M%2BsZAEv2nY3JHHlDzrwoh4gbCXv0%2BFyjiY9iYqIXufYQy8bt%2FSkbCKXuppFghHveAYAUbv5aj2FDIY6sQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57bfcceec759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2163,"size_decoded":1914,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a58ab35a86db43390f96d67088c2a0fd","sha1":"9c26f4642130afa6d93fad34183da17f40e2c0e4","sha256":"92b6fdc8226caf5e6c3d176a3ca5dec136db05c4484035159e49fc20f6b88d27","sha512":"06bf3f6ef0819b7d6fa840a89369cdf0fda03f030446da0aac9f5f8af1303a792305b10a7a58f69822d6c59e7f477064fb005eff2093ce949203e79adaaf8198","ssdeep":"","tlshash":"894151e887d47694f509abf08826a015f71b24fabe56d754a0e9efd9ae21189480dc80","first_seen":"2025-08-14T02:29:46.244889Z","last_seen":"2026-08-08T06:09:30.197818Z","times_seen":119,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/jto.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.213Z","timestamp":1786169267213,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/jto.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:24:22 GMT\r\netag: \"68c92cc6-6a2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nIbS3z6DYOq4xNeMaIpmT%2FtcZToVrTKV%2FxXju4ErYZiKYYjx5401YzvnjFkD7x3BKS7SUcxfxF%2FRCmk7hdX%2BY1ZuuGDcaBPy7tsM25EElfBVCXhLUfDCpAjJhUdon28Io0%2F4xLQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c01d11c759-OSL\r\ncontent-length: 1698\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1698,"size_decoded":2447,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1a5096a9ea764b61bc67a458ba2c8077","sha1":"d042dbd8d9829cb313c9e8bdbd95a356409d8dde","sha256":"09c8631e454b7fb7f335d1ecde16200923f2aac2d93b8030baab5620a80bfb4b","sha512":"d99a55b171be1b6a8b7c826a61a6d5cb7e8ee690b5d470e20ee743af155c773a5b9a3adad20edbd1b12174f8998d3c8424a3166afaf54d42e0e998b5075c7433","ssdeep":"","tlshash":"4c31183680a38d27c738ed3c3c4b6b124032680ca1047f6b1a419e9c0e81c2fae5ceda","first_seen":"2025-10-31T04:50:36.799812Z","last_seen":"2026-08-08T06:09:30.139806Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/jlp.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.215Z","timestamp":1786169267215,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/jlp.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 07:19:39 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca240b-d5d\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y8VT6ZqTJlxZG0GrqSJrhbCoJX75PFyERy0jYvqDiCfNziJCz3I81BYHZfRho5cVcwLz6EkdlAEcaXhL%2F9v8Rny5hWJzR7c3f8vGKWl1msYGRbqkLGxTefqt3F1EwicYdeVX0%2F0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c01d13c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3421,"size_decoded":4238,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"9e14fb934ea0c5945d2b9b2cbaed8555","sha1":"4f77676f7871e129a51e2a02c5bd566ca045c601","sha256":"96eaead08f347fe768b4543956d422a7b72ed21088b6aaf89e614ecb77ea75a8","sha512":"1c378287fd54405e898809f93576b6fd27857f0a77eb6b35dd5e5fff8813b1cc615a49d02b1ac2a40df44cf599e7c0fe64cd6c33af6cfe4083894b65cad6dc69","ssdeep":"","tlshash":"03616de3bfc0a919f2c6173691f2141bf8d80ad112147a611b1e05e692e5d4ec0b30b9","first_seen":"2026-03-31T13:47:07.115311Z","last_seen":"2026-08-08T06:09:30.13048Z","times_seen":21,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/swarms.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.267Z","timestamp":1786169267267,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/swarms.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:51 GMT\r\netag: \"68cb9587-4a6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7BZJ2iKIyeRVRCqkkTVGeJ65BSo6cwxfLGVjGbBXRsgDeQmuKlChJYJL%2FqxKmMQ67hYh0wSSNJ0DQqnSrrrGONMCZuJ9SJ%2FUYKDvDguQopJrAAWOJIzHOSQThiXRrQ4andxYs1s%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c06d41c759-OSL\r\ncontent-length: 1190\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1190,"size_decoded":1933,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"105df6daed68ee3bfb91147de07f0e8c","sha1":"31e078984547c04d8264c6e690d6d74e9980335d","sha256":"a17c21e49218279ff9813e07bac84792a62c797168e5aec4bd2e4f4693b4a019","sha512":"ff9015b98239c142cf4edd60ada8bd284f3a731d49c1ee6067a4617f34ba14b898bbc738fbd5847199f71e7a3646fd56a4fa4d972df7259ea3f4c46fbaca64ea","ssdeep":"","tlshash":"bf21071ae6282653c4fd4c0526eed8cf3535244090109a65f24f5b620659efa8c10a09","first_seen":"2025-10-31T04:50:36.861207Z","last_seen":"2026-08-08T06:09:30.144214Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/fartboy.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.307Z","timestamp":1786169267307,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/fartboy.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:40 GMT\r\netag: \"68d0d3fc-8ac\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bJK6txtuS8l0vi60b0AhT9uMWu0xJCnIjdhoMSah9Dcp7rxx%2FSnYRWgLEpvBNm39oVHWxbNZrM6dTUb60VRhfidUUiZARjys3q0Diqv1Vhb6KnfW4Qxj7kX6RQznOY17KZs9uMo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0ad73c759-OSL\r\ncontent-length: 2220\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2220,"size_decoded":2961,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d5faeb0217ae1dcc345f6b0c424e7b45","sha1":"08cf76f9c325db778a8e1381082a19f6b6d07d81","sha256":"1e25bc27c657ff46139836b2f032f368e4c0cf147d2c2600bb44af3fd2535b29","sha512":"9452b2628debac7501528faf5e15387ca23a9e0ef82c11d3dd6cefee82b8bb2040dfa0d24aba58d3c55cee9157aaccf62ffb4da489ef597ae99580d3e52cd75a","ssdeep":"","tlshash":"f8412b2fe850462ae805e5c044d9f41af1db0b0d7ba994a7c38d6f18c06669192644fa","first_seen":"2025-10-31T04:50:36.868688Z","last_seen":"2026-08-08T06:09:30.153497Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/titcoin.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.349Z","timestamp":1786169267349,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/titcoin.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:21 GMT\r\netag: \"68d0ef91-4dc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FyuYtI4nPbfjAI4w2rxN%2FDmRMIXCSumNdChSXI6xmDWokt%2Bmsm%2FABpgeZjWk0sZXuFJsgUjFCkuz%2Fk7GKlXcmQDLh%2BKu6KpeeztrVLRk7wB668s9jvwXJTKGp4wc%2Bq%2BCJ6SdzNI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0eda9c759-OSL\r\ncontent-length: 1244\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1244,"size_decoded":1997,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2d65131ec0d2b3cb9adeee59f8100c6e","sha1":"ce05cf7315622d69a0bfd3a3b8ab1ea9f7170ad1","sha256":"0a15d28e38f82c33090e8290cf9a4e43277986ab438d51a19ca8913a1408c298","sha512":"ff2a5151e231bd4f384ff2f9bfe88caeb9e2549921846622e9451a21776a54f704e6b7694f19ad84dbac75e51549e5f371f614a730548fe75a0352752aeb3add","ssdeep":"","tlshash":"1921b73070ab9cd6faa1e19208b8544bcbbb7ce40603ae6e08fced1405f42082558f93","first_seen":"2025-10-31T04:50:36.804576Z","last_seen":"2026-08-08T06:09:30.207066Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/bc.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.352Z","timestamp":1786169267352,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/bc.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:25 GMT\r\netag: \"68d0ef95-7ec\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jr%2B6%2FOJ6ul%2FWRTteA1WGkPZ3I6XLxYaZfZdk%2BZktJpI43Ql0RkDI9pWN5GeWFYFjtmM%2BRqb9DOdkc%2F4maBfIhRc42bo%2Fhi9EkHbGwMX5LJcM2rfKhMZSCeLaytUPJwyYUNnf%2BDk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0edacc759-OSL\r\ncontent-length: 2028\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2028,"size_decoded":2783,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"da9221034a235710639dd4a71a34f6f2","sha1":"2e66eecb5836423f41967133c1c9bbfb5319858a","sha256":"25fe63034eb43a1d3db966986e2b8752adbfa9fca3c3c29369d1e4aa0cc0516c","sha512":"6020fcd1d9bc5303a79385198527feb46b6cfe1513c7c0741887a1e717b342ad07d7ce2cfaf98f88a75ad43c46228b97df340eca47b69f92b201d97517f28299","ssdeep":"","tlshash":"f741f878b239e740c8597e3deda6879c698b40e1bb0a0c661a8c15b0252ef8714a1d88","first_seen":"2025-10-31T04:50:36.942321Z","last_seen":"2026-08-08T06:09:30.227632Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/dont.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.455Z","timestamp":1786169267455,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/dont.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:42:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af360-7d3\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vKW7BPy6mdTrT1YGquLhCuw%2F47oCeDAnDMTpIStveF%2BiUbaT12cSJmN2sEr6CNjAqY3f0sXLraCWKe6%2FxNmai8MM9HtPbGVwqSapDJk7%2FYBP9JXcAFCgdfqvU8bg%2B73oRS95cs4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c19e02c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2003,"size_decoded":2755,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"157f3b7a5a2ebde910ed4dec4bac1183","sha1":"5b53356511af6c9161a098ba03c0ae41929b9abf","sha256":"04cdf05488b753ad9f0a3846a94b439e72164ea1d554338e92b8a7bf212e81d5","sha512":"3f53c2fcdcc3cb134bf8e49da423fb2fc670858624be39946f5c10eb867c5004f788d6ab931e2a8fd4bd1f2d24fd3b5d490ef44c966b69849b4bdeffd06473f9","ssdeep":"","tlshash":"0a4108d3f35b964fc062147b5ce1c23b68812e09d14a9227a3063e1eed29a9798862e1","first_seen":"2026-01-30T00:58:38.222866Z","last_seen":"2026-08-08T06:09:30.191053Z","times_seen":43,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/yzy.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.226Z","timestamp":1786169267226,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/yzy.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:27 GMT\r\netag: \"68ca7a8b-254\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=j7gIcNkFk33k9naU2DUy3sDDU2gi0t%2BJOZbOzGEQ4JQHYoA%2FkeSS6VTssdFdjmgXyMFKvLaZbuhMSbrjAq1%2BgM8prt6gvsXSskj6yAhFcutsk8pMfNFComqvpUZ%2FVcfl4Ljas38%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c02d1bc759-OSL\r\ncontent-length: 596\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":596,"size_decoded":1342,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"134a1f24a0c3a369108ecaf5b5087ebc","sha1":"d6f06f42f1f69fa737f2da25c51ab15bf5fb041c","sha256":"4f260305478c7738f539072a3e1f9cff6fa16c6b62e87f33c0ccf70c5225960e","sha512":"a0ccf3eb8d7c4a4b830191945e80a7a1e4fdac6cedb698a971e25e153e412f67e196015a7dc78b3da2a88f6ef7495deb60d04fd4fee8824df655dfc522493d58","ssdeep":"","tlshash":"8ef0200bae237e51c02a703c48e2671ac048d085822aa5f333088915de27907e9f89c6","first_seen":"2025-10-31T04:50:36.687063Z","last_seen":"2026-08-08T06:09:30.156447Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/swtch.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.263Z","timestamp":1786169267263,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/swtch.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:39 GMT\r\netag: \"68cb957b-3da\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F7Oo%2BLeVc0EPdh%2FXhPekK1012FZMBnAIO%2BwRTQuaaqqziixa%2Fm0XiZkQ0vauU7JWdHfOiXkSBNw7auCNRU7fZbkn7MkJ2WlAvzlk6OA3tzf8eS93zm9vHK4V3zBNPXPXSOhAXe0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c05d3dc759-OSL\r\ncontent-length: 986\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":986,"size_decoded":1732,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5197efb425d9ac409817b70e92ed7622","sha1":"7ad2127913e85eb4d0520390c6dc9edaa0100978","sha256":"17e3c44f32dc83178553c15ffa7777388e73db2ea9c16d7e96c2fbda10d3c227","sha512":"7cf8401820a71c024881e839fb0a1f72049b82ca22423f6b0ffcae0239b7a0ec2f544c29a5ea4679d739ce7fce1ef0d12885a3f18688ebc3d98967ca9aa000cc","ssdeep":"","tlshash":"0d11cc2f5aa104197c4779ec0f2467530a95d5cf1414030774b5bcf893a5304a3b7214","first_seen":"2025-10-31T04:50:36.825709Z","last_seen":"2026-08-08T06:09:30.218063Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/orca.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.279Z","timestamp":1786169267279,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/orca.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:48 GMT\r\netag: \"68cb9584-904\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SVTh1Kl8EaL6TF%2F4lXnf82ohRjx%2Bryxr1voUn8JbreJkX40g%2F5wax%2FwX14O%2FgW9o3HnaNC7Bam%2B84Y04UkvvNwdlQ9ZeTsiHpXol5MaP4hcU5LZaSsKIlUErmqbPWNGch4UvO7Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c07d4cc759-OSL\r\ncontent-length: 2308\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2308,"size_decoded":3059,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f144e6a4e44346e636d6f364152cfbec","sha1":"c35fe3c2830c4a455817d784e64b1f39252af3d2","sha256":"697921aec7b9356d920e50d83e85a736867870ffb954a1527b6e11ac9fc317ad","sha512":"5cb9c853ab26e315f2ba3e4b5718d4b4bd3146155442ad48bcb84534b72724a3f8eafa0be5bdb36adf406c5771f15049f0f765b635979af0b7eb73dc04d0df32","ssdeep":"","tlshash":"bf412baa77674b83bd442c3876ed229c274a92ee72cabd50742dc1c44731a958d2a0d9","first_seen":"2025-10-31T04:50:37.012799Z","last_seen":"2026-08-08T06:09:30.073412Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/usor.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.462Z","timestamp":1786169267462,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/usor.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:42:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af363-ac8\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ae5f%2BZR%2Bxd848ior9hfdUTXodoI0%2Fu0JA%2BEJK1mfmlmgki%2FuEHh2slFBEg6K%2Bo8xoyUNq8ywSRUzA5QyOpeiEpSDUUi1a5dxCwb7E%2BgHWW3ATrc989j3zZRJ57WjdE%2BuwxC5y0o%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c19e05c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2760,"size_decoded":3538,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"78870b26ec8bd702d4f3bbced3cb01d8","sha1":"94f4a4d8c42b901445a6ca0cf5d22b0760b0c3d6","sha256":"b18991afbf3c8eec763bb7e57a7885d96e88fd09add764aee289a00119226f94","sha512":"33ac6735c58e2824cea279cc3885ee0e0d4dde65ffaf2879ce50f6eae48a53da59f7a26b5a2be6b26e1fadbafa98768316c9a9e94912de0a5cbaa280ce0d48dc","ssdeep":"","tlshash":"8b512b6b63267502d76e187e0e34d5289715680ed10087e82a8ad38965784e46cd33ef","first_seen":"2026-01-30T00:58:38.225133Z","last_seen":"2026-08-08T06:09:30.172941Z","times_seen":43,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/punch.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.475Z","timestamp":1786169267475,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/punch.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 07:19:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca2406-b7a\"\r\nexpires: Mon, 07 Sep 2026 06:07:27 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SUiwDcfe%2F%2Bm02HJwXO%2BQVNeDIWpgidWhBdIDPQxwHYgEP1Q9%2B6w%2BsndDHYAqiwN8%2FBs7cdHmn4AjGvWRbHnn5tlNDoDX48K0y1BAgCe%2FtbVSFHM1flwU3T5V0H93mwGepMtar30%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c1be13c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2938,"size_decoded":3706,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"bfd594b1e97965618c3ac2d9146524dd","sha1":"c2321066b07752855b284d489a1c8e3ccdb042fd","sha256":"f947817c0873f9038f75c2fa720e3d3c74de87bc4ab0e35080ad42b82057d14f","sha512":"0114098f17cae729fee82136328e19155f51c39a6f3637748b4d46e40d87b0cc740e46ecc8e40b6e469f793c3349ec7adc3369a524277fad0c43364ece90d780","ssdeep":"","tlshash":"df514d9f8725a853f07729358466d320729136c0cc5a675ed091d30f7b4d8f5b8c49bd","first_seen":"2026-03-31T13:47:07.248953Z","last_seen":"2026-08-08T06:09:30.181032Z","times_seen":21,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/io.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.190Z","timestamp":1786169267190,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/io.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:40:57 GMT\r\netag: \"68c930a9-34a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=R3Emo27lfV1oSq5%2FLnmt%2F2nNEotYytqwldKjSgFVYHRoVTtmUOv4n0w47wP8V5YLUoHP5kElhSqVDX50qL7wcAAoYl0EJ0ht%2BpCF1P03IqlGSXHxieRIB7VVzbWjwxvkbxUe7gU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57bfecffc759-OSL\r\ncontent-length: 842\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":842,"size_decoded":1586,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"af2a04f8a1bee054d4f8ec70da7375b3","sha1":"d05eb67d52b19618a8933eda4ae39d242ca4ad9c","sha256":"55d7d7a0b33c9b50d00b39b231318e9363b3edd56f5a41214d60e0279a3382fd","sha512":"739344a9083b4815572bf0071f4dc4036d015707a6360be73112eab34e61b8ae37f4e1fa6bbd74e1fba4d13f0ecea3d0f406ebca1d2f5c2b4ceafc2c159a8c75","ssdeep":"","tlshash":"660175114e328bc0dd17b37948fdb7fa60e0c45cf3a0e9734b6699201dc84484ac8faa","first_seen":"2025-10-31T04:50:36.932153Z","last_seen":"2026-08-08T06:09:30.139219Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/nub.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.276Z","timestamp":1786169267276,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/nub.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:48 GMT\r\netag: \"68cb9584-462\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ITejkM57D7AwPR0IqXJp3BNXOVnNtUqAN5OZpgOy%2F%2BMe%2BXl1hn9b%2BYP0%2Fhjn85Iq9GYEj4XSBwor7WNXel4G0KdNU4TwBT2ttKQuJyzU%2F4MGg9A0WdxpM6qRwbPVueCLyWvGLk0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c07d49c759-OSL\r\ncontent-length: 1122\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1122,"size_decoded":1873,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"48d4b841849caded28441c9d0927d581","sha1":"20c804b45a3b783ac6d90d517d3ff3fcc9510f1f","sha256":"cbd6ee5250caa8b4396786a77a020cf8e9da855ac11165baf341abef248404b7","sha512":"d536dc7044aa6a7d81db6c4daf7f1fa22af76ed262d9cdc2b47bc4451398ef416af5f65b7cd81293733c4bfd04f208b3606c9c71818ce75b0c2dfa47efd0b95c","ssdeep":"","tlshash":"2221f982093356cdbb606a648ce20f49454648fe4dd644d8f643646f17d02e7f30005f","first_seen":"2025-10-31T04:50:37.003074Z","last_seen":"2026-08-08T06:09:30.249778Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/hege.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.408Z","timestamp":1786169267408,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/hege.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:04 GMT\r\netag: \"68d0ef80-80a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=g1pgHjcpN%2FL9W%2FuLM7wL3QvjcfFmyLSapGBFhz8t0E0yijIQA5UWjfW%2FM2XL0NNm82Z%2B4ncwWEH2dTpjAS%2BWyT%2FTrIbzdSjpNfmVXI2xuNa6ImkCQB4biDDe2sKUlvE6MErBvNg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c14dddc759-OSL\r\ncontent-length: 2058\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2058,"size_decoded":2809,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b6612a0411ee3a0bb1bfbe8c638a7c23","sha1":"3ab5ba2f1f83c248af5e9f39974c2846da19f1c0","sha256":"eee308e98e8bee77677c4f662491b4f297731c51d9cb523a56d12ec0d52602ae","sha512":"717e1c55d6349dd00dc4fce9b23741bcd63ce3cb7136cbb1bb0628e1f68a699bdbaed3760ee06e3e2276ffee78d2d2a3a6e49849d38ea48a4b42e8b4300dd849","ssdeep":"","tlshash":"4e41f93767103490eb1ca1f995ef77e2a615be06839cda01778ded4e99828c082336f5","first_seen":"2025-10-31T04:50:36.681123Z","last_seen":"2026-08-08T06:09:30.186008Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/cat.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.415Z","timestamp":1786169267415,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/cat.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d263c-62f\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Cc8wkGDcCBVXIrM6OTTZp0u83QRZ%2B8r1fy37ukufLK2lovBIrrvlub%2FRZu9pb0dZ86hgve0FwhlFG0v4WO%2FSdDs8%2F0yFE%2F00oz1v9McuYXIKzOh%2FXoFKmDwk2kjruWcPiJvYZ9M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c15de2c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1583,"size_decoded":1955,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"b9b89bcf92538c9f3435be7e9050c3d6","sha1":"781469929f714c755b274a2795fac4a5853f567f","sha256":"121df1b8df15ac5584f9672316fa526bbf19671bf74a13438b8b8fa46535703b","sha512":"4fc060ff412a3529b7a9743380a79c0b7064a9d3818a8e73fe75ce535d1ff43eb1eb417be2efd1024dbb1a5748512040814b05836f409915f8641b3f45e2c395","ssdeep":"","tlshash":"1f3163a337151b02f61606b954d4cfb0e3a6bd32daad9344c7475126e9ac1c09c847cc","first_seen":"2025-12-07T05:18:33.946629Z","last_seen":"2026-08-08T06:09:30.108151Z","times_seen":83,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/io.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.429Z","timestamp":1786169267429,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/io.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 01 Dec 2025 05:23:13 GMT\r\netag: \"692d2641-2e1\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KS0Ryf2H3mieWOljwXTPrLicEKlYFmCOhs1RtdcVPI%2FlS9B7rz%2BQIwQnk%2B945IRoUqSmy6oS7whiN9XFIWRUjhJaXP1dwrAix%2BMqfigAKjbLl69PwI2Wnz9Ksu4laU36gIjt5No%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c16debc759-OSL\r\ncontent-length: 737\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":737,"size_decoded":1524,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"ad5ba629bc0215ae0e7c3619579ff11b","sha1":"75dd539e081d5f7a67d066a1421b2325af9ebf98","sha256":"87364d9f768d44815056212498b70ea771bf72dd504f6e35f1810cbc4c485f54","sha512":"3679a7299e9969e8d01ec11cda3f8ab4d203dc351bcb163257c06373120bcdcb5b58308a2ccfe7b256f2e8339a8eba141ec9cb74d4407981f318867136ece1fc","ssdeep":"","tlshash":"280144b3ce5e6711d8d4cbf0626d6ce5dcb272c1213ab412cba1a231618605887f1707","first_seen":"2025-12-15T19:53:24.970328Z","last_seen":"2026-08-08T06:09:30.190509Z","times_seen":82,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/wojak.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.440Z","timestamp":1786169267440,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/wojak.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d2645-8f8\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HCjC%2BOixdYYz5V4tVTGjkf%2BdzaD5hxtxvOBlC217N5%2BlQJNOwlQ0BWa9eDtvvc7K6P9bhWz%2Bjd3GL3mkXmiJyU4gc0%2FIorDVL3Eh8%2FZTvr7LykRl8e%2BecntKMzS75gpP8%2FzfSN8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c17df7c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2296,"size_decoded":2710,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"a74e924ab910f4f1f2c74fba53d44852","sha1":"6d26f8e85a026a281135d4f6a16440cfa52826fd","sha256":"a2b7329788ba44f73a8b02e2c95f36dd7c9adfdb0cc9227e3a8d67dcc1e2a7a0","sha512":"0d57683aee2657165fd10580f84b126912bf163a42c05cf11743e2f9d71b17069cc5ddbc8eab047778d275a4e9e457da77f0ce8c06125b4d0671009ef2a3f005","ssdeep":"","tlshash":"ae41f8f327981a0ad9061b7028d04732f334bf105349930eabc98158b6ae4d09858f8f","first_seen":"2025-12-15T19:53:24.955261Z","last_seen":"2026-08-08T06:09:30.135821Z","times_seen":82,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/birb.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.479Z","timestamp":1786169267479,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/birb.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 07:19:37 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca2409-486\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Dm9QlntjaVfTeH6YlPGNyCrzVHwJl7YmEbX4A%2FkIQoAdBZp07OVUTBh7Ao7tAV8h8JAygH%2BXf4U3tsUpzd3r8YsFRJZAjidteZZGRxBq1INJUvK2B9Z1KHnvQ4h%2BE4tL5IRmbRs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c1be17c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1158,"size_decoded":1847,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"f8fe3b3398088f0e69a11f175bc2e60a","sha1":"4c3d3548c02d8093e1e10f3f0797b03bb3826d52","sha256":"58499474dc41bdaa10400233da361529e60b209435a5ced9f39ea37fba913aad","sha512":"656d482bfe8f87849fea0f689eaba2fbe37fc982019d0b0b43ae435fae1adaee848e54d396c3c9de061a5b5a16089b2f3a78fdabc6b32a0d19a656f53aa62533","ssdeep":"","tlshash":"7d21b69b3ae61803ea0618ff0b5ccd7c13c3cd00c1fe96291553d28128bc2c1bc80a68","first_seen":"2026-03-31T13:47:07.146401Z","last_seen":"2026-08-08T06:09:30.174589Z","times_seen":21,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"solana.publicnode.com/","fqdn":"solana.publicnode.com","domain":"publicnode.com","tld":"com"},"ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:49.068Z","timestamp":1786169269068,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"publicnode.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 07 Aug 2026 02:01:04 GMT","end":"Thu, 05 Nov 2026 03:00:51 GMT"},"fingerprint":{"sha1":"94:5F:9F:32:64:19:A5:50:59:22:7E:16:22:E5:6B:9B:1C:65:F3:ED","sha256":"7D:67:31:E8:80:74:FB:3E:3C:A4:1B:9F:F0:BE:71:56:CE:95:31:97:BD:28:75:B6:47:AA:02:45:08:74:76:65"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: solana.publicnode.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sigma.metaeora.xyz/\r\nContent-Type: application/json\r\nContent-Length: 130\r\nOrigin: https://sigma.metaeora.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":130,"data":"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"getAccountInfo\",\"params\":[\"8ycauMwVE61B4uWz87B2k2G8mMK7iFjRoBHooaVAcP4k\",{\"encoding\":\"base64\"}]}"}},"response":{"raw":"HTTP/3 200 \r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 1728000\r\ncontent-type: application/json\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Origin, accept-encoding\r\ndate: Sat, 08 Aug 2026 06:07:49 GMT\r\npriority: u=4,i=?0\r\nx-envoy-upstream-service-time: 1\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\ncf-ray: a27c57ccc96e56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":326,"size_decoded":801,"mime_type":"application/json","magic":"JSON text data","md5":"13b0e7d55fa69ffeb937818f884ff0f7","sha1":"4fbbc029942b873f69ca9320fd2b50ccdc27a93e","sha256":"d281588c56ef639ba690fdbd37e0710452d62466f4fbc6d0ac5a01d85e206d6a","sha512":"5570620def0cceb0c241d4bca16e2765a1626f79a09e5e53623de739d6d29cf37644c116448b2339e2bce5c64dad3ae93e5912dfd42a8efba3612831e85b7390","ssdeep":"","tlshash":"01e026803e090bbeaa954a568a1562e9a28109585a00494b12da1d1471c955da41b9bb","first_seen":"2026-08-08T06:08:18.913337Z","last_seen":"2026-08-08T06:08:18.913337Z","times_seen":1,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/usd1.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.205Z","timestamp":1786169267205,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/usd1.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:32:02 GMT\r\netag: \"68c92e92-726\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WVwoeSwkyeAX50uNZhpZK%2ByZdVEJTUmDDsJ7mMjsJ249JeoMsRzPdq5W581mZJlJ1waJMyzD%2FUpr9U6tDq7Ctybrfjge0JChj1WbtKshlQE045gqi0A4lfUIS65QoPtdJeAXB4Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c00d09c759-OSL\r\ncontent-length: 1830\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1830,"size_decoded":2573,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5e808a8d721bddc770a526443b6982ab","sha1":"cd67633ffd7ca5b54f98d6c46df309a9b9f88e8d","sha256":"474b49b4bd9842dfe27698818f432da925ea02ff8010cd3ebffc2150d6a8af55","sha512":"0f5b7119bd2fd47df9972abdf07d48c24b4e66c77aaec359f882bba0803dd53d699c537d33bbe2f19c8a5113b178010fde1f4ea6a745c8a563517c8bac7b783e","ssdeep":"","tlshash":"ed310bda63150246c866747cc6e5e36553f2d50110e1f897cd25895d8cc6462cf1ce5f","first_seen":"2025-10-31T04:50:36.878179Z","last_seen":"2026-08-08T06:09:30.24248Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/pythia.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.264Z","timestamp":1786169267264,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/pythia.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:51 GMT\r\netag: \"68cb9587-3d6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QdWQYZBcQEOxc7xU2k%2FPzojkbUcB0BdWMYK95uivmA1opwLidDq3%2Bl3z3hckva8uv6I0Xht4QVikVO%2FAouhSD%2FrGwYUei4AmPK30HoSVYoGfGj3JlstySmAsExsPRMwVMTUhlDs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c06d3ec759-OSL\r\ncontent-length: 982\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":982,"size_decoded":1728,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d9b22244032e62070307c6e6a9babe29","sha1":"a1426181b6d9c374a675a4e13d1bede255fec9cf","sha256":"2ce1185fd5a956399ba52422ac237c7102a1b19811d02aef074db14fe1d94df1","sha512":"1784d5bed2e8815adbb673b709ca5ecf6be35fc2209a449d4498027b250108c91f9f1b650b1c20ca2d566371fe852279fcd7d957d1d360a66d8591ddb5ec3951","ssdeep":"","tlshash":"0611cc664a2b28b5f1466a0df13d6d078c21856cc6fc1de46819bbf30cf0224f1b863d","first_seen":"2025-10-31T04:50:36.827315Z","last_seen":"2026-08-08T06:09:30.188019Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/gdtc.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.297Z","timestamp":1786169267297,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/gdtc.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:41 GMT\r\netag: \"68d0d3fd-bfc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6VqAPk42lvKL%2Fmjj0Sud2Y3%2FWz3NWONQC1bXQFHv8OTsRVUZeESKGFEcVG0A2arfNQzK15qWGww1j7Ok0ob69QuESOOrDFhF4mEDgcVp9IO3Ewq5tQpWXgaF5H%2FRtMYbGMuPIGk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c09d68c759-OSL\r\ncontent-length: 3068\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3068,"size_decoded":3813,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"cce70f15961932f4631c2063dd669064","sha1":"ba58a2e0aafd539be4fe0269c07557ca3f7af656","sha256":"0fb624367d915cba3fb5107a1c897af7a79cd6f9471ffd0c17ab0c35e4f353dd","sha512":"490647a4fd7325b18d4591e037aa7820aa427b2ee1292bd9b2e4e16f5578a0f2dc9b845d19a744650a95920bcaa612f541bb7b3864013ed15a0866ac6ca12677","ssdeep":"","tlshash":"0e515de9db3f55da856f31a4ebf14d2750901880d3834aefacd78c49200eb193a519aa","first_seen":"2025-10-31T04:50:36.741534Z","last_seen":"2026-08-08T06:09:30.215325Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/habitat.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.308Z","timestamp":1786169267308,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/habitat.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:42 GMT\r\netag: \"68d0d3fe-328\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n0Npg9Xq8CGpWxM52glRGaFgn2gS5Nkq8lBioxsn%2BnUK60bGdmo2xNl2dL0llAe1QJ1n92NxqqsVhu6mrH0uq%2FR8wUA7EIk2DunKiC27PXPcwHWFs54j%2BZGJPirHTnvtlue1J5s%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0ad74c759-OSL\r\ncontent-length: 808\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":808,"size_decoded":1552,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"bbb833633bf33b3bb4d730cbca80a314","sha1":"98113cd1cee3ce214dca3935d446c78a9e942a34","sha256":"ed4a2c9cbfdddc0990f0e0f2297d04133d903c4b918affb0218091f09277cf76","sha512":"2e9ec0b2f6df7f725d66fc2495fe5b23fdf4a77c238852e98d679ee28d0e85d842ee0c13bf393f60b60f075c94c41ea14365596dfa90a878da910689804c1ec3","ssdeep":"","tlshash":"a80186bc447c4115c408101074ea382bdcf599881672c27706e31ed6b21f76ba8f033b","first_seen":"2025-10-31T04:50:37.00936Z","last_seen":"2026-08-08T06:09:30.218685Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/nvdax.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.319Z","timestamp":1786169267319,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/nvdax.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:49 GMT\r\netag: \"68d0d405-4a2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IDFv3gonuyZ0Rx2fINsbXZXGHi5FiW8sGFP0hbznw5ZeIC9yUE8VydDB%2BOlyc2dyg3XcjpdApcF4z33CSzN3R7gMrK%2BB88PlT5Np2%2FoUciSAGP692WLF2%2B%2B5Pb0RQ4SrnoBoPPQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0bd95c759-OSL\r\ncontent-length: 1186\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1186,"size_decoded":1935,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9b36650699815d6a5e70fe1fd70473cf","sha1":"7c98038510ce51c367c40be86518b97c053d36b1","sha256":"6ff027fec2b5a0f01c63d9defcd00c21702eb091f13e371b9635b283f9c01234","sha512":"6b5a17bbcafe3ae8ce6ec0b23ed41617b92f2a8b4072c34bfa8cdd0c62f019d30d2599a1acb5c4c66be4b996c91789a2a5509aaf17372883d7f4607681cdc6aa","ssdeep":"","tlshash":"5521c637119c487c07484e42f9994b7d12567439db7afb3786c6ff251cb8488971b292","first_seen":"2025-10-31T04:50:36.768654Z","last_seen":"2026-08-08T06:09:30.239715Z","times_seen":91,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/rfc.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.350Z","timestamp":1786169267350,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/rfc.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:16 GMT\r\netag: \"68d0ef8c-b6c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lKVjwG729O8V6OiGRhHOE6j33kJvyMZcXX8pxqPl7Q5Txlp5LqwvYvsOs6qsCT84vRCty5Ffp4srVXuJ7mjQcADARBnuFmWKYEtSKl0vaw8fLS9Yxx04GOwOt0wWewq2Vqy1JGs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0edaac759-OSL\r\ncontent-length: 2924\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2924,"size_decoded":3663,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"939cafa9e0b39bc1b0969d27c9d17bc7","sha1":"312209a1a451ec09ab8f7d822db00a88aed71745","sha256":"d84556ce0d006366ac500ccdc57b32832f0ccd8a8d9e273e94147695c3135443","sha512":"503931850fc12da77b378d91d871420a35003b027972c0fa3ae17a8541368ccec2d26df77b3f9779115b8445a27ce5a4d00ee11277dd3234e2f2b58304bddd9e","ssdeep":"","tlshash":"8c515caf5328586fdbd72a186fc8a088010436b5990b9ffd9953ec26e861549285164d","first_seen":"2025-10-31T04:50:37.014578Z","last_seen":"2026-08-08T06:09:30.189416Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/grass.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.377Z","timestamp":1786169267377,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/grass.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:04 GMT\r\netag: \"68d0ef80-610\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gWq5b2tiGR3DiA6DBvoYcPDSdioSWbRDaujGRYE6hT2sLTZru%2FMD0hprDrnTFTKB%2Bz3ss1Ns0FKf1chqYwkQ1R3OH%2FhBB3VmuJzdZjQECTi%2FUUdw8MizfrQCTdJf4Yy57B%2BQM0g%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c11dc6c759-OSL\r\ncontent-length: 1552\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1552,"size_decoded":2301,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cf35534f81d1de514005ffacc46e4f48","sha1":"ce44c88d20a069c766ba6186521c31d6d25b58b6","sha256":"ef5b8f13e21d4448cd995466a8635adfe1715d9e35e8a9469077714ffee77c7d","sha512":"ce04a99e815dcb66474fb70cdfa09b068d4c5841aab9f987bd581f1264842ffc05ada232223ed4627287ca79eea63af509bd49ac3af387dcfa05b387cd16ab5a","ssdeep":"","tlshash":"c131dadc6a23c941d77d653dd5bee3644892b816714354355654d0b0e0a73c38820de5","first_seen":"2025-10-31T04:50:36.784401Z","last_seen":"2026-08-08T06:09:30.208042Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/chillhouse.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.417Z","timestamp":1786169267417,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/chillhouse.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:09 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d263d-584\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Dqeytn2MZ096VfQH%2B3OsNXEAYznmvx9re98SR4wynLhQZdlOpAjdy9w57LQKFuB7bgFCaMDRUont8fAioS%2BOfIH7DKbNguOePh5gN0cmtv%2B3kzUUvBlvNZt7v19KaFwMQc01QDg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c15de4c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1412,"size_decoded":2136,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 85x100, components 3","md5":"aa690a3d193cf61f98fa8b77c96f2a41","sha1":"3bbca9a768738972540d387610f5316db8bb377a","sha256":"f3716bd48ea2b5fad654d7aa8727c4a228426bfb86b12ca7a8c08ecdabcfa802","sha512":"de853edc84dcd16ca5d91584cf99be10db269ac855c92545f52eb509c61c4c19f2e4813a7c200c381a89618f70304e03824507cdc071382be982a0b42efdf6fb","ssdeep":"","tlshash":"892186ea435898f6e8390a7f4d86c4a00c0baa12c8a8139e15469db5f8659c27c51f6d","first_seen":"2025-12-07T05:18:34.167529Z","last_seen":"2026-08-08T06:09:30.170831Z","times_seen":83,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/gp.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.280Z","timestamp":1786169267280,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/gp.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:45 GMT\r\netag: \"68cb9581-2f6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HPPymYe%2B%2FkNjXN6X0uk7nArXNy%2BDjrwNx0l6RDDA%2FSkViBfV5XNjO8VA7%2FwZk43mA2mNw1Yunwu8w6ibAaPIeZZQUC0aN9JD4kIBFCEOlTTdlhver%2FP2XiOtANMh4b95A7IWapo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c07d4ec759-OSL\r\ncontent-length: 758\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":758,"size_decoded":1508,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"15bcf7ed1df1314b691a6d69e2b7583a","sha1":"bf0d18cefb973265c65a08418f84fa9c1b3b1edb","sha256":"9a2400bfe0a2d9cfb7a89b0c1bc70f7f31746747b4ace23889bb189c7bb6f750","sha512":"0fafd93d43926396fdd02e74b39b71442047fc27bce09f448551c708788f181555dba99198a59d327a21e64865f4a74ded23b8398f1182970c8602da54fe16f3","ssdeep":"","tlshash":"e0017590c120f780575d4b0b94dea13a60324182807050b23f648a8ae00d4e94944b8e","first_seen":"2025-10-31T04:50:36.992848Z","last_seen":"2026-08-08T06:09:30.225537Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/codec.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.310Z","timestamp":1786169267310,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/codec.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:39 GMT\r\netag: \"68d0d3fb-25e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dHiEw5krRxIn3JtJ9I9pZ8EMwQ78HdTdeJLz5eKMHHN5XkD3wCfi7G09ATRlWVOPo1fBbiLOvgQ2CNYrHWi76zbvk7DaoddBsx2cfed%2BBrA%2Byz3N0NeTGwFaSn72AYOOmuOwuFk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0ad76c759-OSL\r\ncontent-length: 606\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":606,"size_decoded":1348,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d127a3c3f1c94baaacc57f64415c9279","sha1":"d32ee4af752288057471b109c1f033d7f5217739","sha256":"e80c0d028505e82c468bc75da08e0f455749740ef4e4b5ff9f45c365810cec40","sha512":"fa41af926c68e43f6d9127cfd90300a348a727d52318df9ec8aed43222feec741ff585320de1a08f8988f3af9567f736138895e458953db7f477461767d4846e","ssdeep":"","tlshash":"9bf0b715dbf2fdf5c18cb93d10c9780c30d4400c112e3de2e55b8044f31184d5480ae0","first_seen":"2025-10-31T04:50:36.949045Z","last_seen":"2026-08-08T06:09:30.11124Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/maneki.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.234Z","timestamp":1786169267234,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/maneki.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 17 Sep 2025 09:08:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68ca7a90-32c3\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tN96vJSnHWufCBk8Cj6lLmzi7KuRyGBfv723cd05t%2F9IOU1naT5Hrv%2BgLT545ST9CNjpiNy6BaSds%2BQhzzS5KfiTMVo6N91cD1DppW4Yi%2BsmE8B2lzVRTLv8K%2B60oyqmIP5tykk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c03d20c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12995,"size_decoded":13634,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit colormap, non-interlaced","md5":"0e883ff1b71d928e3debc4d54721ab51","sha1":"1758499fbd7ea5de15b9074480a64942acb25a4d","sha256":"4f35c51b476b921e86cca882b87f8c3f4531e5a01d244bc5dbcf2baf556ce840","sha512":"e2823433a97b6bf0f888b79db2a4618bdea8122438f346a5ae21a4cbdfd15d4ff206988cf2a94304ebf3f526b3a77bcf113336b3e58297c55a22ffefd4d06990","ssdeep":"384:PaZotO6r7EElUv50rUVpxvxDEthVfCxpXBQ8Yz9ZDB:WXSIElq50ixwthVfupuZ1","tlshash":"1e42b0015fbcb518ca9e237669510181c530cf1b96cb8db2bf65b04047f7a8e6debe85","first_seen":"2025-10-31T04:50:36.859028Z","last_seen":"2026-08-08T06:09:30.117816Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/usdc.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.179Z","timestamp":1786169267179,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/usdc.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:45:25 GMT\r\netag: \"68c931b5-87a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Qg%2B1ODpHawMT9lbx%2BLnpH06CfJonhkZDU8NR5AfzidJxsuIcSUGiCuEiv9Ni9yF4PbICPvRfr1k3wpcl%2BrLsHlq9IWnud9BX%2FDxn4SpQUd8Fu122hE5VTxuHTtF7iKoHiMhwhL4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57bfdcf4c759-OSL\r\ncontent-length: 2170\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2170,"size_decoded":2917,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2b1cc9796258e8b444cddb152d10b742","sha1":"b194e7192c90979e8f27f659b29bc5e488ef04e5","sha256":"4829789fa6bf5a71d6dbf349d1fb1ef8e3f6f69cdd9e50d6e66c0a89756201d1","sha512":"28cae3a8efdd4499eeafab4eccd294ab8fa5f861e3d1a61b7649f07a90e7669e335572110e8a81ab05705d69f08b7b408e541b7db0bcde10475c47b9830042f8","ssdeep":"","tlshash":"f7411a17e95a7e5ae20bd8bcd121f76158517c545b8efe0733f8ca516c814079df00aa","first_seen":"2025-05-07T12:19:22.496814Z","last_seen":"2026-08-08T06:09:30.237628Z","times_seen":107,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/bp.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.471Z","timestamp":1786169267471,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/bp.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 07:19:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca240a-5dd\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=heGMLW0%2FduCyDW10ykVY7otesOC3G6%2FBSi2giYqmkYBK%2F8eOHdaX10FaBdJS5EINTJTk4ssV4D3WaAdo52wBTFpdhZO6YG4hOthB6lw45rouo6LLTTtJT8Xh2gcbuajJdqoT0oQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c1ae0dc759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1501,"size_decoded":2253,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"7bee23e3da25bbaf49504a7d9cbdcc55","sha1":"d3156d33ec9eebdfad990ef034eaf490daaba734","sha256":"7214409bab733ea6ef9dbe96d8ad3d4317c984f882db5a3a387a46a7ddde320f","sha512":"50cf5af331fbc59d1e59e5ef728315515c72456d8a8edeeadd183efa6de7d2b85a37ac706983acd038414964859b8867774ecc24087e5ebfad7f80b67a5f1691","ssdeep":"","tlshash":"2d31a7bbd3210917f9350f393998c238735ad8128a85978a3b95ae4dbc786c459c0ff4","first_seen":"2026-03-31T13:47:07.070977Z","last_seen":"2026-08-08T06:09:30.18014Z","times_seen":21,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/favicon.ico","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.993Z","timestamp":1786169267993,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/x-icon\r\npriority: u=6,i=?0\r\nlast-modified: Sat, 03 Jan 2026 08:45:18 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5%2FOKcSI2XJrjee4U8bjVLwZ1Pyj1ghMAKVlAmoy1o021GxAaw%2BsvI5PsDCaRaQsjsLVVgOD%2F%2Fy6hqAPtd0ApnqO1FrcpiONJs3kt%2BpSVkelKX8KgdSPX5JmNb4PD%2Bm7QBmZx5KA%3D\"}]}\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"6958d71e-607e\"\r\ncf-ray: a27c57c4eea7c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24702,"size_decoded":6787,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, -112x-112, 8 bits/pixel","md5":"b96a76605d5e053ac73bbcbbca389164","sha1":"01fe0a787bf999569e2c5ec6c7bb751346835866","sha256":"4221206b1550bae4c438085c5c838d16d1f8197ae6dc4904b73328e8b9d8a55a","sha512":"dc93cde886e996cd5d4af0cdf69dff01f8275f7e4e650f069a04d91df334c1345e7808b7df3a07c083c8bda38979c3d65b607d06116fd1929d9c1e3de4fef147","ssdeep":"192:jgzWZ2xCplvXKXIyyRxPGddV73sKdzaiq9zHgXEHYhbjCmb:jJ2KlfqIvRxPWVL3zaiCbgX+KbjCmb","tlshash":"7db2e512bb4ad588c9550f30dd6ac1fd72a01e94ef0803677f087faf3eb46a0695b454","first_seen":"2025-11-11T22:26:53.069447Z","last_seen":"2026-08-08T06:09:30.238671Z","times_seen":17,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/dbr.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.247Z","timestamp":1786169267247,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/dbr.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:27:05 GMT\r\netag: \"68cb8a19-e72\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dgCdNkdMAFFVuRLoEzq2SC76Q47%2FDxKnRFLE%2FuPZLQDlnUc2AybDijOxMONnx4c5843Ljp7mRg4Ry%2BmJqyXPnESD%2FkE%2FdqmJkp9F%2Fi7h48zGXNv32y1KRATVV7XASzJEk8K03H0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c04d2cc759-OSL\r\ncontent-length: 3698\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3698,"size_decoded":4449,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"01c743a994d0b584ee5b74aeb99bbd65","sha1":"990095ec62e88ec4faa16d4a6119b4cbce91071f","sha256":"48e56bf6ff547f6c356f2d96533015710b91f47e7c54805151f78750be8687e7","sha512":"604d29c40132af217385a70b64a739897efdfde12d0a9bea03cbca8457f2969b9de81b4fcf2c62f62a71db4e94985fe9a902d0cc8e2e358bbfe85f854d96f288","ssdeep":"","tlshash":"9d715e5ac7f10c115c1c931713fe2f169096e865749e2f9dc2d3a7d52eeb9e65002512","first_seen":"2025-10-31T04:50:36.773613Z","last_seen":"2026-08-08T06:09:30.12352Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/act.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.257Z","timestamp":1786169267257,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/act.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:52:00 GMT\r\netag: \"68cb8ff0-ba2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w1pXBCA%2BpHgADm4L6u8o%2BuBLBLv3nV9kLB%2BZIk98Zyi%2B7qP%2BbfUGywjjusI8ZAsUW1oKSqIBOXTWH7rN%2F%2FogSoT0p4%2FXFkB1%2Fm5BSDqy6XXCxjshmD%2FobMu5xkD1b8eRp1YcR4M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c05d35c759-OSL\r\ncontent-length: 2978\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2978,"size_decoded":3737,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"28025c2684c78fed7b66dacec56af92c","sha1":"732764993d5f1065ffcf84eb9ed2de6b3a5d27dd","sha256":"792eb6c379596f985e0c89562a0d9de77a2f5836fc6b803a52c9313e32ff7b07","sha512":"273330199b8909b9804411538a71fc9d582d87f383782c8eecae74533bc21649eaf553e4fe2f496636a2a866bad3e00edc103d0ea8ba80698ab021348cdc6881","ssdeep":"","tlshash":"f6510b45978a47c1d9840cbca4940fd8ebaaff368bdb837845b04532b5e90c38458aa7","first_seen":"2025-10-31T04:50:36.97586Z","last_seen":"2026-08-08T06:09:30.125127Z","times_seen":91,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/mother.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.287Z","timestamp":1786169267287,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/mother.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:47 GMT\r\netag: \"68d0d403-3d6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=r9qyIPQpBV1zkBOB%2FaqIvdK40kc1bOgtVMoyJs%2B8zaL%2FbBikg4zB0131YhqI89d7BB6GY4ShgCEBGHIT3zPr7LjrItpxrKnrBpjJ2jykz75ThTRLhsT1nqnAxdB8PPAxm23qemE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c08d55c759-OSL\r\ncontent-length: 982\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":982,"size_decoded":1726,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"de59bafc67eae18d72ecb89f7a7e00f9","sha1":"23f716ec598721770f49b3ac3f7e2d35f1e33db8","sha256":"3abd20803b07f846753c87772a2562e0a56f492b088d5bf205c2ba8892e8da90","sha512":"dfc552a291289a9c731640b0d5a5f6c838e608738cab06f7735ada7fd5f6c943cf28409db350e0d68ee1deaa69097b256c98a34ced0805cd463d732a26f8c63e","ssdeep":"","tlshash":"001108c0cb887c10cdbd09d71d36c8f324f7a85b0af5ada81e419ea24338124c11aee8","first_seen":"2025-10-31T04:50:36.997651Z","last_seen":"2026-08-08T06:09:30.141203Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/daddy.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.293Z","timestamp":1786169267293,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/daddy.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:40 GMT\r\netag: \"68d0d3fc-b8c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=S9BF5uPiL4MAoDdy8D4%2F8x1yCr7Rg%2BA%2B8X29nNzyjfsFGfE4FBf5famoauhdB7ha23hzRtj4h%2FFuEUYJpatN90bGvdXhNHw2zyhY2%2FUa9DMe0Kj99s38H9vbb6eiAnqpeomUg%2FM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c08d5cc759-OSL\r\ncontent-length: 2956\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2956,"size_decoded":3707,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6a44979092da011a9b4ac65aa2913305","sha1":"8f63d3e8d53ee72be02746f2b35e8be202cb9142","sha256":"03fb88878ef74aa6653fa5ffb3cc8068f4df85dc0f627a3ac4073ae0ba5d748d","sha512":"e0813b12a29b3f492575e33463ef893d8006a5133a7f63dd7eb16e0479186109513038266715c22b168c703ca1961ac982f8fbd6573013784f26ac21803bfcf2","ssdeep":"","tlshash":"4f51e7a2d3656b5ccf24263429a55f15e1ad7f7ace28537f8a8600bb313c9864009e6e","first_seen":"2025-10-31T04:50:36.834853Z","last_seen":"2026-08-08T06:09:30.250894Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/neet.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.299Z","timestamp":1786169267299,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/neet.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:48 GMT\r\netag: \"68d0d404-6a0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ozi38lpxAb6RH3x%2BU5hoVHoDamqiHvCSm%2B%2BvQIQrJdFcEeZAm%2FlRNv9OpfUPsKQwAq17wsAkUUpN9ox%2BTXo7KnxKeK4liVQbysJ9%2F8B1PNvaeuEnKtt8%2FFxLj2SeeGgtzipn7dE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c09d69c759-OSL\r\ncontent-length: 1696\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1696,"size_decoded":2449,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"992c2e2c21353423ab236dfecb0ebfb5","sha1":"e444c8e23ef1e90d3c1c12af997cdb19c9e3217e","sha256":"05edce81251cf0c2642a9e1a33748fa83536d53ffa20db7924a1db62f4614d31","sha512":"668a7e8a04ff29bb833550614e47f59e09e6667ed80a800148e017bc632cf49dafbeedc122cbfefc5151ef49d10633e8d6dc9663416a3856099df7cacadf0892","ssdeep":"","tlshash":"a531fa009754b47dca2f1bb500a9d865195c92d1d6dcd5ef117f707d88b430dfa51a04","first_seen":"2025-10-31T04:50:37.013633Z","last_seen":"2026-08-08T06:09:30.242993Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/retire.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.317Z","timestamp":1786169267317,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/retire.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:51 GMT\r\netag: \"68d0d407-5c8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jelEt1wqU73ci14ac%2FtLpz4iw%2Bl%2Fhkw1Xmi3EOMUJVi1x2n%2BocTSZoVsZY4zx1uOFeo8ht4UQPmaQxFpgNcRMvc3fHcKVmDpeO0unfRjnXSFdz7d6BllOMCsYaR9Dd3tCa%2BWThM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0bd91c759-OSL\r\ncontent-length: 1480\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1480,"size_decoded":2229,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x99, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"73f8c3c34e32dc10dee57c68be9c1d6f","sha1":"46a90f175352d9e4b9402d83f20853299a510450","sha256":"518dadc225db4ffeb904226e897aeaca47204b1030cae556623ffb1620c4e9b8","sha512":"50e170ca0b7c9c25e23bb451ed5caa2b3f73f5a4dabf51af9ab932b873ddf8f38f814ee4fc5a83dc7abb87f7d7867bd38962acb83e6ff1fe53f8cf50a46271f2","ssdeep":"","tlshash":"8d31195832473a22c4c82c2e5b6999d2e23322f33231ec6d0425baf46f38911ff0c167","first_seen":"2025-10-31T04:50:36.766664Z","last_seen":"2026-08-08T06:09:30.226938Z","times_seen":91,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/$beer.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.396Z","timestamp":1786169267396,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/$beer.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:23 GMT\r\netag: \"68d0ef93-e90\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d2y8AptrcJh1ZzVrVyO%2FxkAt0ejHyu%2Fb%2F0Q22ZmI%2FQ4gT2qhtPOqxrvNpVVf7gaKUypjINk2I%2FAgM8Vz0INhmZsSm%2BoNyLCbeXhrIewoR58luUnU5rxb8SeSUOKX%2Bx%2BRt7e78Vs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c13dd6c759-OSL\r\ncontent-length: 3728\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3728,"size_decoded":4483,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"11c8f8146d1bd9ffda9b1bb28eb920d0","sha1":"4a7f9d46444097576330dcbc2d67fde30d89af60","sha256":"ff5c587ef35bc5570aadf0c6d9120d0464a25a269d6b879b2d436464d44f2d20","sha512":"0ee319af73ae6718131927264d3c142736622505a2a5f97a2943ed1ded4ed8b9e1190f0a0f1218cdcb013b9c4ed55d2d35f79d66a206ae220cccec0148f558f7","ssdeep":"","tlshash":"44716b2caf889eb1576faef770bab4d9163344c281452e454db67d022a5fa00e20958d","first_seen":"2025-10-31T04:50:36.918573Z","last_seen":"2026-08-08T06:09:30.178819Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/67.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.412Z","timestamp":1786169267412,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/67.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:07 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d263b-656\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4JVjgVEnFEtPWbvTtb%2FtfYOj5%2FKCHtKYIOKdfsBlhZwzMCFHds3vaLT42%2FQXl4Wue0GT7N6uZOhkFH2vt%2FOsH0%2Bzq6b%2BN%2FMOFsBYRKWT%2FBV3FKrnuG3PAyPAzUWADPwWQ15KE98%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c14de1c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1622,"size_decoded":2380,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x51, components 3","md5":"bc0442038c0bf9decda992903fd60b1c","sha1":"189a3657d68eab5927aa9deb906a888a9cee248b","sha256":"d4b6cb7a9ba879c1fc8689bad8b1f602d07ac500758733e514a82395c674f53e","sha512":"6d050271ea878f4303efcd1b7ec89ea376fe3bf747130e08b268368ecffbc6bffa1b76f138355cf90560f5278b65765e1a673c53cf2248c788c51d7b5f3a6293","ssdeep":"","tlshash":"8531e77be93c5c1bed2e05b193d0ec2193a31f54ca88cbebf748ca2e22157d61c00228","first_seen":"2025-12-07T05:18:33.825072Z","last_seen":"2026-08-08T06:09:30.135223Z","times_seen":83,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/alch.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.246Z","timestamp":1786169267246,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/alch.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:27:04 GMT\r\netag: \"68cb8a18-346\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tsXJ%2BLXof00PEtqSBuRFPLzAgnBUYRAi%2FNFnfzQ1jRoyFpYJE9N%2FSqIXM1XR4q8nqOYhRGzBUlgBS2aJYUFCklTV16Ks6fbyD0ukYKwmsuE16%2FhwbCg6JSRmqWe4OPiDfaP7vVs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c04d2bc759-OSL\r\ncontent-length: 838\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":838,"size_decoded":1584,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ecf1b9e78a867d44444f7419ff65618b","sha1":"f72b1b6953bef113500e2dbf86a18e79238bae81","sha256":"30923734d3d2a619539df306fb2e21125acbaf0d31909b626955d6b512f6c245","sha512":"d3ccd6fce9436364ef1b752ff95cfcf8d7eb6d41aca59adf58e70bfde5c5ec48ef63ea1c02e72639f008900b1b8296b09ee5167d2de9f4a9bcb8910a46141fbf","ssdeep":"","tlshash":"9f01d61d21dccb9a39492e241f9f178884a8ce843080d11309229a02b8d29eba242539","first_seen":"2025-10-31T04:50:37.002166Z","last_seen":"2026-08-08T06:09:30.236288Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/pippin.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.265Z","timestamp":1786169267265,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/pippin.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:50 GMT\r\netag: \"68cb9586-300\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zvH1QSwaFfaNEKtx1Pd51xtyvn4RPfoY3vlutHBIoakNdpsbkIwJXCU%2FKDrQHpnmypCrfatVxCCRXwVEF2qplmoSirjprAiTtPN0UkViJSmbcUphnR4ULJbu6V8VjIQ%2FkjIoKKY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c06d3fc759-OSL\r\ncontent-length: 768\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":768,"size_decoded":1510,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"70b64d38d410f2018c03665656dae530","sha1":"dafef40d1f5eb288d93d89cb45bdf9fe6cb00f66","sha256":"e6bccafdb5c6789f3c86c9e676712ec6047504dba4e31c83ca83a7319bddbde5","sha512":"e9e84637c6333feed6424ccaea7aa615546276d96f415bd7af230c5215976bd17b2273a580d7d3f7b08a6f64ca1259686ce4d4d8f1d1c9df4db03d6f7759336b","ssdeep":"","tlshash":"fb01ba7394c8d1e46c01f5b0d097030c0c4b016c055150177ed934ceb38fa3c712456f","first_seen":"2025-10-31T04:50:36.977248Z","last_seen":"2026-08-08T06:09:30.070191Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/tokabu.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.303Z","timestamp":1786169267303,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/tokabu.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:35 GMT\r\netag: \"68d0d3f7-5fe\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yL62tPMse6FhZk1b77PWcQ66EZd8OuC0s9DBoCIlc2E0a6hyxrFcC33HZw0TCkmdUlYObjzWtl5YiTEQ5dALlImwNulCR6Hvz6RJLKw%2FjyN7VMJOSQL2zOTjls4OXau9T5%2FDG6Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c09d6ec759-OSL\r\ncontent-length: 1534\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1534,"size_decoded":2277,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a676ef899d29975341f3d233a31b43bb","sha1":"d5da742227d24bf786b1c3d591968fb78752003b","sha256":"a1dedf0e7e6994d322734ba4b8e51800464bf1d7515ad4f282c29bae2bf1c572","sha512":"81a3f73d41754431a5d846b1f66e5c9ae710eb2974b9acd2b0510d3e78986c06809f81407885dbd82d9f3e82094a8c93f7e6f383547d82f788a56e041bfca0f3","ssdeep":"","tlshash":"cc31d8a157102759f70fa27898e10f21b7627ca6640616b6a00881660796ad9d87ef4b","first_seen":"2025-10-31T04:50:36.88379Z","last_seen":"2026-08-08T06:09:30.069097Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/jailstool.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.356Z","timestamp":1786169267356,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/jailstool.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:09 GMT\r\netag: \"68d0ef85-55a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=neJCwq2UkqNFz63%2BhdGnb%2F3GkgiZ%2F0YZv3fZERI7mkCYZfwZFVgHUxn1fLkVuTE0Jgnyld469eEJ%2Beyf4usOBLlz6aGeeeAQSju1wuxL2pjUep911WWv%2Ftk76IkEuGiwALRuMsE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0fdafc759-OSL\r\ncontent-length: 1370\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1370,"size_decoded":2119,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x80, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0e49c7fdccc3530ff2ed90ec47e80ca1","sha1":"9fc7a011fd034fe324039ec4792303468547be2f","sha256":"496cd7599cf28ebbf6a4ff93967359eba413f1d4e46b577bec2e1599a0131005","sha512":"251412502da9e44e13dc7dfaec5872eddad462af78929780f7ec45a68cd7f3f517ac97b27804df660f18802deceb77d515b90f732a5abf7f4b39f713401fd3b5","ssdeep":"","tlshash":"fe21084bca0d023680e6ed167d3c2c0f7aa9c0c5a4d555cea0b1813e54023a37b9588c","first_seen":"2025-10-31T04:50:36.987418Z","last_seen":"2026-08-08T06:09:30.072588Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/uranus.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.362Z","timestamp":1786169267362,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/uranus.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:21 GMT\r\netag: \"68d0ef91-4ce\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=u7CZt4N%2BFSFoQYS23T3K7q%2BV9JkleYsUG%2FH9S8nJmBFPsNX4V8grtKmyFiQoqvZBMrv5XiWL2PNoXx5QfoAuNvmDR%2BLrxNGcgkrk2T3CgmLDLtfDw%2BGa%2BuVdcYcjGtxUB%2BMrtOM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0fdb9c759-OSL\r\ncontent-length: 1230\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1230,"size_decoded":1983,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"220943d4bb6c760f59773c51328cc22b","sha1":"dfcd410a8c3715a663d74f037b452700170c6794","sha256":"32a0725da1c5d57080eb75bf292347972a3b2e2b877aac05fe4f74e82e8b622e","sha512":"6a1bf9925d1d47d2626b6437a8912e703fa88df14b970e63ba941954bdc3dac2508a6c132098c6321993976fd7ab7bb8a6d66d98ac775fd8f35034256b8d2f39","ssdeep":"","tlshash":"2321b634632c374cd0183378a0713321b7a53f32020a6eaad70166755f1aac8558d046","first_seen":"2025-10-31T04:50:36.690959Z","last_seen":"2026-08-08T06:09:30.221162Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/brainlet.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.437Z","timestamp":1786169267437,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/brainlet.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d263c-759\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iLcpcjCHjJtiowsFIDcEQuyVthGsxAfjo0GbV6bRQpMB2iFtT7OUwxzrVgHvNNSJeRtoeUonE2kJHmvFuDA7IWYJAircvXzFLId7mOG1s72J4MniUml2r2VDXd6HUx%2FKDzWOjQA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c17df3c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1881,"size_decoded":2603,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 84x100, components 3","md5":"e2325c89ff22da30cc18991715efb193","sha1":"a941db046a5d599e67d5ae4b9eb151aefd85a09b","sha256":"5740fc24d8980511efa886abd4e62b672d401a60267628ea41beddc7f07454fb","sha512":"db1b35ecccbc3266b15a957c2e9b161b708537f63f65b0dfdfd231d194327a5ea50118284bd2688c6c50002444db12d2f122c83e76745a8b6d5d8707072f62e3","ssdeep":"","tlshash":"334119e7f2724783c91704370dddc5308713ac2ac94e13d89a52e32eb66e2a4ee20ac0","first_seen":"2025-12-15T19:53:24.996648Z","last_seen":"2026-08-08T06:09:30.129368Z","times_seen":82,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/copperinu.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.464Z","timestamp":1786169267464,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/copperinu.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:42:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af360-812\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jsw37eUfy5Q3hQafLRDoHUIs%2F4g5Uv%2BsUOtgaCah33JNi5QIIBOe7GspBqwRzWKDZj%2FPOnTa5HWZ6uocRo6e3bpqL69f7zS5%2FD3MemZGX26XChOb%2Fu5Ppa%2BpMH4VbpIepgzUmtE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c1ae07c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2066,"size_decoded":2817,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"4aa96d367be7c1117ed78f80a96a0713","sha1":"402afe9782390dcc50fbe459b9bc963646373678","sha256":"b1b5aff8b1559ecba83ae59091f319df2eedacd69ef52bca0f754af36ac32737","sha512":"cc91d43c3f3f87dbf30077b9b93cae304a152f0618ba05e14e5141feafc6a7b5fd449f12c8adc2cda38c5b4c7033cab30ab9e7e62eaf6780257d83bc97971180","ssdeep":"","tlshash":"984118931b04ef97f98b407f6c54aa190141e849e2dd62f83340d37b7a812d94cc17cc","first_seen":"2026-01-30T00:58:38.136696Z","last_seen":"2026-08-08T06:09:30.252028Z","times_seen":43,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/pyusd.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.177Z","timestamp":1786169267177,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/pyusd.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Fri, 12 Dec 2025 09:18:31 GMT\r\netag: \"693bdde7-7ea\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5B0uI%2FKEbMaSmjbcQExwvzykarlgP5YL3ehFru9d8XJnZisVZE0Pb3eHU2pXBC50HC%2BmwtF6bKp62f%2FI7DGICkBLBWJ5HCp7NS3buYpzqhcMK%2FhVkNeU3fHpXtykTwoUwvm5bkY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57bfdcf2c759-OSL\r\ncontent-length: 2026\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2026,"size_decoded":2773,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6895c5a1cdf6c79625d9899169eed0b3","sha1":"de0669d5e770f95f49faeda3e3fa0bb1f911c833","sha256":"696cff2679b7b82a5d8e7b2b08720fd66411c2a8bd08767021388f5ac1cc3db7","sha512":"8a1ebee225fbdfccb1d12254c8707779332e7b5b5422924e814bed1a091b0f9d551e896942da6c23dbae4d9e4172ff2a10f5ac54169c49f730059a2a80c7bce2","ssdeep":"","tlshash":"2941e81e1b55d78bc993147ce1609b3c90fc88702986516fd31869b0dd8b5e58936dc0","first_seen":"2025-11-11T22:26:53.070177Z","last_seen":"2026-08-08T06:09:30.112257Z","times_seen":41,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/$wif.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.208Z","timestamp":1786169267208,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/$wif.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:24:27 GMT\r\netag: \"68c92ccb-36c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JWL8wfsRuKBKejAdbxM5sha%2B3Tbo7ghwQYo2Xu3NPBZ95Y9ImWKX%2BiWctTwQZwyVHNLgPuQ1pJ0rYLgDyYWPyC5mC6sKmvSHwC93kOTPRCDl%2Fu6TwR%2FiQpU6ia5IK6pv9ZRymrY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c00d0bc759-OSL\r\ncontent-length: 876\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":876,"size_decoded":1622,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1c86230f0512d3e53b5dbc1245a3ef16","sha1":"e4e61b26d81fd699398bfa0fda436218b75a4dfd","sha256":"f9efe564a567c71623be1aacd5d34bb8d25d4db665be35e2c465d23657c28759","sha512":"f146fb3d92e4bff8a64c53905f05873f880d9bb8e106035f8751e20a23d85153f832d08e5645407dd65f4a11d749cea950c3786d7d9b6e2a1bc9a719c6423d7e","ssdeep":"","tlshash":"771152a33bae4754c0d5a73b205a374148e0f89cbb17cf4b213c2869cda09b16e61144","first_seen":"2025-10-31T04:50:36.947321Z","last_seen":"2026-08-08T06:09:30.203181Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/a47.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.348Z","timestamp":1786169267348,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/a47.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:24 GMT\r\netag: \"68d0ef94-820\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=S6gBnefU9th8IbG86xZuKB9jRCjCfi6mMN6RgW4U%2FA%2BMrFKEy0OCygGN8YELha%2BH85RA%2BEncST3QuhIIqf7wfRFAGFNRoeYhBH%2BqvAr5g8ZhBqOKTu6o66OjOFQlfZuxxRA0v5I%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0eda8c759-OSL\r\ncontent-length: 2080\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2080,"size_decoded":2829,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c9a72195f9cff2c36e987354b3905674","sha1":"d2d6f450f6be9fde08e431ef1c22ea04a0fb48b3","sha256":"9e60979b600aea90cbd7585d792d61a2b8279da7af416ac9718b116d78e24340","sha512":"008c46170f1151087148fb3741b0d7d4c6f533ec737765e61288f2538d138c0f6e30e7899bc20038c80e85f7b0ec6dcbc41c1b61284542d99049613a9341ed1f","ssdeep":"","tlshash":"944118f264620e881c4cd73c3d4e2b7718a87a02d9ce579fbe8bd5cd58d45d2d1861a4","first_seen":"2025-10-31T04:50:36.794397Z","last_seen":"2026-08-08T06:09:30.205743Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/render.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.216Z","timestamp":1786169267216,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/render.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 16 Sep 2025 09:28:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c92dbd-d80\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=R3%2BcwfUMQvRIU%2FB3zgUzFpFb4o7%2Fy5bJu2rMxHFUyA0Pid8miyAzMZfDO4Jh1Q%2BlLqdntz2y3HM90ztprhdxf8JfthBxMWx34BpajWItzepSqRvhwlD6E5BLwFgArlNgy8I9lzA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c01d14c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3456,"size_decoded":4277,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit colormap, non-interlaced","md5":"01d36203a8eeaf7cfb91c33b4e9538a6","sha1":"fd6cf04600cbf2cd9948aaf6b5cf94891e321c2c","sha256":"00849d5c83021c8dafb484cd0d7f4c52af6efab16323f77ae2428f7b665ed7ea","sha512":"c20a7ffd7320facdac9587a134f28ffd9e8ecfb93c9ea7a32139c08bce203481848ca293b8cb5bbb72415d9022578f58096fed82dd6cde8d1162618f127713e3","ssdeep":"","tlshash":"52616dfbb84ec424afa0e27f7c20a59ad8782e761905b7d594317942484b2464b4a7c3","first_seen":"2025-10-31T04:50:36.684578Z","last_seen":"2026-08-08T06:09:30.177086Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/moodeng.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.236Z","timestamp":1786169267236,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/moodeng.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 17 Sep 2025 09:08:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68ca7a90-70f\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6%2F3A09fyw6clrj0Um1YFZGjSCrkjjYyPkQUd12NwzMl8cPjmYxnxYrqAxPGFteyuHbTqE6eOH1I7KkGLJ%2BJPlnxQxMMsBh9PdDXmWDsV4WFo%2BPj%2FQMyQ46wtpmz1TWtPKJhNXA8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c03d22c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1807,"size_decoded":2623,"mime_type":"image/png","magic":"PNG image data, 30 x 30, 8-bit colormap, non-interlaced","md5":"1660266f4355411ea70cd86c699cdee8","sha1":"4e79db7f905891f73d06729ae502f945abf9ba82","sha256":"d4c940270a96d09665fbc3653e8e5542225e0204dcd816b38a3c1eb42e33ad03","sha512":"f2bdea284c579d0ae8eeaad1cc98ab0c6ea3c057474f28f0df982bb63b579201c5390579567b8d6eb6b1ea180384624cbd928adb839b9fe7b6be9c7c2127706c","ssdeep":"","tlshash":"c8312d92f304ebe45f7a4870e210b385f630354ce64ad75c78c1957eac5961910cf7b1","first_seen":"2025-10-31T04:50:36.961031Z","last_seen":"2026-08-08T06:09:30.234353Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/house.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.286Z","timestamp":1786169267286,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/house.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:45 GMT\r\netag: \"68cb9581-7cc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mxWP4wLO2ZP%2B6%2FrrUArjey3VxZayyhSzwG1ZFwGjfS%2BHW1Iv5qgg0nz9hrmXYV3b%2Fh4Guez9BEc0K%2FPhczM%2FkvtYp79EGRQGiPiQKdDzupWg4wBaHjwj6%2Brv1TzJw7uK7SvCDgc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c08d54c759-OSL\r\ncontent-length: 1996\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1996,"size_decoded":2749,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"857cec553edecf654ddd1932436aee46","sha1":"70bd19cbda90e98cdd980d64789f73cc7b06478f","sha256":"dc8b0b2a4a27b795fcf24e5aa02909c525a1221b7994e982577de7bf632e6921","sha512":"6fa4fc44580a9a1256f7c0974a231bb66123046798049ea08b9c933ca7f2c6ebbe85704048dedc78c03a151fe7239670cc407b6c277ada0d26f9a97f8a0a141f","ssdeep":"","tlshash":"1241d8066ab67f7a682d613494446a71942b809c80ecf869b81ed8fbcb6945ca278842","first_seen":"2025-10-31T04:50:37.008363Z","last_seen":"2026-08-08T06:09:30.195236Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/scf.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.405Z","timestamp":1786169267405,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/scf.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:17 GMT\r\netag: \"68d0ef8d-830\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tfrFNSbDjUiSvI96jHu0e24jHRxrXWc9MmzIHiLLOjXF7bOEqj6K%2ForQiAvnI2ufpAUdX%2F38Mc1NwWiE%2Ben4EYo3xqO5zOjsqTsI5NPEUSEhKb7nk2cyEmcT6%2BMXVPjdIncJahM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c14ddcc759-OSL\r\ncontent-length: 2096\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2096,"size_decoded":2843,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"dc2046c8bfde5310994ff08fcbe1b52a","sha1":"5f84bf495f18edaa4bfb197a7db56d0491c9d2c4","sha256":"50c366dfe8152bf6dc497233e3dd85505805fb74a8dc966f137ba19d167dee45","sha512":"93a0be5c1bf4a8dd29900cd6d82c421df45c4c8fcf987613b02bfd32c7deaff255dbc35b341722fc0e0e495f766d28db146a72b5c9b78f42617e0e8e3a17354a","ssdeep":"","tlshash":"c241181a3876d4925cae7431d6e3382ca3c8ed9ad4f6e7a236b010e4029e14a70b6169","first_seen":"2025-10-31T04:50:36.907252Z","last_seen":"2026-08-08T06:09:30.128889Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/valor.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.420Z","timestamp":1786169267420,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/valor.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d2644-a33\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LpgzsGuJD4iEyHgiO1dSTSAcAFTucvZzlzvHcnJWr6JNtyS00COcwrFMSsNLwFNmrLWHHcS4AWgopKrUkrA%2B5FhcCU7zPwjNAG74naiQBV07NyQFatQn8YlTr6i4ChzhuPaoEao%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c15de6c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2611,"size_decoded":3381,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"45489a98c1bac4c45028346d626ac0ae","sha1":"e27cad3223052bbe3f77df78cb35f8695e9f6c98","sha256":"4750ac5dbd97f77f3067d455e1330461ef7c9ec0bf5324cef27d9fd232e233b3","sha512":"a460a3d0c208506215e0d0b73027c53e2e670ab52aac2e1023819e59880bfa8bd5fb2a68c546d23aa260029b45fe1c5902e7a32cf09ff3f9e424d9fbde32f706","ssdeep":"","tlshash":"dd5129d787472483f99b38768331e27b25875c6081e21ac563085c47da2e0f56e02258","first_seen":"2025-12-07T05:18:34.054679Z","last_seen":"2026-08-08T06:09:30.160483Z","times_seen":83,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/clash.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.433Z","timestamp":1786169267433,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/clash.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 01 Dec 2025 05:23:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692d263e-e7f\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Bmk5AmCXjlZW1iaO4GBOuc4C%2FLlJPyXj%2BGhJLqMB4AtvlSdLTJbr1Tnwp%2FwDGlFJAqL1aLxoLMGlPl2vSI5Kb2bcT6nhVkjtQQzbrqSbkOKT%2FMbaVBP2hlanrLWqA7jKRZl5NSY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c16deec759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3711,"size_decoded":4532,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"b1f6162a88aa16e237670d7a5b4dec73","sha1":"dcda935e1a574a4f8dc670b8da4e711b5038ae88","sha256":"6a5bc26aaa462d511fb78445d33114d5430dad5f2f4296c2ca352754bc198165","sha512":"4664891b82b0e140ffaf563f372a0a8f5ea5323581c3f0e26e048a3bc35f8ee194ddafb38a87aaf6f9c1beb867d4ec9bdc8f6b300eb6aba8fc5232776d96a6c6","ssdeep":"","tlshash":"91716c23e10d17a6a75923c2fc1427b11d24d9ab0d772c231be604172159f67a8a4aba","first_seen":"2025-12-15T19:53:25.143046Z","last_seen":"2026-08-08T06:09:30.179416Z","times_seen":82,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/zbcn.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.472Z","timestamp":1786169267472,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/zbcn.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 30 Mar 2026 07:19:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca2408-f2b\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7MOczDRhvqDPjzgqSFILxXYxSXpVyklVevUYUgiYLyhSyB0lipc%2BKSKzLxyjh%2FIPph1HY2zZrmrfMB9Zg8TG0%2BuvG1fdCEsEx5jghfdmvhlIvupazHCnHvUK8Sbv%2BcIvCdC7v70%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c1ae0fc759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3883,"size_decoded":4699,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"6617ecbbcba046d56b0335e5a78ca8b1","sha1":"0fc395a01a503de9950c18107257b880819ad483","sha256":"9c7daf2731e74132d6a801a733740ce0a45dcc4f4d39f85f11f316cd34dedb2c","sha512":"11f7a6b0ea6ba152eabebcbdf73c8e3b3caa3d1d5c0b741321e277f9ecb3a2e3339d18c17cefaa4e2a4e041314b47da5206212bd669a4f36816abb366d556c6c","ssdeep":"","tlshash":"a5816c7466288f0fc1e346b02dcd2cdad8b88c0274c182124ac79996cd2eed2e54cd1d","first_seen":"2026-03-31T13:47:07.237134Z","last_seen":"2026-08-08T06:09:30.255762Z","times_seen":21,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/wsol.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.185Z","timestamp":1786169267185,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/wsol.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:42:43 GMT\r\netag: \"68c93113-26c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I8NgpbW6Z6Dh40B0dvUAqJPJi6Lz7zBP5C0lFyC27Bt9Dgt9XbrmfuzUhkRt0tEi1LcM8SVsKqSv%2Fu6ZyQ7DBhq2c0yvEb8Klf%2BrGnxPlHwuu0%2FRus9eGeXUPQzrPsRxBGTiYZo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57bfecfcc759-OSL\r\ncontent-length: 620\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":620,"size_decoded":1364,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e8547fa5ccc4675b4f3208fd43d51590","sha1":"ba297bf4e08ffc4c3994a29c1c0a4ed4751402fa","sha256":"797bbd8533cf1c0ae74b78afa4b44f23dae4596b47f4d784ecfaa319c68f2d8b","sha512":"3fbf3bbd6331e3b00efeca1c492c5212d9960dcb8390edc7b425d0ab9563d38f285974aaa47cdf69b3a67ee4ae383c2b5b32aba873ce9c930dfc110e47585f17","ssdeep":"","tlshash":"95f0e12a5b714927d429e53c0abb1396101cd8b6d03852ab52228e565f8be11dff58c0","first_seen":"2025-05-07T12:19:22.461777Z","last_seen":"2026-08-08T06:09:30.213129Z","times_seen":93,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/aura.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.241Z","timestamp":1786169267241,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/aura.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:28 GMT\r\netag: \"68ca7a8c-42a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7Q6%2FLEhtG0rnJo%2FjKzBWV1lj1t9BADdPdOYiuKpz%2BTR2KTBWQx3la11zVauy0WiHoFEPHXBSTM3y4XH9zL6V%2B7z0Gwt2gOXeICFTDmUOdgP3VLpTTGlPykYuoMenJbNO7okGLaU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c03d26c759-OSL\r\ncontent-length: 1066\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1066,"size_decoded":1813,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f0e5fde1bb4f55984486ae24c234e604","sha1":"89f3a40e5aecb9ab384527f8a197bbc4fd3a05be","sha256":"313edb581e7fa3934d193a580b33095bece1e8c6cab9a62f880a0523e29360ce","sha512":"d3c069481c3e17f6acb882ef857a27474e116d2d7b4cbb14373818b1b5b602b43c69f84ae159da62cd3b7c983340d9dff385dff8cce492c0bfc54a19c3c836a5","ssdeep":"","tlshash":"6711a8d2d670c8d5e42279345d77a72b6939108ac166dc979105c0134dc7c05ffbccb8","first_seen":"2025-10-31T04:50:36.758072Z","last_seen":"2026-08-08T06:09:30.122462Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/ai16z.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.284Z","timestamp":1786169267284,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/ai16z.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:42 GMT\r\netag: \"68cb957e-95c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tFp5lRfqBy64I7X1dTS4t5Zyu4uVyegdZMktIHoEuOo8CVOWivXRU9HJhwucI%2BZ4FthUM1eTXQzkHz%2BNc8hG53x4jI6PV3tF%2F6ZIOGzGZuA3b%2F%2BATg0sHvikg4BZvZUPQHBXEWY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c08d52c759-OSL\r\ncontent-length: 2396\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2396,"size_decoded":3145,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ba6a2c8d83d13e733b5b1968ffeceae5","sha1":"74ebe1e0b2f8cd9dc241ed3129008069de52ee84","sha256":"1d9d4b4e419b3859a8cefcca7555b59ad358aa60054ec1ec2f8cbbbef276fdda","sha512":"cd5403ac7fe718697c443edc9df4392e0f8115ca788edc81a37cdfd7fea95aefc87f665ecc25037ddd34c1bbaf2af5943736aa28594f8e89ae9cfdeaff0fee91","ssdeep":"","tlshash":"e3416f435015397128c0f7d0b74d06ce434d27adbf85c1b0b62c12cfe849524cd3a90e","first_seen":"2025-10-31T04:50:36.985768Z","last_seen":"2026-08-08T06:09:30.188544Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/spyx.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.292Z","timestamp":1786169267292,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/spyx.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:35 GMT\r\netag: \"68d0d3f7-250\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Hw6eQ65VEP18YgVNHdfeR0FTJki93w33Uu3lsMwd78cIJpJ%2F0yZx0uCA6SNLZNMWljXv0n9MOMXYZEB1OA6a1%2FIfpeFPNO0zUOyD4XGPUEVEKD%2B3ixzxqlWLblEeyVTdTHJ8U4I%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c08d59c759-OSL\r\ncontent-length: 592\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":592,"size_decoded":1336,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"33776e6d825a0d18160bc2b00761ecda","sha1":"b2bb857683b1a4271359681d303de64b2c62450d","sha256":"67d266c1cddd93ab9dd9f2aa8fed857a4fba1b3cbc2ae18229186e619f0ff279","sha512":"a753a51c529462fe3bb1f6015930dff3069c09d973a83b33ac3d6ddded938424094fc015e381a917015cd0647ceabc6583e2da68332afeb0a1baa3ef0f1f721a","ssdeep":"","tlshash":"33f047e4a3ead475d6134d90d37db591064661459812c34cc4f7a5484ef382ccc8388e","first_seen":"2025-10-31T04:50:36.855096Z","last_seen":"2026-08-08T06:09:30.253799Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/audio.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.342Z","timestamp":1786169267342,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/audio.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:38 GMT\r\netag: \"68d0d3fa-44c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5p8xX7qRJiQa6164O5PtpcMEVUP2aaYgGcCWMefJpKEROlYUm%2Fd%2FE6hcTgBLXp3d1hA6YvyKt%2B1xle2hcM%2FPV88uEh8Q8Iv1QB%2B%2BsIeCqN9rpax91qpzgyofodBdJdmPS6Sec0Y%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0dda2c759-OSL\r\ncontent-length: 1100\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1100,"size_decoded":1851,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"1c6e9ec5c19856d46ef6ae6eb44f9e07","sha1":"26757d9943247efa3d2c28ed4ff8cd39b26385b8","sha256":"c65af8cab2005808822aba9cbdc20912ec9c4d84e5778c8be11227789507fb6a","sha512":"8285a54f40e24c0228f64e7b2af653b07c7f7cdede6f9fe5866270659a895060baf9b5902a7d90bf2a446fb709b48bc0c0d2e16550d33f59ecee7e2835429e0a","ssdeep":"","tlshash":"7f1196f0e28936b06d15561d405462aa0360716698e2e33a5b40453b8ddc0a0f59b9ea","first_seen":"2025-10-31T04:50:36.946467Z","last_seen":"2026-08-08T06:09:30.107368Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/sonic.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.351Z","timestamp":1786169267351,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/sonic.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:18 GMT\r\netag: \"68d0ef8e-842\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LSAEc%2BSRkM74%2FStjgYWXETssNdavhWgmkEgl05NSAhvrbg3M55OKoaqj9RRwHxr9IqncPN53yrqhH2mSo0NuqWlwklV9Qc3xGhkGtuCtGhPK%2FYa1uBSFQNRCbjis36qAZ2H4SgU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0edabc759-OSL\r\ncontent-length: 2114\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2114,"size_decoded":2859,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8778db3ea25cec1fdf2f23c11b29fd9a","sha1":"5845698778eea8f3b4acf5d8efba1a2800a20df9","sha256":"53ec66ba5a2ee4af15cacf18e42ca94b81401830084fb4819d4044f146d2e94f","sha512":"0ccd9cd3b79dc7508733cc370b39b35e051a613034ba85b8a99b4cf5c09951f1408a9a68e6009ae3cddbd576f8e6cecea5fc7d46a0c0d7f6bbf5de864f0d7658","ssdeep":"","tlshash":"ae411a06621d39d3866cabad77d48d4988df8988f07ccd6fd08c7e11c0bb2291b0536c","first_seen":"2025-10-31T04:50:36.770332Z","last_seen":"2026-08-08T06:09:30.126771Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/avo.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.353Z","timestamp":1786169267353,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/avo.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:24 GMT\r\netag: \"68d0ef94-4e4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q4V6%2BqHvA628pWeskDV6U5zRHQbdoDcPXsTzmsYcnMTGD6ZW9AalZFvMo45sDO27D4UVzklaKtnRTZl%2F11wh8lRdShh489YsoTI5aeLoNZFokruPS0o12ESLUTGeyDnYpR%2BgeBE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0edadc759-OSL\r\ncontent-length: 1252\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1252,"size_decoded":1997,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d78936f6327b4a4acdf25d593d591a3d","sha1":"17bf8175d593bbd8591846ee417a375891a29d28","sha256":"49a455a7cf719299498f1ef0106201806b20739992d3adbdfa9e93a76e202690","sha512":"dd259046b119867809e89f2aa46629194a2e4b6e1693d4364bfddc5254a5a6f5ef24e4d79d14b889fd111b7b48c9d211b0045dccd4cea4237bf80185c7aac6f5","ssdeep":"","tlshash":"5f211772c07720d846c452afaeed0ae25c3a4a643fcc804c195908b4a146c7fee8630e","first_seen":"2025-10-31T04:50:36.771814Z","last_seen":"2026-08-08T06:09:30.189954Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/would.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.376Z","timestamp":1786169267376,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/would.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:23 GMT\r\netag: \"68d0ef93-bba\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fYPNUfQXRjvgFmyOokisrEd0sjisB8uFVH%2Bnj9%2BAR4OlcQCQEEF2ic9RE6%2F%2BmVbQMOmrr8Zv%2FYlnKTckSNoLNfuF1nQKJR%2FSvNG9AX7fsqaimfekoYmX5mYdzhXcyKnR2n%2BHJEw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c11dc5c759-OSL\r\ncontent-length: 3002\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3002,"size_decoded":3755,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ba1a4becf98f579c821fa53538f382ac","sha1":"f64b33755bcc063fceb095ce0f2b63ac4275e172","sha256":"962a6abf3677dc80a5417237318ebcf9efb0275329b826c36a054f791b2b8e65","sha512":"00f2a8e21e69f4166943f8c6a9172f88840462029119307a4644e384694de04ee80c20a5572c38a2ce3e95e165369e813ae0f45a40ab07600305a7c904f98af2","ssdeep":"","tlshash":"2c514d5fdd1555a54f53f871fc86362b8623d350e77ae710948481020c3ed7e8d51327","first_seen":"2025-10-31T04:50:36.692637Z","last_seen":"2026-08-08T06:09:30.11962Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/vsol.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.196Z","timestamp":1786169267196,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/vsol.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:39:41 GMT\r\netag: \"68c9305d-73c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JYqp%2BcgrpU%2BwdviqZB3K597udk0JJyJO%2BvjWZYfrQSp5fRinLB7lrgLLhLE9htM2LiQRctrFDaPAkKtPBgEPXgdjlFJPoihvSRsvBJV174Og5gMecpVNSCA%2FP3on4K2y7Hq0OX0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57bffd02c759-OSL\r\ncontent-length: 1852\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1852,"size_decoded":2599,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a3ad437c805d577e4a4e6022ad1cd938","sha1":"f39379004dcc3f28a1d7db9ac514d90e9dfe0083","sha256":"50fdb03c44ec1e0a288531bbcfaba8e6b8387b57bd006e2b5471356afe13ed38","sha512":"d569e2a9435e389b1d14761e3be0d490da6b543ae5f378dedef329630868f92d53409ef6ebdc7214f48238ece2e2a551ee52a302c7558f0b4ab2d8fd8451deac","ssdeep":"","tlshash":"8b31d7aa36914c7ae6ae76712539b7a2bf8da18260611855af4c2848cea3ec43e50341","first_seen":"2025-10-31T04:50:36.708945Z","last_seen":"2026-08-08T06:09:30.17649Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/fwog.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.245Z","timestamp":1786169267245,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/fwog.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:27:05 GMT\r\netag: \"68cb8a19-786\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p4OPOHVQ4Uku4GiftS%2Fk1JZwKpmDuDHYcu25HifO8Q7JxWRpw7gwwv5TIStsWLRcpXMjXezEnEot0dFp%2Fv4Uh2YsTqzUgH7gJxGXWxv0dPg2WNlBaZE%2BmHuWudki5N6WUJVBzI0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c04d2ac759-OSL\r\ncontent-length: 1926\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1926,"size_decoded":2671,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9c3378d746b0b35beac848b6111c7b57","sha1":"acc09866f44dd0f2395ed98fe390d45984579d33","sha256":"d86a6fcf1e14e183291f01c8401cb72e3950e255cf966c2e088ba29ab1f9499c","sha512":"9ff641ecf69141961ec68e72d57a341b276bbfbe474631f4c119ae5a6bc52aa46d7d390a41db37c815fd7f6dbaacbf11b6140b9cb43cc64670eb1ff72f084c5e","ssdeep":"","tlshash":"9741ea9875ef5b8b8753bdd79692d38654a3486b43026622a740f7442206cb0e0ffcb7","first_seen":"2025-10-31T04:50:37.011068Z","last_seen":"2026-08-08T06:09:30.07449Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/ban.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.254Z","timestamp":1786169267254,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/ban.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:42 GMT\r\netag: \"68cb8eee-1e4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=t1QOhw7c2FvNGizMpYgcb3Sv%2BhqNcno5VVS6w5mdjOohbqWgVCTCV8NVlHI8b3PnqwlW186GACFwgRojwIRrAPmdhuC8Jg7HF3ocOY0ZROOypWHD8X%2F6p0EIfaNbokI7K%2BZKh0c%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c05d33c759-OSL\r\ncontent-length: 484\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":484,"size_decoded":1228,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x73, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9ad6dda76073006314ff8ee25256fe03","sha1":"2b9f7eefbe105fe890913bbbfa9fade4fedaba3a","sha256":"1b776c681901a2e2d18c8d79c0705701d489ff04ab6312c653a1b49ac95e728f","sha512":"cf283c98e0a3a5736556db72b1d891bd131a70a57b4c5bf4933d8e0bd672b231aadce44a3691bf6d7d321096378d2cd8b57bace37ba77f1b7ec2785012f0d385","ssdeep":"","tlshash":"c8f054ea922003c6254f65737560132431e5247ca367be3ae3470c144c20bb787df129","first_seen":"2025-10-31T04:50:36.882114Z","last_seen":"2026-08-08T06:09:30.210598Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/zerebro.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.268Z","timestamp":1786169267268,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/zerebro.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:41 GMT\r\netag: \"68cb957d-8de\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EobQHhI%2BYHPANcJYl1gdZMOcJHb%2BoW7SPYTMlSlprKsWsrS7bPIGU%2FGpmVoOck03ZFIgU5DFkZSeO%2Bd7FyktQ61J8%2Bi6GU7VBAxs1mTlUJ0NfJCbMaBvIj72S0%2FKlVo1FIcq1lc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c06d42c759-OSL\r\ncontent-length: 2270\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2270,"size_decoded":3021,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x87, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"561b885c5306e7fe32d073cf86952277","sha1":"24fb87e4e5b82e845ac0cb4f43fad09683e1c742","sha256":"9fda3d3d879bb63173e5b8bfd5c8ca9f29d8d108fdfe9185b0897b41854052f9","sha512":"fbb06d0e5b99de0ad7c45d19e0309afe900887aa68f1c684ebb2b9007533c9b37ad674fd0eb1305c95b473586226c6ba4cc61504ce0841015ff4508ec8dbb87b","ssdeep":"","tlshash":"474129cc54b623e348a0294040ce7bf3a4dd8024f7a300a52bde23fec3b4409780b9aa","first_seen":"2025-10-31T04:50:36.812343Z","last_seen":"2026-08-08T06:09:30.194674Z","times_seen":91,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/retardio.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.302Z","timestamp":1786169267302,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/retardio.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:51 GMT\r\netag: \"68d0d407-422\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7B0lFfVSrRv3IBgX2MD%2BjqvucdKUQ%2FubRUuOaWFTgHtq3sAe0VyKBAvlPj0Vmk%2B%2Fua%2FqAvLsr9ywa4UYjdgjcRFf3JrX7gFGb5HZ6m6bpIyo9O83hR12Yq9PsjdYv71C5y%2FoauA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c09d6dc759-OSL\r\ncontent-length: 1058\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1058,"size_decoded":1809,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c4997b4d706f8983350025f9d6d6d74d","sha1":"535fa23d66880b33d98a01559db7def28cfbaf79","sha256":"0d5d34d44f8a12b42bb486e4ab8170a457ff66ad8cd9cf715f7ca9793ee2fb0c","sha512":"4598b27de3550b30c83e098fe2a2cf8531620b6cc60ff7d1855ceda0bb977640a5e432d2ad89a3d578df4446583f1263a08927cb4031a81685cceda70a141c42","ssdeep":"","tlshash":"d511b565f9005204c59122ca02e443cbe29efab5e20163e79bee4da43655f9b957a0f3","first_seen":"2025-10-31T04:50:36.778413Z","last_seen":"2026-08-08T06:09:30.147368Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/billy.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.313Z","timestamp":1786169267313,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/billy.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:39 GMT\r\netag: \"68d0d3fb-53e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IIsqEL%2BpT6q0%2BU69GSxE0iC2UQCOmzCTv1A4a1byZ96SnByiHeX0BRDXC5HkGfxUbCd3OBmCo%2FctsS9FAnbQH1HzA8C6hQkhmlkhuUvIjuZONHflDcPg1ycNeFzpHN1dL88YnXI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0ad8dc759-OSL\r\ncontent-length: 1342\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1342,"size_decoded":2087,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x74, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5bf1a0e57ed95d4599e3566f6aaeda84","sha1":"6ecf63dffd7fc57197b6dd5d6d821e8ecfd388c2","sha256":"f649e00d08dfcd4be682405bd0ddb28b822d75351aac3d66c3d4ad62f48e56a7","sha512":"1f9cd40c71724928128c9269e3f3823c6bf9fc26e74420867ed18004e9ce7169c938db24fa37d116fb8a30ac620f1f481451352c37c37c5c2a946204bbf886f9","ssdeep":"","tlshash":"31212bc3e91d873fc76e9ced00e43471a5d246e892a8435848ed8ec8631c0a6e1a1bc7","first_seen":"2025-10-31T04:50:36.808579Z","last_seen":"2026-08-08T06:09:30.071473Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/purpe.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.390Z","timestamp":1786169267390,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/purpe.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:15 GMT\r\netag: \"68d0ef8b-a72\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9e6qZM4kA91OvBXKrTH%2FhYeS%2FB6zCzqw3M1kNp4hJJnc9Qklm0%2FIGQHscd6xT7ynEQTmgQYAEKkYx75gTtkQGPzTRTw6SPp3Jdg1Ot9PsgbXlnKzeYZsPruO%2FInvKaHnAH%2BYQAU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c12dcec759-OSL\r\ncontent-length: 2674\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2674,"size_decoded":3423,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e9fe753e81e4fa8eee49869225c24bc4","sha1":"ea25ec8be3d1a0d0eb7d99bac3e3844f635f30c0","sha256":"92d1cc719cc5813c722fc2878d10029cb7481f9abe20f9245f11b8d1d14aa517","sha512":"709d08020e20d9a7467cfbae80f9e3ae18cd574db1e099f2b0fe0b01b27d7a539a26a2d7268b5e7ce9d94f93fc01f1273ff7f2d6b92e126d1ce765898e5b32a7","ssdeep":"","tlshash":"9f512c5927754bcae2e1333d65819f01fb4bfe3ae0c83f9d84042c776648580772e292","first_seen":"2025-10-31T04:50:36.840474Z","last_seen":"2026-08-08T06:09:30.246204Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/sns.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.392Z","timestamp":1786169267392,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/sns.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:18 GMT\r\netag: \"68d0ef8e-682\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6HRTl7Ja82Cm1bST870WxZB7EE%2B%2BVtQcrnYc37suQ%2Fhglaek55i0ciQb%2FWhKMlVYplGZpPOGiUMB%2FcwypvGsF9YxZuFHuWjv1pjf97DoaJriFNUSfRv5hJ3nIM9ViREQ7VwXG7I%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c12dd0c759-OSL\r\ncontent-length: 1666\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1666,"size_decoded":2415,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8714974fbe6540ee78b05fac3416059c","sha1":"ea762c4d0cdccaf028248c27bf610d5225b819d2","sha256":"3751cd41448f0ab6622ebb6e58bd0764e66ac38621407723d1a93a0294847ecd","sha512":"4aeed8af555f6053ebbf352821b5988bd2c1f2dfa8d1ec5c17ad3819e0f673cfa13e60798148cd377879a012176d30e5f60bec6baf3e80e9d573a2190a3a54c5","ssdeep":"","tlshash":"7a315cac2c8efc4afafe50c889317d8a16ae4c7d68420133a1877201caacce55d6042a","first_seen":"2025-10-31T04:50:36.747307Z","last_seen":"2026-08-08T06:09:30.184794Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/cbbtc.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.202Z","timestamp":1786169267202,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/cbbtc.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 16 Sep 2025 09:34:19 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c92f1b-223c\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TLIJaiZeYtkrfokK0UWzupR25fuRdvMvfQ65ZsEpr3jB%2BdpolOf2pZVEbYR9VD0wevSPCk04sBEhF0WH8jUjLtJ0%2BHNmEpX8DqCfdiVbB7out6U8SjP3XlZxyYruRGQ7KuPLIwU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57bffd07c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8764,"size_decoded":9528,"mime_type":"image/png","magic":"PNG image data, 640 x 640, 8-bit colormap, non-interlaced","md5":"4b8fcf1d41dc6b9b27578324de15a8bd","sha1":"0716848f6cb16a5dca789d11d25350802741b2ad","sha256":"968d5730a47219a3c17037839e0ddf699f3ffe4feea28a1d15473b22d7afe90c","sha512":"97b1197a445f40838a00d5469a3d29f05fe0f9276bb2eac5a4253b9fae9c158b99e5fde9653c910c2d9684bd3315df68191cddf86f294ae6b4adffc009a811ad","ssdeep":"192:RRODUmTWtgspS7nC9fFqqxlux6PnAlo9Ymgx39GI2ZJQottUXeiUn+:oT4aULluIAm5gaI2Z7bdp+","tlshash":"cc02b0432056ed3442fca44ad80c7ae7015a6eea7994352888065377bb36d8fcacd53a","first_seen":"2025-10-31T04:50:36.655445Z","last_seen":"2026-08-08T06:09:30.192627Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/xbtc.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.204Z","timestamp":1786169267204,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/xbtc.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:33:37 GMT\r\netag: \"68c92ef1-5c8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xGd64WkPu1ccI2iviaqpur2HbOri2lAZ80SB95V5Pxz1%2Fglm%2FfKsxS%2FT%2Bq%2F4FXaKxPpP7rtW7%2FH%2BiawzmU7iEEjKw8zPVmzfSd9e9BZqW%2Fvty77LRjQ5NnrQzIS2jQ8DfR%2BhNog%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c00d08c759-OSL\r\ncontent-length: 1480\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1480,"size_decoded":2237,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"360e43c81aed3690a061c333deefcd15","sha1":"aaf71170fd465c0a6c9b841f1c77c5fa3f61f876","sha256":"dc3d13068c19077ec26b81ac51abb61b8cc3eeb747e46782833e082b3fe62c6e","sha512":"a01e640094f8ae1ecc39a41d63efbd5d6ef11e60505266b0cab56bd2d806cb969969ec639c2811732a42b05fb7f4ee5ab44d166888c5f4af3d4a9cdebd28445c","ssdeep":"","tlshash":"4631e64b2315fe6ad1622dbfbf2277e4e01ac51a1509d2a74ba8c0819f84984cc177e2","first_seen":"2025-10-31T04:50:36.749722Z","last_seen":"2026-08-08T06:09:30.113514Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/portals.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.282Z","timestamp":1786169267282,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/portals.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:50 GMT\r\netag: \"68cb9586-8e2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f3sL6ujgUxGpeZ5Wn2m9y0zs5f0JQ3ybLdROvKjOg1NFK%2FiAklZlCg45owHy%2BI9e9E6LtIWDGHNjIrpWHQ71gU1bK4UkhJccxdtQVNOFJ%2FqV41eoIHu2TE7axXYAWYfCOGiLJf8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c07d50c759-OSL\r\ncontent-length: 2274\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2274,"size_decoded":3019,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"65a0bcb7ae89dc51724d6ec79941f70b","sha1":"968beafd546d05faa063a9c3a360d818e9a8e97f","sha256":"86337e6a682e4650d92f66d688e2635237bc185632e2ecc5499d9e60348804ed","sha512":"d3417daee8aefda0464a2ed747b898502d3890f2bc6a67ed3da552ab9008da1d7baab57b6ad2e7078a88a793aede30f25a059ee3a0b70e5cc82b30b9898eb967","ssdeep":"","tlshash":"1e412b1858d2efe8f56c3d606f22f42041470c2eeb678e538d5359863ece4513f146da","first_seen":"2025-10-31T04:50:36.762555Z","last_seen":"2026-08-08T06:09:30.214823Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/whitewhale.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.454Z","timestamp":1786169267454,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/whitewhale.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:43:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af364-6e4\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sUZr7EEornTd1f2DXHYyA0K2lEvdL2vnqG9lCib%2B%2F0GnE%2F1P1xuXzXq3fInyh9zekHcPgY%2Blq5fqmfef2z6zW%2FJL3q9ZbzLLMIF8cK5wVV4yS4NLujBbs4eq%2F8dNi7FvhpzcIHU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c19e01c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1764,"size_decoded":2534,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"4602b1e42f6faeba8554fbd418df7e41","sha1":"5c61ae9f0a71f398f0993a69eae33972dcb5ac37","sha256":"a01a092844239b4cbbd5463074a30ab1c407f063761a5a0bbef4085d5294e9ae","sha512":"4989d9f914c1e2cc5b2c23a3e697513fce3d385ff4850dd8af800e022477bad2a04f384e9319760fe96c1f7076ce69d05107c69452562f43d27ccda3d6ffe304","ssdeep":"","tlshash":"9331d85321325412ed8682730811c3357371a900818fafce5908fab2ea66be13da7e89","first_seen":"2026-01-30T00:58:38.077517Z","last_seen":"2026-08-08T06:09:30.257404Z","times_seen":43,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/9bit.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.481Z","timestamp":1786169267481,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/9bit.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 30 Mar 2026 07:19:37 GMT\r\netag: \"69ca2409-1bc\"\r\nexpires: Mon, 07 Sep 2026 06:07:27 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ir1KQcLvTT%2FweTdr5CdbGofoXcHlIKBEhEUoENey7HuyP%2FNEA1AZEg8MA6n8Wr1wMnwJ3rQx2rLajbuyfMyT%2FaAH3I8ZdNjhFnqccvZW2Rarcee%2F8QQgMolpE%2Fj4X%2BFpJywA4zQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c1be1bc759-OSL\r\ncontent-length: 444\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":444,"size_decoded":1235,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"b81e00ed3ac34bd200395761fa96c579","sha1":"2875cef9cfe7c6575d3a846f7591fe7f6d3cf197","sha256":"4af8729c917bffc2cb8a75906f7fbdcc50599c1be10d576f7c15f8dbb26652ca","sha512":"8f5a2ce3aa4f6b2f8648669631fdef04666f845eae421d288c32b1db46be70eb2b2b68cc4d18a5941b49fbd0320d970d48a7f61ac4509b4e302fdd681715a90c","ssdeep":"","tlshash":"46f0a3a55a130586dba51175941504acd1370640a565303f03c75936066f400cea47f5","first_seen":"2026-03-31T13:47:07.157328Z","last_seen":"2026-08-08T06:09:30.196753Z","times_seen":21,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/secureproxy?e=ping_proxy","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.826Z","timestamp":1786169267826,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /secureproxy?e=ping_proxy HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: text/html\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iS0DaPaKLOQ6rP74DPKsPnOlR3sszIt3iSil1pHRpDHl2M%2F1ctw%2ByfOSNs4p7hOAV4%2FjVmWK48eGSajpXy6RsFSdxESedoUFdvjJEzDmr24J4yJ56YoxxlCutweARIQ1YWPqWtc%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\npriority: u=4,i=?0\r\ncf-ray: a27c57c3ee87c759-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":146,"size_decoded":683,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-08-15T10:33:39.364641Z","times_seen":550869,"resource_available":true,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"solana.publicnode.com/","fqdn":"solana.publicnode.com","domain":"publicnode.com","tld":"com"},"ip":{"addr":"104.20.24.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:49.069Z","timestamp":1786169269069,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"publicnode.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 07 Aug 2026 02:01:04 GMT","end":"Thu, 05 Nov 2026 03:00:51 GMT"},"fingerprint":{"sha1":"94:5F:9F:32:64:19:A5:50:59:22:7E:16:22:E5:6B:9B:1C:65:F3:ED","sha256":"7D:67:31:E8:80:74:FB:3E:3C:A4:1B:9F:F0:BE:71:56:CE:95:31:97:BD:28:75:B6:47:AA:02:45:08:74:76:65"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: solana.publicnode.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://sigma.metaeora.xyz/\r\nOrigin: https://sigma.metaeora.xyz\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 204 \r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-methods: GET,HEAD,OPTIONS,POST\r\naccess-control-allow-origin: *\r\naccess-control-max-age: 172800\r\nallow: OPTIONS, POST\r\nvary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers\r\ndate: Sat, 08 Aug 2026 06:07:49 GMT\r\nx-envoy-upstream-service-time: 0\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\nx-content-type-options: nosniff\r\ncf-ray: a27c57cbc95956a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":641,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-15T10:46:18.4937Z","times_seen":17901663,"resource_available":true,"data":null}},"time_used":172,"timings":{"blocked":0,"dns":3,"connect":11,"send":0,"wait":158,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/jellyjelly.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.250Z","timestamp":1786169267250,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/jellyjelly.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:40 GMT\r\netag: \"68cb8eec-1246\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pAwH1A2S8vn9W8EIngQct9vN%2BHjeM3AnL75KV9sW%2FUsmx%2FiLGRVrrFDrYDHJp3H0vN3yKI1QxOOMYr2ZYekSl7a7Gpn8gjw44TlfPTVE%2F8SjGLtOcfUAW%2BdzfKvuzmA4FvExbTQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c04d2fc759-OSL\r\ncontent-length: 4678\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4678,"size_decoded":5428,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x209, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"69b7d09cb0b95b83fe294fbb9cf6cef8","sha1":"fb704e8ae24fdd2de9cc59be56a92cc54dd5baf8","sha256":"f15ffa38698db4a33fd7d40c27f799a01288529e4f2aa9db1adb1120bc3e6f61","sha512":"c8ec01dfb8d3e16ec5a61849255c33e0301006706825b9114faf2695a489304d1fa5bbb72de8ccc31a9826ad2f7e3e2eaa08a045b30debd740115d3496bc3746","ssdeep":"96:GfxtGpLGJ8tWGWjYDukWPsWBs/ajNfIj1vy6vDFUPi7VQkDz1I:G5t0iJCK9R5fIBvRbFUqxzDz1I","tlshash":"cfa18e192263026ff13f9636d2dd678e8b06ee458034f20d98b1b36b55168761682bcf","first_seen":"2025-10-31T04:50:36.664449Z","last_seen":"2026-08-08T06:09:30.229507Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/gmt.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.211Z","timestamp":1786169267211,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/gmt.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:29:52 GMT\r\netag: \"68c92e10-92c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xnGCYQ0j9Pxetr4CAV0nuM78yh4ckzJfBx%2Bv4OQltp2VIwWbfRsZA%2F4MvQmlZBL0Plu0GKDyR3hjM2u0wpJW5OVIk6usrA6c6tN5qQYUuDDdVpzY%2Fd3VRgBU7PWEApQhGsXbJvs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c00d0ec759-OSL\r\ncontent-length: 2348\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2348,"size_decoded":3093,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f18bbf73d3b9508e435bb984166c9349","sha1":"019a45172c382a677d74d06488e76020e5a1b966","sha256":"28f58cd63ab9353a6a07d31f4e1b7194771e8f29b5cabcf09756deb16acdcddc","sha512":"6feece22442fdb24307713bf3a2fd1c4b664da0be3770daa667ee81d3d443c591c545ae6a96bd0112ba29258a3553e6ccd5a7a3de18a313d12a2ce24ed8fb071","ssdeep":"","tlshash":"fa411d9386f10d75e30535bed15d7f00567399c5c91784a5f8cb852b2c6f8224e9e8ec","first_seen":"2025-10-31T04:50:36.982122Z","last_seen":"2026-08-08T06:09:30.069611Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/ponke.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.251Z","timestamp":1786169267251,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/ponke.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:41 GMT\r\netag: \"68cb8eed-870\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dYhtUQo71voeJYGKOqU1TdrvCnMqk3k3FV3HyeDFOshq4v0T%2BxKC7u1%2FF9VuvQ5ik1L13Mpo69iaXONe1PUwddMv82dKHRzQeG8XY9iR%2BFZ7wecef07b4Gat%2FTVxNApH7DRvYKA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c04d30c759-OSL\r\ncontent-length: 2160\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2160,"size_decoded":2907,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b9eb074425eff713dd10de3475e8953d","sha1":"caf79ce5f8f811166d4ac27b9bd0348b8c4eae30","sha256":"6891aab3ff52ca709e41106a692fd3aeb854c70edbebf3ada508e267ea511423","sha512":"bfa46eb09f17117a515275f2a5d0f95490ab3292b31d43a0716b988e645759727f37151413c3834a137fea169342b627a0a002a7308bc4881c2f61a2b4a4f716","ssdeep":"","tlshash":"ae4119083a096a415adbc4bdbf5c1ec70b708097803ef1c9a3aa79501824d18696a2fc","first_seen":"2025-10-31T04:50:36.905568Z","last_seen":"2026-08-08T06:09:30.198517Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/griffain.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.255Z","timestamp":1786169267255,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/griffain.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:44 GMT\r\netag: \"68cb8ef0-1a6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=epFO8sd%2B24Ly8o3FPmIcJzwT69%2B6tuS2VMtHMgXoWOM19BlxoJAvM6ovl%2FkEKDsToTIMSJuE0tm7JmU2nUZN5tNJM1hJyVcx1kV9nwa3QeKay88X5FGpr%2B3YnTsPCwZ7PTvDGWE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c05d34c759-OSL\r\ncontent-length: 422\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":422,"size_decoded":1168,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"29145c705a6fc62bc642f42311aee369","sha1":"5d541626f54b8ccb493c23341637f486b6bd462d","sha256":"c06582e29bd4e36422b53e335b968e12c62740081d02430fc073cdb6d44ae5b0","sha512":"c8fbab0fd8462ed697e9de317bdaf7a39368dce3d59ab0cd5b7bae2e98abf090be5d137b4d25dd47390c50a503cceaceb772cc429429b2621b12e2402fb8d6ae","ssdeep":"","tlshash":"33e02343410053a1468667b5033c33ce03c16d03d883d359d97623990c895097982c72","first_seen":"2025-10-31T04:50:36.974284Z","last_seen":"2026-08-08T06:09:30.163469Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/mini.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.285Z","timestamp":1786169267285,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/mini.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:47 GMT\r\netag: \"68cb9583-3fa\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=02TtkPfYwi84OU38TveljepRt21M1khLyNNGdZk%2F3iQ4%2FJa2j7qVuh7bDmSsq9Z8lzK7xfcyriIjYKnScQ%2FM7zhNi4c0MMZGleiSHAUw4eUE7QE5BaBxZwapDC22B8r9tzQAuU0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c08d53c759-OSL\r\ncontent-length: 1018\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1018,"size_decoded":1763,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5423895b8927440bb98872be54916caf","sha1":"f7a1d56bf3c66154a0136dde107fc1f1c4be1f99","sha256":"92864148d1d74ad7a0fa81387c8060d7551a7c6265f12d29209cb3e826818b5c","sha512":"19b68594fa6871e8c0770daef62eb64f4d9474167c47ad38c37dabf46cc38603d696112b83bcc511f4545cc397301056cc0c8e43666a243e7120c3b569ef2a66","ssdeep":"","tlshash":"5d11d81c23a62ffcec542880aa9840c18f9181b5bf788f1571a265ea4c61aa4e10204f","first_seen":"2025-10-31T04:50:36.788218Z","last_seen":"2026-08-08T06:09:30.182405Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/opus.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.316Z","timestamp":1786169267316,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/opus.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:50 GMT\r\netag: \"68d0d406-d8a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LvcyD50wBp67TLdmGeiJxmWMyv1756rAPEGBP6OWoOqV8WyW47CPo3727Z2L6VEykCQKfcLHqV1K%2BAF74Vf4%2FgF8W%2BoZ%2BM9K%2FP%2BBXq8rFNfW3wdkuPGFgBaNOiZ2NCCJFlq%2FNGE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0bd90c759-OSL\r\ncontent-length: 3466\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3466,"size_decoded":4219,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f82b323d7ec4be1699d34f1891889958","sha1":"a8dd04c915ea3791f11e0bd6dc7ea4ea5eb056fe","sha256":"2adf9e254bf61ff1fbb604600213db3aaf1785916eee795f26fde6b146424b51","sha512":"c79c6c0aeccdbebfded28bb1b42330395a79d6b34f1656cba99dd651c7aa5de195b3f9fa4eac5fe0ffcb6bcdd45872d50081af5352ba66d54adfe9276126b201","ssdeep":"","tlshash":"e0616a480ace930502bc59d3049602b1b0ae1dad840b2b39a8196e477016be2a07affe","first_seen":"2025-10-31T04:50:36.915265Z","last_seen":"2026-08-08T06:09:30.072019Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/dood.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.384Z","timestamp":1786169267384,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/dood.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:29 GMT\r\netag: \"68d0ef99-872\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x21NFfDjE%2FWs74mIJODCDr7272DU1YxYwIVbQOC1o8ZaNGcx1dYtfC8VGf6S5jYjyRjNkLj9N6ss3PxeZjp1T7ukPDTp32jSzPbckk%2FMZw361WEFSgYDuLNGmJ2Byf%2BkvMY%2B9u0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c12dcac759-OSL\r\ncontent-length: 2162\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2162,"size_decoded":2909,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1297fe6884a818c144505682426ea476","sha1":"038f73bb67917d0d4091cb4781fda583553fa2e9","sha256":"c925cc9a1968bddec9180d8d52b3e970190a0e2095f355112bfaaa3a28509af7","sha512":"ff03d0a0c3e3c09820b59242a130d657a85bb84e515d91ba5807d9607488c787d3aa5636ec70d47910374770cf952fc7a9081c8fd276f59b5ff848dad8d5a445","ssdeep":"","tlshash":"c141eba9d89120dccc2eeed67cdca71a49f329e443018f618279560b162a9446d9d794","first_seen":"2025-10-31T04:50:37.000458Z","last_seen":"2026-08-08T06:09:30.127933Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/blosk.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.397Z","timestamp":1786169267397,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/blosk.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:25 GMT\r\netag: \"68d0ef95-5ae\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=66VdGACb8Xp0asHG7bTBIzCBq0XZDmhrm2trC31ssVtGfeEEgL8MnOTtp%2Fk9wHrDZlnqHBUt3PazJwxWqIz4sxXl7gGKGWZ9R5uXsh6F3WYPPOWD2%2FowHOmjKek4nOA6Xstwr7Y%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c13dd7c759-OSL\r\ncontent-length: 1454\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1454,"size_decoded":2197,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5d4125730404d6097c42e4f484ba9d31","sha1":"5047b74d0b625aa881255d4d6eee173c72ba0cb8","sha256":"b14c0738d43ba27e366ddae43ecb506fd3ec5f38ece97035a77e258d617efe57","sha512":"e8665e6878d72cdeea70ed9bf162074dc11f65e61e7f217bdb559a024edd06731165580edc9a9a901653c134bdaccbca47e95ef73b10c10fab7e09166d528fea","ssdeep":"","tlshash":"db31a8b24788635ded5867b451d04b80eafa3e6b66dba3a6c5400247e5a5080980d58e","first_seen":"2025-10-31T04:50:36.786203Z","last_seen":"2026-08-08T06:09:30.120366Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/pnut.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.233Z","timestamp":1786169267233,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/pnut.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:33 GMT\r\netag: \"68ca7a91-61a4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jwswypcZJ59WspYuHI4xhg7XrnYjPKHxArlofU5iAstPjoaKW9bOkiDSxN3isDIUWcK2IicelNUw%2BzGkRDNwkuDeyVCByroJ0wCNkEk5CYafMT081Z3pUUZi2zzd8kI635jhIDA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c02d1fc759-OSL\r\ncontent-length: 24996\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24996,"size_decoded":25739,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bc4e3cac0d72c46167a5ff5133e525dc","sha1":"92bec756365b4bd3abe6d428c6c65a82a35d4037","sha256":"66f38f1406524d1b639fb0327b3e23c9555c4fb5d4e51cbcf9fea227f0ee9a0a","sha512":"21accb0255a3b2555245b4b938f4c63c76b4bc1d3dd02fd63f81ff7d8e1a10681f9248b984e6674fc308522e1510c08d80ccc12e9c39cea72e6ca47ac5a5be8c","ssdeep":"384:qurOJ2Z0gt910E6la5r+zK4MltB5STNklDnF2J51bG74IUpl23t:qurOJ/aOOYK4MlteT6DnYJzbG7hVt","tlshash":"cbb2e12ba43adcd5cc16fcf53fc010ba469e67f1621acc9645aaadd7931721387c508e","first_seen":"2025-10-31T04:50:37.006547Z","last_seen":"2026-08-08T06:09:30.252563Z","times_seen":91,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/gme.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.270Z","timestamp":1786169267270,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/gme.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:44 GMT\r\netag: \"68cb9580-30a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qMhtfdD4FarjydrZelXalq8VoBXBUGuuCHClX8ulU3ckoGB21WGg4w54GyYbdN15%2BvQO%2BkJEjVV%2FaFcbZUx%2FlJOxZxWoGB6%2BlADd30eqtMehEv1U1uGQxfTus0PoHR7O3MtIjEI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c06d44c759-OSL\r\ncontent-length: 778\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":778,"size_decoded":1526,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x69, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3efa1b9edfb525879f6501008d17a520","sha1":"0adc708aa7e52d6173dfd67c4aaa442a126257b4","sha256":"4a55611f26e8ac4d912f4461adda73ff4d4d4ba15897af28e9ace19ea24804a5","sha512":"2996173ee5aa9071da737e049161596e38e0004df2d34105c35cb8331cf1120dc5ccd6878918be62d170f9c66f6d5c4160ae281290b98a670d0011e0fc53f89e","ssdeep":"","tlshash":"c60175e16e76b44ef241fc709d0e3b326eeb404eebe29115d7266d8bd8ba1413690845","first_seen":"2025-10-31T04:50:36.7752Z","last_seen":"2026-08-08T06:09:30.15727Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/$myro.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.296Z","timestamp":1786169267296,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/$myro.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:37 GMT\r\netag: \"68d0d3f9-862\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IQd3ECFBwlVyhlqsvnBKr3Ng6btKhitxcrbPhGMAvW2NwIJKd4aHlOWpLOuz0TLODIwW8tZZ9A3Qcko0QSPrCOqdiqDifLn1%2B3BzTeGhw2TDRS3tUKfmb1uhdpy12jPvB31xjo4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c09d62c759-OSL\r\ncontent-length: 2146\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2146,"size_decoded":2887,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8d5bba06a8d84af302a89362f8ac16b0","sha1":"60db160c9d042b6031cd1dff50a90091b6ea0920","sha256":"f59b4b5613ee80d204239dac6c509a2e6f16e7e16329b8dd53bc85c4867a4f9a","sha512":"fee530f5d0e983dba1e2a33835d9b00e491c1d7f36592a2c274a87a2e9bb24e5c1c322b72ab9b699ee86e64a51cb9ddf71a36ee955cece19c5b02ffff64b64ca","ssdeep":"","tlshash":"b9415cb3c847cc33dca8b603ba3c51f8b4d020ed42ad0a197d967b55913d9a0fe49a02","first_seen":"2025-10-31T04:50:36.863105Z","last_seen":"2026-08-08T06:09:30.231508Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/project89.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.300Z","timestamp":1786169267300,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/project89.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:50 GMT\r\netag: \"68d0d406-702\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FVn30UccDCFT3SBmyPP%2BNH4voVxXeMbfceeVXY50bifDuaDM4rqAJD2ulXqvR%2FAGWo8gDyVEAbL23pFLksnzfzcRBC4v13OhXE2cOppAgJR5Tc%2FNPaYWz6VDkigiHFWgcG4qTv4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c09d6ac759-OSL\r\ncontent-length: 1794\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1794,"size_decoded":2541,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x105, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0522b818215f9329b63eaaec396ce7e5","sha1":"f2d1318ae265e565d55d3f0db7a7ac8ca1aceebc","sha256":"9175dee348b01eee13378546e44a3864ea340160854ad13da7f9d6852bc122cb","sha512":"23cfe428ba44b9ec148af3e61c8d221e3986dcb152b92d299dd5683029f131c211f14d6194990717510218902269dc6bb81874d477fd45a5353548ba7888d0df","ssdeep":"","tlshash":"69310969f00b5f2fc8609695ae0f4017487d022a3b14d3cfe31e54c9ba285a4e21b78c","first_seen":"2025-10-31T04:50:36.9996Z","last_seen":"2026-08-08T06:09:30.146802Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/sigma.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.312Z","timestamp":1786169267312,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/sigma.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:32 GMT\r\netag: \"68d0d3f4-7ae\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oSGoJU31zpxgDH9NEbA3N%2B6cBbDPeWb49mmMUI%2FA6xerXfrqvwAb21%2BW%2BhuZTiadYo06VWcRUrilNOcQUxrwC7XhjvGvte%2BWIXvr2X%2FrZOJmDnalnDao1KFDTZUQPBQMEzIyb2o%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0ad8cc759-OSL\r\ncontent-length: 1966\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1966,"size_decoded":2717,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"054a24ab785f14202d4ff1243e487604","sha1":"9188037de4daf78a32a247f9768a5d40adfd7474","sha256":"d799a93de585b73a936e5770560f699ad6e69ccb6872e21b74e1164dc3b3b1b7","sha512":"3ba2e28f56a1f2e5e492d12a5302ff076f4c54ba34b08c841949b3bf8ce2a82db08e512bf52bd164cc75165b57c1a6b7cd7275507431f6848c43e1fa15fbd3f1","ssdeep":"","tlshash":"e54108227d92e8c58dbb7f530789ab3b935440c380379ee11d8f2025d6100e8ab34a96","first_seen":"2025-10-31T04:50:36.962584Z","last_seen":"2026-08-08T06:09:30.166376Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/launchcoin.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.341Z","timestamp":1786169267341,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/launchcoin.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:44 GMT\r\netag: \"68d0d400-4b2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vzL091qvH95yCWJJFccwMm0SPZYuYcxrH63bWR0MRGji8BoCn2Ujvl5Fo85ebKD3YpjZKsQPmdrlQjDwoKZ%2B7CEbIYk9%2FBIgzTOY0cTPmjuiu%2Bvjuw4ZLSEQ7vBzfBgWr%2Bb1N2s%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0dda1c759-OSL\r\ncontent-length: 1202\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1202,"size_decoded":1949,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a65d93ecc842738146008b3cedf4ebd3","sha1":"6133c853034dfebe83508115511d3ece477fb0ee","sha256":"053f212d0d205eff9c4e5a6843e1d8a0c2e3987347c8bcac7beaf3b7385490b0","sha512":"27fdee98bf13ca1c0d6c3370f3c93b98ed9774893d79099b048b50b5c21062712cef2047aef0628848fa541575a7e11ef9671a54c55a11c063b79b9c05b0e66a","ssdeep":"","tlshash":"20210dc3896910e38cde953c1f503611481f59403dd3a32e4712775c4f0cc10d96d3ea","first_seen":"2025-10-31T04:50:36.865088Z","last_seen":"2026-08-08T06:09:30.238172Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/kind.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.368Z","timestamp":1786169267368,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/kind.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:09 GMT\r\netag: \"68d0ef85-418\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wzmFl7z22qiNzXgoGYpJelbkN7b5BMNBAe1Q%2FO9e4Y%2F5ZttBAC1eXIb0RLTY6Q0Et1LUxYCbPX8f%2BxWLzO6Rglz5fCRBucqpAffRT2dwzBbLHoEn8AO7tEqF28eAJIqRbJwn4Wg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c10dbdc759-OSL\r\ncontent-length: 1048\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1048,"size_decoded":1793,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d3b422300ae6d5c395051273c2f225be","sha1":"c4056948810ef58ec772b00f1d7a5f298edd756c","sha256":"0feb0e5732642b9b0a4652b6dc3974e284afb2a4484aaffa53610b57078d79ba","sha512":"f0098444383fffa5fbb8164ec524c67ace9fec9e98f16084782058ffb4624d12f1fe4af6f2208cb746fe22dd292e26d4fe2be8ba61a0d2b3c59f03d2e52722e9","ssdeep":"","tlshash":"0611d8fb55da3f5f2b036708cc68185609ea1270a00416754f2e5cd94d7fceba7101d7","first_seen":"2025-10-31T04:50:36.781629Z","last_seen":"2026-08-08T06:09:30.134618Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/gor.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.370Z","timestamp":1786169267370,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/gor.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:03 GMT\r\netag: \"68d0ef7f-4fe\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BQA7zbL5fNk6oF98ZJ95t5Q4xoZcWDAoyhv3iQYCPni4G7x83FKAOrj8ZNF%2FJEV%2BeelngGr25oclOPNKk%2BbmfB%2FTsLMstx0EIuJBt7Xc7oeAJSdF48dOIOptW0wkVVQumoUsNHk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c10dbec759-OSL\r\ncontent-length: 1278\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1278,"size_decoded":2025,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 89x67, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"03a9a50b7dde15dd902814c1ce82a0a4","sha1":"b5bd597a7948bcd659852e59420d78d95fa33861","sha256":"e51207b4f48c1ed2df83aa390ac1fb3a45998538badb98b1dd413b40b6f89c28","sha512":"21df4510edf3ff1fd635d2e289e4157831cfc086173dfef0229d3b78f06964192ab441da0339c40480f72be48114c0e2ebe13a12a7fcd325c1dfb6f4fa185e85","ssdeep":"","tlshash":"f721ea180e07931e8b42e7abb90c7b2c50d114e907266d7fc55687187e74ba661f217b","first_seen":"2025-10-31T04:50:36.817446Z","last_seen":"2026-08-08T06:09:30.183159Z","times_seen":91,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/usdt.svg","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.181Z","timestamp":1786169267181,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/usdt.svg HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Tue, 16 Sep 2025 09:45:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68c9319d-495\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7%2BtEzHp%2BYCGMTD3kzMbmMQKjpivGdXgVOZljWHQWPAm8v8ljANmfQenQMAbpAPTxVGEsGSyA8SC4s0ubofvfjOjNlN0%2F2HSy3b3Xicz9p5t0vYf%2FlO6KamVErn96chcPhrt0%2FYU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57bfdcf6c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1173,"size_decoded":1390,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"335eb4a1649df9ef0779a3cf76667dc1","sha1":"94a48061d57696748777521618457fbb4cc29d1e","sha256":"ebe5e8004bc8a9e681f3208c5f838abd5536ed8e4eae243486a430ba70a90ab1","sha512":"1050f9d49d53f9ede345242eb6e98c2e40bc69d651c8908a217071d43bb4011b6e87f3ac628456ec26e0dde2525f756689e223a15c2ac17ab0c8a6ead3ed58aa","ssdeep":"","tlshash":"c52114cd775c884040c44ffb7f3788c83c36e4c11e464f18c0219f152c999af9d46a9a","first_seen":"2024-08-20T11:34:03.137583Z","last_seen":"2026-08-09T07:47:35.834804Z","times_seen":130,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/pengu.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.206Z","timestamp":1786169267206,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/pengu.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:30:58 GMT\r\netag: \"68c92e52-418\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kPH97P9i3NDuqX%2BsEvZ7eDKZKfl%2BMuVUbnKzyz32TGBALrXYACCKyfKVfmzsITDVD4Riu%2BfM0fJ0epVKTvLiQB5Di9c%2BFNGDfZxpBka4Le9zPzozAp4WtXN5vurxJ8idBhJVXdE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c00d0ac759-OSL\r\ncontent-length: 1048\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1048,"size_decoded":1795,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5c6f83d56b13f7f4e5e9bed0c16b0e25","sha1":"9a94c349c07aa3e04efd50a158a263b72fcd8f3d","sha256":"77ba39ca007217e322188122e3d935f47f7ffd29ee638ef27c298705755da9fd","sha512":"e234911ceec4870a510f8a810893593a021e222691bf04dc5b1751057d7138e5dcd91e63622227dfa75f30dda654a3177c44e07d108c7daeff522ea927112977","ssdeep":"","tlshash":"c311c42aa9300607e40e967cc03db7804344b15830aa628e520fcd368dca344aef6a98","first_seen":"2025-05-16T13:51:15.637676Z","last_seen":"2026-08-08T06:09:30.161064Z","times_seen":94,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/troll.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.242Z","timestamp":1786169267242,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/troll.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:26 GMT\r\netag: \"68ca7a8a-700\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6iqYLCtJW91gRzbztV2Opq5zgYJDzhqzQmSGEKoMSj3TVqgDs3rE5j3xWXm5dKBD9IyRPqmsennW%2Fdb%2FV2lB4OsWqBI7rLoXVxognCkhCE35%2FPosuOk9OBv7%2FJbplpNFb%2BcszMA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c03d28c759-OSL\r\ncontent-length: 1792\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1792,"size_decoded":2541,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"528183630197f8e82650294afed69ef2","sha1":"a7abafcd8d1da40d5f7a2a343fe137157d6fa324","sha256":"8d449425955cbd61d9cd040b45ec07808e9ca4b60a4502c89baca4836a1de543","sha512":"7515606f9b0d0b290ede4ebad082474b9189ea5080cc9c2caad2d562da4d17571c98f1eba86e7cde87476593dfcc8d54631fd1bfc8575bf6e7fbb506f295d75d","ssdeep":"","tlshash":"4231095309080689e139917ce8312b0c5822cccdf15367b9e321ba80de2b6cafb2c948","first_seen":"2025-10-31T04:50:36.983039Z","last_seen":"2026-08-08T06:09:30.235595Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/ava.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.273Z","timestamp":1786169267273,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/ava.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:43 GMT\r\netag: \"68cb957f-a5a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=symyn2TX48x4J%2FGbTyFFq1Y3CbgLzyfUGA1bosciwzY04ngpC%2FM7f1uXw8o2LZGovyGcVqG8KUtugTxnIzKyEwy%2BxiecvVJn1t3HezrIZNYVa0sVzUyoqnpeyf%2FR1QJBrKL4FG4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c06d46c759-OSL\r\ncontent-length: 2650\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2650,"size_decoded":3397,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x82, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c6eeb0e7247c9ed1df734ae909dd50e5","sha1":"87e951900ba24531b5b929ae992b257a93234380","sha256":"cdfb2ffdb5a7bd9a452021a295f620bd7f2240a64c6b7387e16a8ca87cbc60eb","sha512":"47e614b639e8da59e6d0943184da7769c5117c311c3cfe6c434aa7f2015143e9bc98ad9eb7ec4736bddc52805593c2605977dec49c63c439bdacd01a2d6dd017","ssdeep":"","tlshash":"dd510c7515baa121d7b80f0c12b0d760e6bd4e9d7a850e47856f85d13a32c2be53b60e","first_seen":"2025-10-31T04:50:36.908682Z","last_seen":"2026-08-08T06:09:30.125866Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/light.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.288Z","timestamp":1786169267288,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/light.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 22 Sep 2025 04:43:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d0d401-19a2\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Q1Ao%2FsQXlzFNLFkK0QLMHtnBjGsUGBqmEO62Sry3CTjrVp4FmfCoolkzjaamK%2BHsmtuOy5NoZHDXtPNf8LqANnCq6xlzYojzwTzJ1cRvWygPiSl9QGVWgFP6qCHUEMwHKCs%2FBjc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c08d56c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6562,"size_decoded":7382,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"b38cf5a87864a49c942e15e59727a509","sha1":"9fdb7e32806dfd7d86a18d56ecc72acae24f822d","sha256":"02a5e4a08fba32575dc694abc0fdc48f8ddc6899084fe013aa79e5b898e0fcb3","sha512":"3a7e0416585cb1116b3cab0692e8cd3efb3d5cf2bbf1ebaf7f3c70e9f82d1f8da8b2f7442eff8a3f10a3a9606e2c06743783308f728c4dce120100ffaa117bf0","ssdeep":"192:Gz+vlUUurBR4waBp0ufxBPH/UeNvtm4VNDUIp5dBzdj:GaKLBR7gfnH/U0UKAIpHBt","tlshash":"d2d1af33975341fe8d8b36906a04c239fc3d9013a5adac5e3f7609e679e3ec54554381","first_seen":"2025-10-31T04:50:36.998499Z","last_seen":"2026-08-08T06:09:30.151733Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/hosico.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.314Z","timestamp":1786169267314,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/hosico.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:43 GMT\r\netag: \"68d0d3ff-92a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1Yc%2FOGZkoT9N364YmfHS6Xwv1tTXhWbjF1FQNanVyXecc8p9zkm4zuyBqQfUL9ERSIEzrjKRpJP700pqEKQwTfz%2BCNgTT4rpFEWp6mYucYRzP8b5UxkalpLNTgWHRTLs%2Bv%2B1HfU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0ad8ec759-OSL\r\ncontent-length: 2346\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2346,"size_decoded":3093,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x113, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c89e4f57ab2972ff29ca095e74b8cd82","sha1":"67c6486255c96504799239449ae06605011273b8","sha256":"249a8c90aee15935542288ceff2c9fb17950604dc9ca88acda944838c1810a18","sha512":"0bd08b41e9cba5493452103cf10d49a13eb1505b8c44f7eb2ac5f216ae0dbb21b070d619852ac68f87777dac05ba40b87ab247bef31f6bb203f24e9b5d56bb1f","ssdeep":"","tlshash":"ae414bc14b92fd616b96f2365f073e4caa8130e2c8557a7b82fa1015f7453ad1be2e0d","first_seen":"2025-10-31T04:50:36.66801Z","last_seen":"2026-08-08T06:09:30.204587Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/rizzmas.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.357Z","timestamp":1786169267357,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/rizzmas.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:16 GMT\r\netag: \"68d0ef8c-dd6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=haTbdkdpEyznByVgm%2FjrknWsSPvcBEi%2FIBF1JdGR6CKQ7gd0ufQUCVgKivtMQNB7EFt7UM7tD4zLiyZ%2B1gh6RUq7mNRjhAt211fgneOH5XS%2BLWpy0wzT2LvnSYRKWAdit63k0lk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0fdb0c759-OSL\r\ncontent-length: 3542\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3542,"size_decoded":4289,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x100, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"e4dcfb1574c971b8e3fa658a636ac0fa","sha1":"d2ed880c9dca730df67e1fe591313b969f25dd6e","sha256":"da51cc2d42b477fbaca7d0a53b49b622b4681bd17e0b873817614eb4542b3a9d","sha512":"80f9f4d9eb2c7fab22e088b1c071b8923e9dcf90814eed690c3d89adbc01ec8026050d9d4e4b34ccf1813eab6b3da81ddc2b6a9d9d71fbd1d1d5805c9c271420","ssdeep":"","tlshash":"77717f13a0b32b4bd4d6401c2cbd67402e7e359258b0ffd4a596faaf0a24f9d4b31549","first_seen":"2025-10-31T04:50:36.945471Z","last_seen":"2026-08-08T06:09:30.217247Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/virtual.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.361Z","timestamp":1786169267361,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/virtual.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:22 GMT\r\netag: \"68d0ef92-254\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aw3Mui0aoKTYCcECluMMJQWcqiGb0ssSUMjtyMslo8f7P0zxEXBct2FcQyy6rMFUfnGwqClZ8TKbO5%2FykskNfDOjqrgGkQd5RyzcSxSmosrzcedHN92Uzsz9S8pKckfDAyilLE8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0fdb7c759-OSL\r\ncontent-length: 596\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":596,"size_decoded":1336,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d67cab96aedaabe99af2dec08d4c181f","sha1":"be2d7a204ffa7b76dd51159f9ff357b41ecddcab","sha256":"dbd1acd916b18a1408ab8327c886c39971a7d48cf90244c5cc602e3c0f8380b7","sha512":"431ac66950b068dc97fb4376a0241d93256338cca4e7be6a588445b5999e7d61aef20bef5d5581321c8f1cc1c10d1faacb7929a7d702ab4fd768f1222cfede66","ssdeep":"","tlshash":"80f0413095e2a1598802ff8d2b7615176dd304097582dee9d88239b3915895ae2f208c","first_seen":"2025-10-31T04:50:36.885658Z","last_seen":"2026-08-08T06:09:30.220505Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/bnsol.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.187Z","timestamp":1786169267187,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/bnsol.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:42:16 GMT\r\netag: \"68c930f8-8b0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AgCFtmSbi7mUSJLA3hrtBfSFLvonB6mVWwijP9%2BuSiWwQsB1%2F%2FEYQVGwsUctRyOYIDrkFHcW8qFcLm8ARJNkwABHsC1WCHNWl9wdzvu2mhhHTa%2BIRXjMDd5Xzy0%2F9gYqKKtc82Y%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57bfecfdc759-OSL\r\ncontent-length: 2224\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2224,"size_decoded":2973,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"da523586082cf5a54dc8766a27ba2da8","sha1":"067c52de65e979ac7867cdd27f4fd79d20cce718","sha256":"67e917c2ca6a19c67db370823f20d4b7af0b44a793b1676f4456146b561ed268","sha512":"a35c62812432e7037681a1df490e88d1ae52fcc7ab9d3d0a701048724f95154163860c5b69876119732c641bbddba8bd4c4ceaa1cb39a9dbcda228f6a085218e","ssdeep":"","tlshash":"01415c5e0a73be18db6bf13c5eb69369815150860c8888b7f344dc8a1eb3cc05f799b0","first_seen":"2025-10-21T09:10:44.635424Z","last_seen":"2026-08-08T06:09:30.13868Z","times_seen":95,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/bert.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.261Z","timestamp":1786169267261,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/bert.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:43 GMT\r\netag: \"68cb957f-972\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=in6KR819EEGTDohcC2zgfxHbqiAwFE8aOTvgAP0n0frGRGQQX3oTsqErhEDhNlFtmlE5zt4WnVVovjTHCeIKc6K0Nwto%2FzV71nxNC4ITHAjO0ehCzg7cNg8RnlRH2%2F%2FugMqbc%2Fo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c05d3ac759-OSL\r\ncontent-length: 2418\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2418,"size_decoded":3165,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"42f6ce659c048e7b028534ec168df007","sha1":"f2ccf55ee4405b0a54bf9f8f5679280516094d13","sha256":"128c4af9cca2a4de4937baae39768b1b24b2e1f76a984f717084c71059b2ec3c","sha512":"2b2174ab0c6c3d952255f475a7963a7e3e1ce735005af46c89ec08d847a4a764fe219bed76b2dfd020ab9750fe894cf93d9bb363bc22729bc96ed010011e82e4","ssdeep":"","tlshash":"f9412d69f3884318d90416b540773bc6f7e4bf9d9735ae14834743a107289c9f1e85bd","first_seen":"2025-10-31T04:50:37.011879Z","last_seen":"2026-08-08T06:09:30.140631Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/mplx.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.338Z","timestamp":1786169267338,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/mplx.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:47 GMT\r\netag: \"68d0d403-4a6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zlLJyAVVL2VTcw0KZrvKOkLJY5QpcwkckaKvn3hsvy1uvHml%2FGlaOwHeAyWrcg0JtPYutaWZwPNGS1gDPbsPrsKr9iYFB99DfF%2Bfb%2FHkmv87HG35n3SM9Na%2B5fqyS9kPH3PrzvU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0dd9ec759-OSL\r\ncontent-length: 1190\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1190,"size_decoded":1937,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3333e49d07e21f27998b4bd1da31125b","sha1":"74697f0fb65bf60c1d67c02997b5b5cb6003a91d","sha256":"3fdae9383252a4b204a8b7660690dae2684edba576c64ef4367d574e0b92c355","sha512":"57ad71395d9df15081cde6da7ee159f2be021fd2d4eee26bbe7bf2dfc5d24c1829b397f3d526fd66a58495f428df83288418cf2ac0b0083c9f4063c7a0ca6c21","ssdeep":"","tlshash":"0821b71f0869f335fc280416c4c1b5990b97119a54a7835112d1f9bf88cebe0933fd8d","first_seen":"2025-10-31T04:50:36.813944Z","last_seen":"2026-08-08T06:09:30.157892Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/startup.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.363Z","timestamp":1786169267363,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/startup.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:20 GMT\r\netag: \"68d0ef90-2ba\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5vZhfGjWf6zrWXDxVwbmulKUnpFNj3F9Mrj2jrKTnG3lAe5SjESv9ADyw8eleNuM3LW7IX%2Fuy%2BlD9E61b964tSrtz7wj6U7mDuRBvM9bPH4PEX7doHY9CshI4sYvWl2r2xNJWkA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0fdbac759-OSL\r\ncontent-length: 698\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":698,"size_decoded":1440,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x84, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a860993143f148970190905e2699bedb","sha1":"00fc0002c065119e7661e03462f46b2e77c33248","sha256":"21fe6bce7e9b29aac5dfca9ee06b7cf4650c12ac5a0b5d50213106d604145ff0","sha512":"f8e44df03092344f8d0ed9b3d60c8de1ec0675431345fac29bdb17e0ad12f19604b40709cd6885e0896e1541f837e9b16865ae255f5e93f10ee8f9d4e37353d5","ssdeep":"","tlshash":"fe018835651e97d7a4a4f0303517634b4108a2b74438efc40eff5893687323e9c16918","first_seen":"2025-10-31T04:50:36.838607Z","last_seen":"2026-08-08T06:09:30.207537Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/dupe.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.368Z","timestamp":1786169267368,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/dupe.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:29 GMT\r\netag: \"68d0ef99-402\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ntWq%2FLdhZcEjpGf4xpqHe3tn1bnIfDBxjRcgwZdGNDGsKnUi2BkBM7HepY0bT%2BpEw109c3LIWZmzOySoXXV%2FukKDvpSe1trMfIxpR0ELuOQawy35CI7bkC7wlh%2BNl9CDwTDJHp4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c10dbcc759-OSL\r\ncontent-length: 1026\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1026,"size_decoded":1773,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2e8675b6342cf88202289808f47f049c","sha1":"92507587eae7b3a0fffe2103eb9ced3ec96c72c9","sha256":"bf5b8dae96c220f4ae43d068570d4e6997e717221f2d0fd6183cf2170eff0b7c","sha512":"a9738c44622548ec99d63411867428825d86df16988910561a028722a6542ba1a8d928d011718d8a98e2156501f030bec30b0dc8bb9285c76033dd7eb033843a","ssdeep":"","tlshash":"9d11b51797065ce0d4d6e8f1ce6f6860941a68768843d89a068992c15f7560d80f4d07","first_seen":"2025-10-31T04:50:36.994427Z","last_seen":"2026-08-08T06:09:30.245711Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/inf.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.373Z","timestamp":1786169267373,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/inf.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:07 GMT\r\netag: \"68d0ef83-5ac\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LkrfOgjFMn7d5AG9IdrXVErWw10KohWnxXjiKA1Z8Kk%2BL%2B4Kfakzi%2B4ISrTPGmjpanDGQ8DqUEMzG8UFyThiFkT7xxiXObxqUtyKl8yOHxdcIxjbh6X4Ecd8%2FIujdK6Kz4%2Bwfmc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c10dc3c759-OSL\r\ncontent-length: 1452\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1452,"size_decoded":2201,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"af41f54c78107245839582192d605eff","sha1":"9c582629ae17ff97055687cbf04800c46b580817","sha256":"156c2a35fb76cdc56f6914119b4cb48855b94e8edbd93aab51e2bba98530e675","sha512":"69570102e2540b82d088e8506ba33f6c3e5b0c5125a3ba1cd2a914dd775af3cc780da61f2b590e9880a42a837b4827933c458f21dc3031697708e3df5968f513","ssdeep":"","tlshash":"6631e9102d75bf82e025770b35bc30489b1f29f5c69ccb2090a2e725196411a8e37eba","first_seen":"2025-10-31T04:50:36.856777Z","last_seen":"2026-08-08T06:09:30.201897Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/wen.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.380Z","timestamp":1786169267380,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/wen.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:22 GMT\r\netag: \"68d0ef92-54c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0xxau%2FLzAjN8d2t5ka0ZSAaIjh4yY5jwVxyB3uDGjKWHDFa64j6wZuG7n7k26lWqC4EUqGDXurQLJiPOYi3AdJFS817VdQX5Veq5MS7tyX6JMGUw8tiBpfyZJnndmh%2FUDPifM%2Bs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c11dc8c759-OSL\r\ncontent-length: 1356\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1356,"size_decoded":2101,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7f1b454f2d8c91c82cf692160812b188","sha1":"db16bde22afa68cfff3e3622412cc60b1817183a","sha256":"7233054b48727bb5921efa53c57dc3b69a235cd47f60d6407cde50c8370bb610","sha512":"d0b7b1161c606ad07e006308680f83a981e31188e71319425ee76cf16f3c2da00dee4a30dab6a6ec4fe9d768417cbde051d67f088b11711c2df76cf64a2ff86b","ssdeep":"","tlshash":"b221d80d45b430ecb80270f5c0f4201997e38856aa0a456b1e373c99ac24b19269fde9","first_seen":"2025-10-31T04:50:36.924161Z","last_seen":"2026-08-08T06:09:30.243522Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/fdusd.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.411Z","timestamp":1786169267411,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/fdusd.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 01 Dec 2025 05:23:11 GMT\r\netag: \"692d263f-2db\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kgSTCxP1dpoZtcEPkBJw0jUx0ufuJp1vPyGHS9G9ZFpwNrljIFtyKsr1LeUpjoxf3n2uorREdFdsv2yWnsxf%2B5efjYXPO%2FDRb6nnoP0L9fd%2Fxe9wHF45cHart0uE%2F4vVXxbNDss%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c14de0c759-OSL\r\ncontent-length: 731\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":731,"size_decoded":1518,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"4dd27f2418c7f846c74ebdde3911c05f","sha1":"1b52059363c2fefa7ae0095807316f4d0b2e8e21","sha256":"85a30cf0133828dd4419491838ef2622892dc803d03b3fca2416f969117fb3bc","sha512":"40382da8154b04fe23120f3c6bb92f433620b1b5544fd39368946d1af9ca435ae72d2bb94136d969890a58ab4b61246a0df895132e58842d4be3871ec5310bb7","ssdeep":"","tlshash":"8c014472d9b07a0cdaf58031c1b9c5389ebed5201695598b03c0f9f3ab2abc6a097720","first_seen":"2025-12-07T05:18:33.891726Z","last_seen":"2026-08-08T06:09:30.167792Z","times_seen":83,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/eth.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.198Z","timestamp":1786169267198,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/eth.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Tue, 16 Sep 2025 09:35:16 GMT\r\netag: \"68c92f54-5b4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6PhzOe76NdWXTEtRJjY2IFIUSrqP0h1pb%2BlecU9SB%2FBmo5GG%2FC0dAF%2BiQKq4vemGTccRIyQTjCou8iZIltRm9ctyclSiT3rTFhjT69GdVu0x7B7vTWO%2FQgG%2BTMSkfRTmOVMdxZs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57bffd04c759-OSL\r\ncontent-length: 1460\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1460,"size_decoded":2211,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7c33fb710fe13a417b44e4474ffe4167","sha1":"6a96bdee97e8bb16fb42d90782cd396033f48d5d","sha256":"12b13327e0850eae05d107d014f7950ac6f228019cf2873b5f384abcef40e244","sha512":"3243a8948c9768af94c8d85dc7de2d7485fab469adbeac13779bb2d92e0f0b34a758f5f0cc4d9a7d7a0a08f52ba6c4d35f65e40393fb5034658b6e69c157c542","ssdeep":"","tlshash":"d031e6139e971ec4ca8625fca9a3b3468421784642b948b94a4c4b666e87c356ed39cc","first_seen":"2025-10-31T04:50:36.880197Z","last_seen":"2026-08-08T06:09:30.075354Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/useless.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.249Z","timestamp":1786169267249,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/useless.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 04:47:41 GMT\r\netag: \"68cb8eed-590\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=doYgh2WeIrIlPVOGF2m7%2BM1KSNpNKHcbP%2Beb4nMfTP1uWEj0ybUHyR0AIRVVoWnH64Nagnt4%2Fy6p8dHpPXLKrZ8%2FdmdqgjfbaMPER2T%2BZ9Zy%2BheRziF%2FqmVXKmaJfUYos5Osqpg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c04d2ec759-OSL\r\ncontent-length: 1424\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1424,"size_decoded":2177,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"47e67b87c643c410193de120bfac81c3","sha1":"d89be78255e4a3220cb072723802d1aeffe412a1","sha256":"83a19828652576705f9b6fc8892bf2f55e24126590a98fac057e9e670d3a5581","sha512":"fe75a8d2534d2abf98334b35b1b25e93a86988110584f62c93e5fd93d63af550e150636ea4a1c81fbdff0791bdf2138203aafc4d06c49af274fee20516ccef02","ssdeep":"","tlshash":"752119163af25920731d3081e85f04ad524d46cce3cc8dfaef29505016834f21ef1f55","first_seen":"2025-10-31T04:50:36.810512Z","last_seen":"2026-08-08T06:09:30.168551Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/layer.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.277Z","timestamp":1786169267277,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/layer.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:46 GMT\r\netag: \"68cb9582-144\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=G1JyfxfcejaeS%2FmykIRYQV7pFvEkP2SQaSx0cSHo%2FelYZHj1Un0scjpr1JHTfT5vH0AwP9%2FcKV%2FFpUgDCb6bhpJR6WweM1KRBtmC%2FUG7zTqnxmYQyPvnw8CMhvjDKEJOhUv7CiE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c07d4ac759-OSL\r\ncontent-length: 324\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":324,"size_decoded":1072,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b72f5d6a4916de0b7277319dc6d212ff","sha1":"d2b82b4c30d72459043033734b2b8b127b3e3597","sha256":"ce659f3c36fa349a63e3d449bedf97ad9923e466cbe765a04b138753ceca7248","sha512":"4a5bc7a236af6f251af0fb44d6380a45647863c5947048bae82e9dd0a6fb500fb7bf05adf751702a004e9f3f91ffa020d5ed6591bf268ba335ce6b51314aa742","ssdeep":"","tlshash":"85e02d1e961819c8e1a1c238fc2c23c2acb31610b8888a3f88c92ff28838aa01340c25","first_seen":"2025-10-31T04:50:36.983914Z","last_seen":"2026-08-08T06:09:30.214252Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/au79.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.295Z","timestamp":1786169267295,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/au79.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:38 GMT\r\netag: \"68d0d3fa-ba2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 21\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ut0M24%2FlPWboxTydzwglKFTBE1SryHyi3VmIsF5f1EwO1zLztjQb5EKr4Co4wEq0Jh2y9XSJ3%2FUUooUmzorfp%2FbGXyEVs3oVPfuh1Yd9H%2B6OTBF4dzIlreqVSJMEU6U6zK77hmY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c09d61c759-OSL\r\ncontent-length: 2978\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2978,"size_decoded":3725,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"783dd165d3727ae0de97c5a41df25bdd","sha1":"cf669f30e80cb98f8e5da8e1d977f8de295be80f","sha256":"69ee60996d1358a9858ff58bd0f2b61c7a17639e3f30b85bec1b50f528da072e","sha512":"4e8dbeebf628208ae569e76613e22a9804efb222be68472366276893b4fcb961211965bd7c27b4122ae745356ef9941f5f2364fb778df3d36bef1102e52918a7","ssdeep":"","tlshash":"4e516c88b69ed8bcd1f970371001f044d217a00826ebc09daf806261a7bf1ac6a4fa73","first_seen":"2025-10-31T04:50:36.764621Z","last_seen":"2026-08-08T06:09:30.070758Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/stonks.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.346Z","timestamp":1786169267346,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/stonks.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:20 GMT\r\netag: \"68d0ef90-8d6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pg3sEBn1L%2BBV6pm%2FKEV4UlMu1t5s56LlP8LKealOx1qd9DpcuMOdEFfRGLJsdDYFejRqE%2BKWGMNps5nmhtRtyQoUTuk6H6JIJ8gcbsq0W9DQ%2BCDOtLWrozrdyCEjFsSAvhFN1Jw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0eda7c759-OSL\r\ncontent-length: 2262\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2262,"size_decoded":3009,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f4f2fbe149f6a0fdd55b753b10baa226","sha1":"f048c10a7b98a8e5057453893b9c2a6506211763","sha256":"83c5125a0caaf46766f70834429b45cc727b330dcc102c0422df2581609a44b7","sha512":"148b1427683483a89cd1048ad574dd8be2b68fc387efb92b3fabc95e79c40c04d215080ed4aa11ba17afda38b40f664e69ad53ad7f2f5516552d1f151bb59feb","ssdeep":"","tlshash":"f4414bafe1ac3bcfc6846958fc75f00378315e37424a327981cb4384255b819a918f69","first_seen":"2025-10-31T04:50:36.7923Z","last_seen":"2026-08-08T06:09:30.142954Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/memeless.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.366Z","timestamp":1786169267366,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/memeless.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:11 GMT\r\netag: \"68d0ef87-5a6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f4YJ2xV6dH2TlmhOIWn%2BzwKH50zR3%2Bkr1vpSJmvxDabXEx1XptnsJQHT6A5J9q7Cq5vihuRjxTIa0kezJfW09K25Kkn2A92%2BM%2BoUSNQuY39ourbNBHODKdsl%2BP1Z%2BGejdrDTtww%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c10dbbc759-OSL\r\ncontent-length: 1446\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1446,"size_decoded":2197,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cfd01eddbb15e359e03ad53666d92837","sha1":"0eb26e3dac7f952feaa7a43651314b5f4f2097c3","sha256":"66d7f10adff11ad2f1908d0fde2e24f7d4c1b7e69972c032f25cd27c16f588f6","sha512":"3a78b39c7778fd3a843e9ced6ef672068a5095117e4be121006ebf7609d996755f47c0e3edca5b2ab86f768888277948946af507d5eb6868b05e1e1087afb040","ssdeep":"","tlshash":"223119130f920821f8da7b7e28d4c0556a1348e6a8b0c3bf831592e0081dcb680b0388","first_seen":"2025-10-31T04:50:36.756083Z","last_seen":"2026-08-08T06:09:30.245152Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/huma.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.399Z","timestamp":1786169267399,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/huma.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:05 GMT\r\netag: \"68d0ef81-32c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cQ%2FDnpgi9lrpbPXuzYX%2F3f9nxtLptI9C11w01mJgyAn0UKMWKZSfrEqGk9BiWd048Pev7lZeZ0WNgAtHUOJyhqvhOTeOdGGSdt4iO9CaU0Zf5ke43KKu3gEImhjbfLT77afmmaA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c13dd9c759-OSL\r\ncontent-length: 812\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":812,"size_decoded":1554,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b109450e98b04cc4db6515753bf93131","sha1":"43c372177e5c2da411f110d6858a2fbecef01651","sha256":"dd4526aaf9964f4d31ab2c261590bfdc7d204f191c31db088e0cd36acb46967f","sha512":"b7514fec7558d4da9e93d11e32c519b63ffdffe9b5ddf5484c5e01c0e19c6bf343f7274bab94cd37a6639f1752c19e978bb760174993f6c26a9783f6db1cb694","ssdeep":"","tlshash":"5b018a701f35b06ac4ff5a5af582ec64075f341d4eb1a44423c15f4a45061d4d7b674c","first_seen":"2025-10-31T04:50:36.818989Z","last_seen":"2026-08-08T06:09:30.25508Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/buttcoin.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.448Z","timestamp":1786169267448,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/buttcoin.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:42:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af35f-74d\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0D7nf%2BbXB7%2Fd09UruBxCoFZbEsZ1JZhd%2FK1s0Zox9iNMZjomceGaixGfykUPZ%2FEwNAH4ctJUJel76stJoBZSLzIVjGIzeWJoFr2aZHB%2F1CtOGjmnQg16k762ZJn0snVGaMYYbT4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c18dfdc759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1869,"size_decoded":2645,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 90x90, components 3","md5":"95e35c1606ab201e97d4193db5d2913d","sha1":"ffad5f8da70fe88023dfb1f883abbf2bf2c483f1","sha256":"f6616063c85e88b149ac5b5f61146f82364e0f8f72f64631329ae6e91d895468","sha512":"191419fd3473f438f761a46e5378e8324f2a6529d87ad4b4fbeda88dbb239fdf3412fb09b0de3ba062c7efee997aba2c830dd9569422ae86c06d4e381e270eec","ssdeep":"","tlshash":"2731eb96521edc58eb4f537dc04a77a84b5b321a922012381e9d2974f71bc77e871326","first_seen":"2026-01-30T00:58:37.975258Z","last_seen":"2026-08-08T06:09:30.187441Z","times_seen":43,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-08T06:07:46.265Z","timestamp":1786169266265,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:46 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\npriority: u=0,i\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8QiDkAhWaEuTnfWWyYRqgZSOtz%2Fnss25UcN8QhV5piujRuHCPX%2BWz%2FF3LHVtn5kOBm0xS5niQPT6GJFUUXek4nWo9DWUFnGWikIRUVKIw8H4SoD0tbgWGLG0cKEBfAKbwVbMca4%3D\"}]}\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57babc68c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":327457,"size_decoded":19089,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1089)","md5":"34e269ae15ff8ccacf107fcbed616c3a","sha1":"c89595a0d3bcae2d855416a15ba0945e454d7fd5","sha256":"a947e268d878700d4c26d0556ec177211c2cadb8e76ca4fe3e24795d56558225","sha512":"452c9a7af641007f84a5facd90a45191131a926ddec59edbec03c340f6367b5dfa0f7e07f068186f04dc054848bb9f1a56aa12de1a0477735bc3c034e348a4a5","ssdeep":"1536:BjzGeJDFDJLOCaE0+k44vJOFAZ5k795UOi1qdQqvhfKHjWILOj/zH5sVP5jfMofv:NO6OnP","tlshash":"d06445b4a0f519bba197a5d078368f2b3ad1fa0bc95b125136ac9fe00fc7c92ed13145","first_seen":"2026-08-08T06:08:05.525166Z","last_seen":"2026-08-08T06:09:30.154797Z","times_seen":4,"resource_available":false,"data":null}},"time_used":422,"timings":{"blocked":-1,"dns":72,"connect":20,"send":0,"wait":330,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/tslax.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.275Z","timestamp":1786169267275,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/tslax.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 18 Sep 2025 05:15:40 GMT\r\netag: \"68cb957c-3c0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k%2B27u6sUJYe9aXOapg%2FxLYZeFG7pu07zQ0Ta%2FJv8iH7%2FFg0yUaFEwgavk0qkGP5oU4zsBAAQDy3IYpXOayeVhaxRddjk6CKXapelOR6H9B2ylnYaMd42Cpm9HaRl%2FLcInuaVS4Y%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c07d48c759-OSL\r\ncontent-length: 960\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":960,"size_decoded":1708,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"641906f846d08492338b70696957ec20","sha1":"9808750aab28e0109f85f1bf9ef101f3417505a1","sha256":"8b94e684af39238b2b1bb291389d20f4ec0a02ec2804451ce90a5d3937d6549c","sha512":"6a5129fdc20662a75f00474d739c9af63c20f008ffb4fdf2df4fdff469be9becfe11dda4fabf0af0a3fa9000d008e8fe727513e53d9bb5587ee5d90b3dc3a680","ssdeep":"","tlshash":"a61188f49e5752f5deb01283d6ccbe41131e855e14e09617f84a04b62f055f099c3689","first_seen":"2025-10-31T04:50:36.829001Z","last_seen":"2026-08-08T06:09:30.203734Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/$collat.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.304Z","timestamp":1786169267304,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/$collat.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:36 GMT\r\netag: \"68d0d3f8-2bc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sYbWZAyK7kWSeq%2FykIPG9hzkoYXkeeucb4K4IL8lcJLdaOpXvL4n1lGXjwpUCvCj4vejQsMrvIp0iz1DfLIVTqOym%2FgZLouyY3Yn2zGesHmyw%2BsIdDVQvHDNnKbcC3Og%2BDecLm8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0ad6fc759-OSL\r\ncontent-length: 700\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":700,"size_decoded":1446,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x90, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"1e2d39790592b230fa4cb0ef8db46495","sha1":"461a6e4414b8855b163f3d5907577db2abf2517d","sha256":"4a6158e2fdb26e242c36c26cd7ce8f8601826cb4a65ed2dc0da708a50a335c69","sha512":"5038700a18f94449122e8e50d802aa38af67ce28c4deb0eedf6c6849074e9528fbddae36b157471e874158841d21f12a89bb84272e4e31d1d072ba880ff23f56","ssdeep":"","tlshash":"7e0194230f5ad013498fed8ae490883c00c267546b2db96a05ca56524197cf359a9300","first_seen":"2025-10-31T04:50:36.909922Z","last_seen":"2026-08-08T06:09:30.165388Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/spark.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.306Z","timestamp":1786169267306,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/spark.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 04:43:34 GMT\r\netag: \"68d0d3f6-984\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gOq4ZemlUNIWVM8sogROdKoo3HyaBVlFVLmR70K3WrjwSh6a42%2BVxLqmupNSE6hoDzHtbDFsOB4zOmkoym%2BXxwA%2BqHcfTf0brqAwBl%2BlxlTu862XU%2BSjK%2FXUrICluhhCU%2Fe46Og%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c0ad72c759-OSL\r\ncontent-length: 2436\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2436,"size_decoded":3189,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 90x84, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0b4637aa3d131ebd7a773d6b8064a27e","sha1":"e78284e79f06b18fea347bc1ec63caf65971debf","sha256":"72b4decc989d30f0b0121f2cef842a5ab18184de41615933bee867cb61b7d6a3","sha512":"d1b462f2472aae9296a836ed43b28f712b6e903df20359d62d7f312e68775c5deedd23bf91bb2cb9c2e95458700fa324c5fb7b809d51682ae9e4d75b31b4c499","ssdeep":"","tlshash":"71415bce5cdc41996020c4574a5ac670f03f7a22c782d96c10608dd8f3eb4a17f29af9","first_seen":"2025-10-31T04:50:36.836841Z","last_seen":"2026-08-08T06:09:30.175387Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/cloud.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.387Z","timestamp":1786169267387,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/cloud.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:28 GMT\r\netag: \"68d0ef98-732\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Seo4mb%2BeAy0HUsvuoY7fp0XCPcR%2BMl2EYeCYdKdb5coi94215ACkgv7twjFkl2wCF5ke8oDxPGTUEePKKYI68vj4yIxse0Ghu8oAm9%2Bm2rhECJDYz4vwUuJCkK131dEXOYN8Tqo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c12dccc759-OSL\r\ncontent-length: 1842\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1842,"size_decoded":2587,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"774e1c3252064bc07f6a13b3b3058ce9","sha1":"87a70896a048a1d14cdf5dc4fb3238e406a60f8b","sha256":"e9d76639c3bd2994bb2ed09b9657efc00a9ca707f164b8d6a35e36d0b24c3f93","sha512":"77ab50ab797c2ae14d9bd69cdc30a48d87ca08c68119ec347f080b4628ccfcd0ef4c2ef5b07fc72b1dce20261a93e8cb8dda843cf0675723a8fde131ae82e245","ssdeep":"","tlshash":"ae3119be1184ca716cc2b93d7cc54a660b071b057dac890373aa33d49d0b2d4a83df06","first_seen":"2025-10-31T04:50:36.916747Z","last_seen":"2026-08-08T06:09:30.158536Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/luce.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.391Z","timestamp":1786169267391,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/luce.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Mon, 22 Sep 2025 06:41:11 GMT\r\netag: \"68d0ef87-8aa\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=y377sBsqXU5DYXpRYHMptJj7Chm2U86zgj%2FVE1G6B%2Fz9ZVDxfFElbLCpxlrT0G24uEMfN8gZisViPgv0ylZEbPFqUoRP045eO2D%2FbLNrwiUUTr0VIQq1TqL01QcAVk5Q6DJCFj4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c12dcfc759-OSL\r\ncontent-length: 2218\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2218,"size_decoded":2963,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4af966e5a0f96195d0afbf43e0199958","sha1":"68ab84e208214ea2d300519d9b6e373754b0fc16","sha256":"2457fad71ccffbf744ae2d86b1fbbfbe9c05a037328cd29e539816c6f110ddf5","sha512":"0ecb8f5f586c56dadf97d4e693269799494dfba66ba17178263d63bbdff77e6e8c44cee0c45114c5f24cd34697f4f58690bdb111ac140f6b592ff1543c4baf3c","ssdeep":"","tlshash":"eb41f821737abad2c29571fd146d3f80b7882f734bc92257525950360f9d8a55c3b49c","first_seen":"2025-10-31T04:50:36.670957Z","last_seen":"2026-08-08T06:09:30.184056Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/clawd.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.452Z","timestamp":1786169267452,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/clawd.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:42:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af35f-658\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yQuAnUYKXy5b5ucSqvt83AYzwVezIlrS%2FxKlP87U4aAsYYR5m6Gs3bsAE0Hfw9h2ZnaZIF3fAVZidBqfixCjgY7ki023fZIBv95o4jzA%2F%2B%2Fx%2BG56zqIDxscovsKARSAimeMzr8Y%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c18e00c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1624,"size_decoded":2375,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 90x90, components 3","md5":"349cf153b2bc032112385fad1e22e0a1","sha1":"58ec84f783c34148a9d43f36f10967139e521a0d","sha256":"d58b48e0b834fd574c783897f1c2c2f69b98a3f01a199669cccb8c390dd24a6a","sha512":"fb8f62132e359ce172f757f2fbc95c92b90d2e7bb988998aa5a9b24af5e8a567429ad7e3ce71422a838a04f76af7174032c2fe82ff1a883da37c16014b9c3507","ssdeep":"","tlshash":"8e31ba9b0e0a3cd3f88b03b44919c53221929986cd8986162637ff19f8b8ad45c4b764","first_seen":"2026-01-30T00:58:38.211395Z","last_seen":"2026-08-08T06:09:30.247456Z","times_seen":43,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/gsd.png","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.457Z","timestamp":1786169267457,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/gsd.png HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 29 Jan 2026 05:42:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"697af361-a05\"\r\nexpires: Mon, 07 Sep 2026 06:07:26 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 20\r\npriority: u=5,i\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xeAcpUe3okW7m6ixbrCNqrh2Scdt5gkSfkuH0pxpDooCnMRXN%2BVrZNhwRN2Z8xvgm9f6CVTX6wjf6hk76%2F92F62Lc9Hea%2F77FfKxk39sLfWUmTVI%2B1Z86AwsyMBMZa5%2FED2haAI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a27c57c19e03c759-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2565,"size_decoded":3388,"mime_type":"image/png","magic":"PNG image data, 90 x 90, 8-bit colormap, non-interlaced","md5":"6f793230328a358fc4141ec8bb864fd3","sha1":"7a43c367087384aa0aff24a6fa62245e280e7058","sha256":"ce0dbea49c280b6844a8016ed20de38e725f2349dc6c85cf67775ca5d57441cf","sha512":"0c251306b4919f51a42cc7a43f23197ae98dd27d5710657488620af2cfa6390189580120cee72abad2bedc5d25d25a4c0b8c4b8b4ec6f7c5df42af8139c0756e","ssdeep":"","tlshash":"fe515cd27407ef08ac12bc06a07c8388a6b301b3448ed4847f21a06ccdeac3d6a8357a","first_seen":"2026-01-30T00:58:38.078894Z","last_seen":"2026-08-08T06:09:30.191482Z","times_seen":43,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sigma.metaeora.xyz/files/bome.webp","fqdn":"sigma.metaeora.xyz","domain":"metaeora.xyz","tld":"xyz"},"ip":{"addr":"104.21.73.72","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sigma.metaeora.xyz/","date":"2026-08-08T06:07:47.224Z","timestamp":1786169267224,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metaeora.xyz","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 12:14:44 GMT","end":"Wed, 16 Sep 2026 12:14:43 GMT"},"fingerprint":{"sha1":"D8:40:A0:87:F5:66:30:6A:AD:A1:29:B5:6A:F7:D6:90:03:02:D0:55","sha256":"BB:26:89:92:1D:14:A6:E1:4D:7C:6D:40:D7:D8:A1:1C:72:D0:1E:C3:65:67:30:6E:A1:54:57:5F:E5:9E:C6:66"}}},"request":{"raw":"GET /files/bome.webp HTTP/1.1\r\nHost: sigma.metaeora.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sigma.metaeora.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 08 Aug 2026 06:07:47 GMT\r\ncontent-type: image/webp\r\nserver-timing: cfExtPri\r\nlast-modified: Wed, 17 Sep 2025 09:08:28 GMT\r\netag: \"68ca7a8c-722\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\nage: 20\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FMX1jJlU24iPYQiC0O40iZ%2F9%2BF5BNIPia9SuIkcjChAz99SlZWG51VdTnPOGxaPDKiTiM%2BBxGj3LUasdq9Xt7%2FANlYaEQzaDtKNeFHomMdDMg%2Bc3XKWUUaYxeERxaRnIoKmHtD0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a27c57c02d19c759-OSL\r\ncontent-length: 1826\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1826,"size_decoded":2575,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2ee67630ca27073e70c283c447eea7b4","sha1":"bd0187a7b56a22b45a27d26c34a81ac78581c2b7","sha256":"2be94ec238847e6b6e13fc98cf9788e9862a94d6d13271732980a8c949ef9a87","sha512":"198fdad94f808243b485acf62ec4c9fee7925a52aa5b5e5d1d34f5032660b601b1c9beac484b46fed77d399f20ab6acf84f0993957f52832ff1e250726447364","ssdeep":"","tlshash":"38310bcd2f269469e31cef38580d1397129623133b588c5bc04b9b368da743bd3ec9a1","first_seen":"2025-10-31T04:50:36.898848Z","last_seen":"2026-08-08T06:09:30.213581Z","times_seen":91,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-08","alert":"Sinkholed","trigger":"sigma.metaeora.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}