{"report_id":"d99a39cf-dec9-469a-a484-265fe5e8c1b1","version":6,"status":"done","tags":[],"date":"2026-03-07T01:27:55Z","url":{"schema":"http","addr":"xn--pnp-doa.fun","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"xn--pnp-doa.fun/","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"title":"pump","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T17:51:58.402791Z","times_seen":17874405,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"xn--pnp-doa.fun","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-11T01:27:55Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":8,"urlquery":0,"analyzer":8}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-07T01:27:36Z","timestamp":1772846856,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":42598,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-03-07T01:27:36.783939+0000\",\"flow_id\":938263506901082,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.28\",\"src_port\":42598,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.28\",\"port\":42598},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":945,\"bytes_toclient\":1654,\"start\":\"2026-03-07T01:27:36.776282+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-07T01:27:36Z","timestamp":1772846856,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":42624,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-03-07T01:27:36.787639+0000\",\"flow_id\":1037356992354783,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.28\",\"src_port\":42624,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.28\",\"port\":42624},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":2598,\"start\":\"2026-03-07T01:27:36.776671+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-07T01:27:36Z","timestamp":1772846856,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":42612,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-03-07T01:27:36.791167+0000\",\"flow_id\":367936947149141,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.28\",\"src_port\":42612,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.28\",\"port\":42612},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":2597,\"start\":\"2026-03-07T01:27:36.776533+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-07T01:27:36Z","timestamp":1772846856,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":42654,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-03-07T01:27:36.794604+0000\",\"flow_id\":2123990160693996,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.28\",\"src_port\":42654,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.28\",\"port\":42654},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":2598,\"start\":\"2026-03-07T01:27:36.776940+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-07T01:27:36Z","timestamp":1772846856,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":42638,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-03-07T01:27:36.797084+0000\",\"flow_id\":2027263202220649,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.28\",\"src_port\":42638,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.28\",\"port\":42638},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":945,\"bytes_toclient\":2672,\"start\":\"2026-03-07T01:27:36.776809+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-07T01:27:36Z","timestamp":1772846856,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":42664,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-03-07T01:27:36.805306+0000\",\"flow_id\":1138907199101901,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.28\",\"src_port\":42664,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.28\",\"port\":42664},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":945,\"bytes_toclient\":2673,\"start\":\"2026-03-07T01:27:36.777165+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-07T01:27:37Z","timestamp":1772846857,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":42666,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-03-07T01:27:37.014549+0000\",\"flow_id\":894042523631216,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.28\",\"src_port\":42666,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.28\",\"port\":42666},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":945,\"bytes_toclient\":2672,\"start\":\"2026-03-07T01:27:36.982640+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-07T01:27:37Z","timestamp":1772846857,"ip_dst":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":42674,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-03-07T01:27:37.082653+0000\",\"flow_id\":1130231365180590,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.28\",\"src_port\":42674,\"dest_ip\":\"104.18.50.34\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.50.34\",\"port\":443},\"target\":{\"ip\":\"172.18.0.28\",\"port\":42674},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-14c1504681d2427684ac1f489338d075.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":2597,\"start\":\"2026-03-07T01:27:37.072878+0000\"}}"}],"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null},"summary":[{"fqdn":"xn--pnp-doa.fun","ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-02-27","domain_rank":0,"first_seen":"2026-03-07T01:27:57.657607Z","last_seen":"2026-03-07T01:27:57.657607Z","alert_count":0,"request_count":30,"received_data":3712882,"sent_data":13503,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.reown.com","ip":{"addr":"104.20.46.121","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2000-01-28","domain_rank":0,"first_seen":"2025-09-26T22:04:59.160341Z","last_seen":"2026-02-28T08:59:50.494431Z","alert_count":0,"request_count":7,"received_data":338178,"sent_data":3360,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2022-08-23","domain_rank":0,"first_seen":"2026-02-25T03:05:04.781981Z","last_seen":"2026-03-04T13:08:02.812325Z","alert_count":8,"request_count":8,"received_data":5579997,"sent_data":3800,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/avatar(7).svg","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.899Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/avatar(7).svg HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WO1dy3sT6qV%2BVhax8mJmzyCrd%2BoOdakrcRiF6MJSHQeMyhtnxK2PDp1wdDfDGbs54sGcOFrzdZncajBxOiJK%2FvCFB7t1SUh%2FdvcPOzHSTQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\netag: W/\"2465-64c1ce4ff5d40\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9d85d171ebb40883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9317,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"36128d1dfcd0f2808035850a7e9c1ead","sha1":"eaa4a9dfc046e06d995933102422c12d3ab6ee7c","sha256":"b30755e2d4623214158899a31ed878aebfe10d8a14f1b262910ae228cb2132ce","sha512":"5ea566d15ae709b359fa9e1e61795a8b413d79c62a5ce76a1415e19f168a0553002fdb351fd1706899cdbc616645e969c47e45002937f712eeb7aa64802bd261","ssdeep":"96:PBkngBtDVaJvC4loRKQYo746FwpNuXrnX2IniEUsRboD7w7D0Gs2In04UsRbodCL:JknMxwagoB4U4ORiGR50GG0qRehM","tlshash":"ed12c7b09a34517c184383edcfb2c5a63b5fb0fe77990364b4b9c77170566d9d88a424","first_seen":"2026-03-03T14:41:54.837411Z","last_seen":"2026-08-04T05:41:38.477567Z","times_seen":90,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":77,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/avatar(11).svg","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.908Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/avatar(11).svg HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uRNHLrjBSxjYI4SPbFvRWKSda1eafqvYalJQyFtiaIofvPf4jDI2V9gh6RGhxuC0ZJgcNCAr9y1493ZEKvI4Ez8EIXbNYk2GX%2Br8gp4Tqg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\netag: W/\"13c0-64c1ce4ff5d40\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9d85d171fbba0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5056,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1e82693281c6a6f7dc5d6abbb61b22e8","sha1":"7602df82ec430491d58f16270cc5722c49eabd5e","sha256":"22e13af1b7d973794032a0cc5c9bcabe543c661480226c3138a4a361834268b2","sha512":"0af525763826cc4d5efadde4d7042dda22ca72cc2e462fd8212641eaeaf850138ad4366fb1fa0a0d0d06526f4255b0cfd13ff1b45b0c8076522af43e3b6165da","ssdeep":"48:Cq1n8UknGc8oi8I26/gu4Ae3V0gdHp++vOvsB18qNdnbNdaV7bCCVv88vy2OdV4o:PBkngBDel1QgL8ybIHBnwh9zJ","tlshash":"09a1a6b2971851ac2e0247fdcff4b062a72fa0feb5944788b86cc7b174525bad44f918","first_seen":"2026-03-03T14:41:54.938519Z","last_seen":"2026-07-27T12:16:15.915346Z","times_seen":76,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":77,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.reown.com/KHTekaMono-Regular.woff2","fqdn":"fonts.reown.com","domain":"reown.com","tld":"com"},"ip":{"addr":"104.20.46.121","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:31.302Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"84d97dd5.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:15:03 GMT","end":"Fri, 08 May 2026 01:14:56 GMT"},"fingerprint":{"sha1":"45:9E:64:A7:5F:5D:4A:08:84:41:1C:19:61:0C:8E:F9:07:F9:39:0A","sha256":"BE:61:71:F6:DB:D0:2F:10:BE:6D:F9:49:68:D6:02:00:7F:0F:E6:E2:EA:25:7E:B2:B4:99:56:B9:98:A3:C0:13"}}},"request":{"raw":"GET /KHTekaMono-Regular.woff2 HTTP/1.1\r\nHost: fonts.reown.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:31 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 35836\r\ncache-control: public, max-age=31536000, immutable\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\netag: \"d9f04a87559c7cb8fd4dc85e16f292c6\"\r\nlast-modified: Wed, 13 Aug 2025 13:41:59 GMT\r\nvary: Origin, Accept-Encoding\r\ncf-ray: 9d85d1752bc876ef-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":35836,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 35836, version 1.0","md5":"d9f04a87559c7cb8fd4dc85e16f292c6","sha1":"b1c409b4512757654e78381b461e4eae303bd5c3","sha256":"6f0fb7a71d24385e53113fd29c812c8923649e3063e12f8465d3e45a1b183457","sha512":"ee5be9d9cb4ac195c35f0285e971c4db7a6d0c26852ffc7d2c4eaf4c3b3ea311ffed98a20c1afbaf57c6159224cb108d9894a07c999b2f59615397040a28ef2d","ssdeep":"768:rhftQee8/9NOz7HTIMqJVDQtFDGHR91lSIO960XN1zu+aXw:DHe8VNOnzqV8GHj3S5XzubXw","tlshash":"bdf2e16bd8194560f9fcc87a0d8520ca2d81197635738d77f3999342bb9e33b21c789b","first_seen":"2025-09-26T22:05:13.133134Z","last_seen":"2026-08-13T04:37:21.361135Z","times_seen":905,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":81,"dns":18,"connect":9,"send":0,"wait":41,"receive":1,"ssl":49},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.reown.com/KHTeka-Regular.woff","fqdn":"fonts.reown.com","domain":"reown.com","tld":"com"},"ip":{"addr":"104.20.46.121","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:31.304Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"84d97dd5.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:15:03 GMT","end":"Fri, 08 May 2026 01:14:56 GMT"},"fingerprint":{"sha1":"45:9E:64:A7:5F:5D:4A:08:84:41:1C:19:61:0C:8E:F9:07:F9:39:0A","sha256":"BE:61:71:F6:DB:D0:2F:10:BE:6D:F9:49:68:D6:02:00:7F:0F:E6:E2:EA:25:7E:B2:B4:99:56:B9:98:A3:C0:13"}}},"request":{"raw":"GET /KHTeka-Regular.woff HTTP/1.1\r\nHost: fonts.reown.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:31 GMT\r\ncontent-type: application/font-woff\r\ncache-control: public, max-age=31536000, immutable\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nvary: Origin, Accept-Encoding\r\naccess-control-allow-origin: *\r\nlast-modified: Wed, 13 Aug 2025 13:41:58 GMT\r\netag: W/\"f68d2c4950f0ddadd8e09e104ec4e425\"\r\ncontent-encoding: br\r\ncf-ray: 9d85d1753bfb76ef-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":60140,"size_decoded":0,"mime_type":"application/font-woff","magic":"Web Open Font Format, TrueType, length 60140, version 0.0","md5":"f68d2c4950f0ddadd8e09e104ec4e425","sha1":"a776262129e9223ef9b786f44d8718f32bc7529c","sha256":"adc78a8fe0174e7e1f6d4b4a267f1e2f1742088923635f36acc4eae42f953c1e","sha512":"390be30d7fb7b01e15d8a7c4e4412ac8507fb07a88ae04ae418f4d288bef57cf9a7db4a66c44fc4df738b6a58b59b66a57cfbb00c8d2d0b32984bdd5659531a2","ssdeep":"1536:kXpFvtCoQwH0kJLLpdNUTaa0TdlDz1mzltKA:Qp3RSwDHA","tlshash":"594302bc5a0243cad09991c5cc4c6d0d6f8c379597bea20bc6723b9a1523ba937bf584","first_seen":"2025-09-26T22:05:13.170618Z","last_seen":"2026-08-13T04:37:21.363252Z","times_seen":872,"resource_available":false,"data":null}},"time_used":232,"timings":{"blocked":91,"dns":17,"connect":12,"send":0,"wait":44,"receive":0,"ssl":55},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-mobile.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:36.748Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /phantom-bypass1-mobile.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 07 Mar 2026 01:27:36 GMT\r\nContent-Type: image/gif\r\nContent-Length: 2031700\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"a22dc9face81ff1665651f1052a0a99f\"\r\nLast-Modified: Fri, 23 Jan 2026 22:55:26 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d85d1972f5fc759-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":786432,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"eeebcd74061a9dcd7dfad338ebe1d46a","sha1":"23148fe8cd0cfe6b4379103d03dabde517e9bfd9","sha256":"631978ce1c77fdc8360949130dc08a761d8a5cbf0b87875b7b1556706cabc068","sha512":"e151fd7805ccbf649173ed454739604bbb31cbd0daa1dbf057454363c74532c9a5c2310e516f087f21ef09e5cd7de46e91d67e01815274b82573caae494eff45","ssdeep":"12288:/2TA4vVLmF/WbRkFOppRWsWNbGSQHJAUOUsLOsWZssG5bxVWhseThDII57tSKnXb:/2TAaRkFipRWRSlpAzUWOsWWvbLqhDVr","tlshash":"41f4233ac26c0681a9a500112e6526604c337cbc54feea3383eddf3adb5b92d6da5295","first_seen":"2026-02-25T03:05:09.955526Z","last_seen":"2026-03-07T02:01:37.494267Z","times_seen":63,"resource_available":false,"data":null}},"time_used":316,"timings":{"blocked":79,"dns":33,"connect":1,"send":0,"wait":126,"receive":27,"ssl":42},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/index-tIMRj9oK.js","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.874Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/index-tIMRj9oK.js HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5IKp9eyxvjL%2BXgAQxXlMl15mGDqx3OfSQm9LLL7nKquobLpLqGf9F%2BQBtoT4CEcls88oF3meB8w4I%2F6snUC%2FER2epRJrulTwTjmRWE9VbQ%3D%3D\"}]}\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=iso-8859-1\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d85d171db9d0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T17:51:58.402791Z","times_seen":17874405,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/pump.png","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.879Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/pump.png HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\netag: \"86e0-64c1ce4ff5d40\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 34528\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P46xD1lM9xMKhYYZSgLz5edZlwiVqj2OxBh9AdOPnpTX7spj%2FILiW53gdBxHVKQMdkyAH8eO1qAQ%2BO5jZxdB52OwGLKXX3uGD5ZP1v6tyg%3D%3D\"}]}\r\ncf-ray: 9d85d171eba00883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34528,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 279 x 224, 8-bit/color RGBA, non-interlaced","md5":"9b86e948902cd59b1d7939679aef063f","sha1":"ae92e13dfbd9f970834222366b085d9ff0e2f370","sha256":"b7b44ca054c4d04171cddee9b9298807b137d5e50865c22194a965dfc59a5d3a","sha512":"c59789b9eeca0be001caa160d6f21351d0a2c6c566f381b1363fd2ebbeabe61fd1e5533c496ffa29a6a995a5eab40b51f7d809f024daeeeb392fdbab9faf4700","ssdeep":"768:vzYlGEgbY6HjWErvGK8t3SAZSjiPnUxy42ZemMsG38d3RgzEn:veSYiCErvGZdzZhtDg1sMI3eQn","tlshash":"44f2e1fbce13c6a5e5ab71add88dd4a2ca4c50d213ded85b4d0494b74c0bec0969cba1","first_seen":"2026-02-04T18:55:33.891763Z","last_seen":"2026-08-12T06:39:16.034772Z","times_seen":240,"resource_available":false,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/128x128","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.880Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/128x128 HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\netag: \"5c7-64c1ce4ff5d40\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 1479\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BEFN0tVlxBje0hM4se4uryNC68zXcgoB47kSxaqGsHfs5OhQ41OMSJKflDVpPkY%2FvdWXJQeuHvpgQOXEGvlZBD4%2FeRrc2NtQ5744bv9xbQ%3D%3D\"}]}\r\ncf-ray: 9d85d171eba20883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1479,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 128x128, components 3","md5":"ecc862f9550a8502e56961092f5f287b","sha1":"bcde81da377b3cc60bbd75a4e11bb212f831e388","sha256":"ba83e4cb90d103b876d0cc659a717bcd0c83d37013dd0c5443c14eed45c18219","sha512":"e5143ad74d9e3b2ca9ac5fa1d08c8c20dea63bcd6d86944709d9a777500bc0ed78441cf54934e3ac6f90bae4686f71e3e3999cbaf0cf04742fd73daf8ed0f6e7","ssdeep":"","tlshash":"b131a417d716c7b8e84997b14ade271c278dadea5190d9e9739cf4e6a4a00dc1b88308","first_seen":"2026-03-03T14:41:54.933564Z","last_seen":"2026-07-21T02:09:16.13079Z","times_seen":69,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/test1.png","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.885Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/test1.png HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\netag: \"1ea70-64c1ce4ff5d40\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 125552\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N%2F2x3ToVjlpwimoiMxJhyn78I70tdnvdHJYwWHElHyUYBSOD3aM6puYN4XQBIXmGN2Caex59EiaUhsxedK2Xy%2BFuN1aQbUiFhbkCkCtURg%3D%3D\"}]}\r\ncf-ray: 9d85d171eba70883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":125552,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 519 x 290, 8-bit/color RGBA, non-interlaced","md5":"40f44c8a0cccb59c327488c2a6e3e947","sha1":"a4b0d1135013f98cc9d8ef2e74bc45d719431151","sha256":"2ef826540ac79ddf96473ef9983d125c4408cd86679e69f87fbaad7f0dd86f53","sha512":"67502fec78997dd074c6e95ab89efea9b2bcb8c7fa85515637e273217c876cdee1dbc5f24102bd70de82250304dbf9c2b61a4bf4e53c98cef31242cfca46c2c1","ssdeep":"3072:14DWdhorBfFsWOKvGRRcqAJjpfsdK3DnLPp5:mWd92icRjp0daDnLB5","tlshash":"c9c312a5e13d19f46e78b03548643cd3f868e8684a7a7864287783f75f26c805be6d3c","first_seen":"2026-03-03T14:41:54.841381Z","last_seen":"2026-08-12T06:39:16.14734Z","times_seen":212,"resource_available":false,"data":null}},"time_used":145,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":82,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/api/v2/handshake","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:36.664Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"POST /api/v2/handshake HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/octet-stream\r\nContent-Length: 71\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Sat, 07 Mar 2026 01:27:36 GMT\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ECsYg%2FSOkenPOZVPJ6E2tUoAwuo%2FxRlhFTYm78IAqNMrYPWMhXeIlZoB23XtHtIel1y4afRLmbDmMkXE6uh5X%2Frg5D2QCpb%2F9j49I4PlJQ%3D%3D\"}]}\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=iso-8859-1\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d85d1962a500883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":277,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"346cc77f0f657dfedf63eb94336d1ee0","sha1":"ef6b70be12a389bd980d3cfb50520c51ab892b93","sha256":"dd97f464be0eb59a94fb4b02cecaeee0685c67f0318c804f26cfd601ed481ed4","sha512":"59036fdee4444d66e840b1df11ae9afb0e0c0e72a8bcb29b1c56e821781efc91a7881341b56420aa41004e1b9ad499d07c1efd3a84c58c66e8374ae1388d4ddc","ssdeep":"","tlshash":"11d02bde50836287491214a039c625c2374d12f6a43a42a83dc6e4875298d3ecedb59c","first_seen":"2026-03-07T01:28:01.198545Z","last_seen":"2026-03-07T01:38:42.398098Z","times_seen":2,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-mobile.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:36.757Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /solflare-bypass1-mobile.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 07 Mar 2026 01:27:36 GMT\r\nContent-Type: image/gif\r\nContent-Length: 6028322\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"cf5ac8fca45e5d0409fef8923c179975\"\r\nLast-Modified: Fri, 23 Jan 2026 22:54:15 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d85d1973ade32fa-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":786432,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"13ec753f0f7ac3f2e09cd8fb3d159fd6","sha1":"fb7c640e5ea1b3eb5af719aec31fe04a971c27db","sha256":"69c12f796a581c42a4dfedd57a615fdc0407867c0ab2577507c6afe5320d5b26","sha512":"79c55e8cc4ba19d93751be035f34ffea46704d06b08da0ee65a013c3bb40a7f3295156bc659db38df831457a65d53ed01bb79812b5903f66de13108d99c85e9a","ssdeep":"12288:WKLOlpdbVhOBbi61VlVP30w5qYO8DgLhC9bxl0zY6+wqzta5YpqXl5M0k+3uJH:WKS1/OBbi61/Vvx5qYONFC9VGM60S15M","tlshash":"b4f433f9941e38c2eb42b5617c2f12219dffb09b487f5fe24b40ba6a23dad4443d9458","first_seen":"2026-02-25T03:05:09.960469Z","last_seen":"2026-03-07T02:01:37.469286Z","times_seen":59,"resource_available":false,"data":null}},"time_used":445,"timings":{"blocked":79,"dns":27,"connect":12,"send":0,"wait":130,"receive":150,"ssl":32},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-mobile.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:36.758Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /solflare-bypass2-mobile.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 07 Mar 2026 01:27:37 GMT\r\nContent-Type: image/gif\r\nContent-Length: 8319275\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"ffdbd9550fb16af66a8cf7717da03833\"\r\nLast-Modified: Fri, 23 Jan 2026 22:07:07 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d85d198de288deb-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":72469,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"363ddb53f563d60428da2e86055b2036","sha1":"ee503fa9ed60ece6e2054f8c884e7baf035d15d5","sha256":"77be1ed10e7f68a6fd8f2451c56c71277238b1c676c33181850749c3405f2bb0","sha512":"1160e949962b9989055da464412469a4bc259a0daeb0c1a1020878a65292d038f6fe7e1f15bb5b1893b78c0b6944ffc2fbc8054d350dfbd23aea0a469c963090","ssdeep":"1536:Ttz9fYIkFr7zUR+em1WBIIuefEUJyOA0onplEdGhI1:bf5Iz++emEBeefEU69n8X","tlshash":"386302cbb56de35c9da0e9f56e8fa9c13b82673fbcb90c4597c18c18ab839515d0c280","first_seen":"2026-03-07T01:28:01.202894Z","last_seen":"2026-03-07T01:28:01.202894Z","times_seen":1,"resource_available":false,"data":null}},"time_used":463,"timings":{"blocked":315,"dns":0,"connect":3,"send":0,"wait":124,"receive":4,"ssl":17},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/index-DHNhIdoO.css","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.876Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/index-DHNhIdoO.css HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\netag: \"a2db-64c1ce4ff5d40-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncontent-length: 7726\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3wKuY9aI5hosh44uBXG6XQBH8VNI7NOv0qrYLMzbeMCduhSHtdCSO%2F87Omjl6fY0Hr%2BTexT6BfG3S%2BqNTG7BPMKQ4H32dAR0EC1Qqa6IIA%3D%3D\"}]}\r\ncf-ray: 9d85d171db9e0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":41691,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (41690)","md5":"0e01ec2018adaf2b297a25d41d33ca4e","sha1":"a039c5b4744de23755df3ff3f160b396e48e2d9e","sha256":"64ab960eb76bad09340289487ba6f8ab727cabca48a0f6c66f34874d9d9ee498","sha512":"65758d170c9dbc6f424c55c0d6ebbfcdb2f5af8e584cc9720c5c623b17f6f44341a6830995f713c471b8836bddde8b30b68c5222e689320effa908094e60a33d","ssdeep":"384:koq1opvhcIt49Q9dMbE9c56HjH7kTF/y/5r5f5GexOQU0jqv:nq1opvhcIt49Q9+CPr5f5GKPqv","tlshash":"7f134f2d6a14403f7c6790f5d2d8ba9df21bb0c1df3a9aeabd8211115bd23f61ca7604","first_seen":"2026-03-03T14:41:54.879222Z","last_seen":"2026-08-12T06:39:16.112709Z","times_seen":205,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":87,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/avatar(4).svg","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.896Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/avatar(4).svg HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZGdIMrRGaG7SHVcW2nrv20wIPN5OuuqrSoXpt4d8Nk4y7Ki2VG012YT1RuTGyyGsE8TiTkYNtjF3x%2F4mtCw%2BDd6LEdo%2FvVnkgulccKa8Hg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\netag: W/\"225a-64c1ce4ff5d40\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9d85d171ebb00883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8794,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f1841905888f62c235661d78760febb1","sha1":"49e58275ca26269153c9f662bf2cb2d5cad258f5","sha256":"eef064451293aa9729c8625e4c509e4e055427dd8d9c1f284d028867c254b086","sha512":"29ad1c263ab819f383b4a6b9c3df545cec38822da698425c04c7e2ccce868e3841103481a42e45961f9b5a4246d767bdb20e134e1facf59f9dd316f648ac66f3","ssdeep":"192:Jkn248QSIP036BvW6LHEkCoZHhiGLA0qLH:ynaQSatHEkCoZHhiGE0qL","tlshash":"8202b6a19710627c294387fdcf7184a53b1fa0fe7b9a13a4f5b9c771b052ae9c885424","first_seen":"2026-03-03T14:41:54.955615Z","last_seen":"2026-08-04T05:41:38.500312Z","times_seen":90,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.reown.com/KHTeka-Medium.woff2","fqdn":"fonts.reown.com","domain":"reown.com","tld":"com"},"ip":{"addr":"104.20.46.121","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:31.298Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"84d97dd5.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:15:03 GMT","end":"Fri, 08 May 2026 01:14:56 GMT"},"fingerprint":{"sha1":"45:9E:64:A7:5F:5D:4A:08:84:41:1C:19:61:0C:8E:F9:07:F9:39:0A","sha256":"BE:61:71:F6:DB:D0:2F:10:BE:6D:F9:49:68:D6:02:00:7F:0F:E6:E2:EA:25:7E:B2:B4:99:56:B9:98:A3:C0:13"}}},"request":{"raw":"GET /KHTeka-Medium.woff2 HTTP/1.1\r\nHost: fonts.reown.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:31 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 42388\r\ncache-control: public, max-age=31536000, immutable\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\netag: \"b4654ab0ae548e33ee07aa61dcffc61a\"\r\nlast-modified: Wed, 13 Aug 2025 13:41:58 GMT\r\nvary: Origin, Accept-Encoding\r\ncf-ray: 9d85d1751bb476ef-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42388,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 42388, version 1.0","md5":"b4654ab0ae548e33ee07aa61dcffc61a","sha1":"a76a9e6e214dbb1442d49384ddc04ab15f646f8c","sha256":"72b1a6bb274ab9bec5b0c7ffa3294d57aeb40e5e1ddcd636608f7b303a5a188a","sha512":"b4c066a098813b2c9ece27477bea99378b5e228b466c19175a01f75a324f3a28d8003b50ac4202263774492d90c7c32f3911987b79816eec3e86f146a4c703ce","ssdeep":"768:lvEK+O85aFN+GawIrhD6BC07w+/m29yWiaZMPhpEqAJhxyCd9/xk7VremoV:qK+O2aD8hD6BC07w+xqPEtJhxyCdxxks","tlshash":"2313e002c08249d79ed6913b3232aa1b3ab1b6d8d634e5fc42349df824e6c1f989d324","first_seen":"2025-09-26T22:05:13.166396Z","last_seen":"2026-08-13T04:37:21.360069Z","times_seen":908,"resource_available":false,"data":null}},"time_used":205,"timings":{"blocked":80,"dns":19,"connect":1,"send":0,"wait":42,"receive":1,"ssl":58},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.reown.com/KHTeka-Regular.woff2","fqdn":"fonts.reown.com","domain":"reown.com","tld":"com"},"ip":{"addr":"104.20.46.121","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:31.300Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"84d97dd5.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:15:03 GMT","end":"Fri, 08 May 2026 01:14:56 GMT"},"fingerprint":{"sha1":"45:9E:64:A7:5F:5D:4A:08:84:41:1C:19:61:0C:8E:F9:07:F9:39:0A","sha256":"BE:61:71:F6:DB:D0:2F:10:BE:6D:F9:49:68:D6:02:00:7F:0F:E6:E2:EA:25:7E:B2:B4:99:56:B9:98:A3:C0:13"}}},"request":{"raw":"GET /KHTeka-Regular.woff2 HTTP/1.1\r\nHost: fonts.reown.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:31 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 42188\r\ncache-control: public, max-age=31536000, immutable\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\netag: \"a918aa94460a2a95ccfffcf7224df6e4\"\r\nlast-modified: Wed, 13 Aug 2025 15:27:31 GMT\r\nvary: Origin, Accept-Encoding\r\ncf-ray: 9d85d1752bc476ef-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42188,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 42188, version 1.0","md5":"a918aa94460a2a95ccfffcf7224df6e4","sha1":"9c690a4d67ca4f8fa4295524af06b4d061f8c8f0","sha256":"1491e6d9a713e703891bb7cff67f2f785c9616df0b81504a37be6c15a4706bc3","sha512":"7859869f84323541884bd97b25c2a8bb60af834457f17ef41ac12669fce15e442a5212acbc00a4f28fd6eb7bd2ea148f45de3b7195edc4b4f066f0a4e541fb39","ssdeep":"768:oIKoK4lzWnuGeZ660HRzqx1V13F3Eej9qtLzoq9Yps4me3Jw/GW6Pf:xKD+yu63ZqLV1V3ut/ENkGW6n","tlshash":"1c13f1a0590670217d2f91784a67d8cfbcb0b47e1e4a774f6c7cab5c0930916fcae585","first_seen":"2025-09-26T22:05:13.153365Z","last_seen":"2026-08-13T04:37:21.353291Z","times_seen":908,"resource_available":false,"data":null}},"time_used":215,"timings":{"blocked":82,"dns":19,"connect":1,"send":0,"wait":45,"receive":1,"ssl":58},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/avatar(1).svg","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.891Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/avatar(1).svg HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Cwj47tAV2v4Did5acT1KNVjZ0HVc7vJCXjSP1bSG%2FU42f5MvpMPH%2FORjFaTU94KpmcMgHioKzzWHvjSS4ifS9hKKVT8vMBT99htq1kZTew%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\netag: W/\"16a7-64c1ce4ff5d40\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9d85d171ebaa0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5799,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b34f5db2d6d7bbf90a1b9c4fd60191ba","sha1":"6627eebe6eac5bc0ced992f0e2a78b96fdd38604","sha256":"91a1498536566bee7729167e86b57d11a3b093913f7c6e339d87cde4aa73a1f2","sha512":"5247ff8d395a146dfd7385eca9acc235289b0b23b0e3dd630a73b19a36a4d40d03dc3e8ea7e19079435594af0e32fe4b5d60f4b1a4bebbc892e61594f0395514","ssdeep":"96:PBkngBDJKFeuGQGMtj8UUeKIEtRMugWxEuwx92SnHUhbTCPe:JknqJKmQHtGRf9waSHmbTf","tlshash":"59c194b25b18103c250347e8ceb7a5a2372fa0feb6ca46d4b57ec771b4436d9d983848","first_seen":"2026-03-03T14:41:54.844414Z","last_seen":"2026-08-04T05:41:38.475059Z","times_seen":88,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/avatar(12).svg","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.909Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/avatar(12).svg HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pIkjZ3rh1iv2rfZmX%2BENsW9zFXDO0pSXP45HH96DF1fsuvUVUr3uAZQq62WKI%2Bsga5dpB63pnJ4YcdBHNai%2FMFKIqCDIbL6%2BYjltvauvrg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\netag: W/\"2e26-64c1ce4ff5d40\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9d85d171fbbb0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11814,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e01eab0a05ccff2b784348d95cd78eb6","sha1":"99bf4164a44f276be81e2b6bc772e220eeda1a93","sha256":"d8608c68cb067935374b966f903687ac6b0d83eeb8dddf473273ce609d47de07","sha512":"668b1acfc4d450ace89d12763efdca0a837f68b7c197e112af91367d2136aea505a7fd50752f61eea3cc466f0eb6bf732a4566448f914aa74180613005e910c2","ssdeep":"192:Jkn7XCZxSp+rOxJGmNDDbW+eDT8yA2yVl6hVDI/J:yn7SMDNXpg9DhVDIB","tlshash":"ef32a3f45a1812ac288347b8cf6990f1331f64feb78942d479fec7b0b4439a6d943928","first_seen":"2026-03-03T14:41:54.927589Z","last_seen":"2026-07-27T12:16:15.952346Z","times_seen":77,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":84,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/api/v2/handshake","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:32.543Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"POST /api/v2/handshake HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/octet-stream\r\nContent-Length: 71\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Sat, 07 Mar 2026 01:27:32 GMT\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TlWSqMyjDPDo%2BLFCRWIlRTwNaiSRu%2F%2BqofiKC6%2BAjkznbdx5C4uzJk6IHSxJY7kntKAoAlrxbr28PSjQ9xC%2FauBKBnu21vqpLN%2FAsjiAfw%3D%3D\"}]}\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=iso-8859-1\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d85d17c6df50883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":277,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"346cc77f0f657dfedf63eb94336d1ee0","sha1":"ef6b70be12a389bd980d3cfb50520c51ab892b93","sha256":"dd97f464be0eb59a94fb4b02cecaeee0685c67f0318c804f26cfd601ed481ed4","sha512":"59036fdee4444d66e840b1df11ae9afb0e0c0e72a8bcb29b1c56e821781efc91a7881341b56420aa41004e1b9ad499d07c1efd3a84c58c66e8374ae1388d4ddc","ssdeep":"","tlshash":"11d02bde50836287491214a039c625c2374d12f6a43a42a83dc6e4875298d3ecedb59c","first_seen":"2026-03-07T01:28:01.198545Z","last_seen":"2026-03-07T01:38:42.398098Z","times_seen":2,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-desktop.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:36.755Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /solflare-bypass1-desktop.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 07 Mar 2026 01:27:37 GMT\r\nContent-Type: image/gif\r\nContent-Length: 6028322\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"cf5ac8fca45e5d0409fef8923c179975\"\r\nLast-Modified: Fri, 23 Jan 2026 22:54:30 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d85d1973f978be6-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":786432,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"13ec753f0f7ac3f2e09cd8fb3d159fd6","sha1":"fb7c640e5ea1b3eb5af719aec31fe04a971c27db","sha256":"69c12f796a581c42a4dfedd57a615fdc0407867c0ab2577507c6afe5320d5b26","sha512":"79c55e8cc4ba19d93751be035f34ffea46704d06b08da0ee65a013c3bb40a7f3295156bc659db38df831457a65d53ed01bb79812b5903f66de13108d99c85e9a","ssdeep":"12288:WKLOlpdbVhOBbi61VlVP30w5qYO8DgLhC9bxl0zY6+wqzta5YpqXl5M0k+3uJH:WKS1/OBbi61/Vvx5qYONFC9VGM60S15M","tlshash":"b4f433f9941e38c2eb42b5617c2f12219dffb09b487f5fe24b40ba6a23dad4443d9458","first_seen":"2026-02-25T03:05:09.960469Z","last_seen":"2026-03-07T02:01:37.469286Z","times_seen":59,"resource_available":false,"data":null}},"time_used":502,"timings":{"blocked":75,"dns":28,"connect":4,"send":0,"wait":213,"receive":133,"ssl":34},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass1-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/pump1.svg","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.877Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/pump1.svg HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PLKy9KPKAgqqpWVdIxLDfewOzviSBiLNMUpQFbfYvkikITUnW8Olm4HF7R4VSrmqhvGiFlFlEkYA3r4vy3Npw3slref5xHeYpq2th4FH2A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\netag: W/\"a5d-64c1ce4ff5d40\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9d85d171db9f0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2653,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7ac045d44726d3ecd7d70cc10fd98c72","sha1":"d3e2dbb1530f6a00a41c9467e977fb61048ed08d","sha256":"2c72b8e06bbd7be8823c2cce4bbe652ba7a36e35074b8a1b27fd668304816379","sha512":"488d3da62f6ba30a36f8bb106262c3342583a719402680e34ce6d99ba26db1aea5d14496d7427aa39544527a3d5f63a0030d6e32d48e4366e07aacd5db5d12a8","ssdeep":"","tlshash":"395171ff7b5448e5de86c2f8eb2a2adb782a24d97120464193d42f29780176c4d8ac93","first_seen":"2025-11-15T00:25:53.758655Z","last_seen":"2026-08-12T06:39:16.068896Z","times_seen":431,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":77,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/avatar(3).svg","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.894Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/avatar(3).svg HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bjSR4nFm%2FCy2VhxTH4Nun9Whgx6Et01u7zLkulWTFsJPLnXXPeEhXaHdNMAPC41yVEvfHEb26CDa%2BWFqMOOaNAwqJEBkqRMLTx7fuQicsg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\netag: W/\"1ce5-64c1ce4ff5d40\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9d85d171ebae0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7397,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b924fb80999557d555a20275262237fd","sha1":"2ce759dd62b7fd4cf2311920d934aea393f20097","sha256":"68c457f6d0259bbc998407fb2b250a3ed25a60fa8b808b6504df536acb046978","sha512":"05c2e4f93b6152c9eac023c43754bf6171b404c3b666ab1e83da882ee56114f57eca2c32273982febffd1f365151565c919599852519a2ad998b5e617b885b18","ssdeep":"96:PBkngBGD8na5WEWWLYtUPwTdZ3xdZMMyZqSRF2kIki748jkl4mSxdZdKyB:JknT4meFtxxUUKF21ki7LFmtyB","tlshash":"7ce195a2861042bc2d4383accfb291a1371f60eef75a43ecf5b2c371b05a5e5ea45d58","first_seen":"2026-03-03T14:41:54.784173Z","last_seen":"2026-08-04T05:41:38.475898Z","times_seen":90,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/avatar(5).svg","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.897Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/avatar(5).svg HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SSNaZCPfk3pbAnGrJY2QKpwk0uImwF8sqaQYVhsZ8z8YVII8t%2BK8JFFcq6vTVqgVHNPJb2zkQIMMEysPSIyu2tqqW62seaUcaciig8B6%2FA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\netag: W/\"1533-64c1ce4ff5d40\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9d85d171ebb10883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5427,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8df10ace31e9fdbbb04c1edca130f2a9","sha1":"502dfe5ea588c428f0c945a2b716a24cb1cfa9d7","sha256":"ecd386b7226ef5af3d5481cc02660665cb55b4fd976b012daec2ef8954f26291","sha512":"c0c94bf6406b5ba7f9031071eb927d60ca8719b5a359a40520865c7faa3bc930ff276cab07295f25a7820750d7749c18f2bc7f71037aec929b4058eea913c357","ssdeep":"96:PBkngBn04KOvge4uJ/++cyfnDlnRzv45IL80+EHcz:Jkna049XTfne+S","tlshash":"ccb1c872962812ac2c0343fccfe195e6272f61eeba990694f579c772f0039ede946458","first_seen":"2026-03-03T14:41:54.919996Z","last_seen":"2026-08-04T05:41:38.478338Z","times_seen":89,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/logo.png","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:31.201Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/logo.png HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:31 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\netag: \"7d7e-64c1ce4ff5d40\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 32126\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=anJ0EY5IgfYY1b%2FLBkxxwRJ994ckp%2Bla89QLl1kpKPSBsdeB6zTflcQpA2ybm8cvRwuY1G71mbPjAsDEOHWOvoyyI%2FtVEByVGz3ZomnbLg%3D%3D\"}]}\r\ncf-ray: 9d85d1740c480883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32126,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"0336be6feeb4e1d02cc0efca4dc35514","sha1":"2aa6de95ab67da70eaeba513053992c83cfe767c","sha256":"943c48e760ec717f55363835067d501ff4bd6825a29732a18955e141ba536602","sha512":"b3e1d8faa48cc19bb6a8f008a7254e6d988101585595a34848c4592c2126eb45b6ab1892c320af92c89a35e3e16a1b1e910cba7e7fb8c41d37ca436d24084556","ssdeep":"768:WlIJYLr4t4Ecde1XDx+6ofPEkLPF3PGqqy6fpXwj:WlIJYO4E9F+6xkL93+qQ2","tlshash":"65e2ae2ec86ed8646316caa07bfd0fd70c09d2385424b3e62414fdd646a5cd0b9b5efa","first_seen":"2023-11-14T06:42:50Z","last_seen":"2026-08-12T16:46:41.265861Z","times_seen":757,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.reown.com/KHTeka-Light.woff","fqdn":"fonts.reown.com","domain":"reown.com","tld":"com"},"ip":{"addr":"104.20.46.121","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:31.303Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"84d97dd5.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:15:03 GMT","end":"Fri, 08 May 2026 01:14:56 GMT"},"fingerprint":{"sha1":"45:9E:64:A7:5F:5D:4A:08:84:41:1C:19:61:0C:8E:F9:07:F9:39:0A","sha256":"BE:61:71:F6:DB:D0:2F:10:BE:6D:F9:49:68:D6:02:00:7F:0F:E6:E2:EA:25:7E:B2:B4:99:56:B9:98:A3:C0:13"}}},"request":{"raw":"GET /KHTeka-Light.woff HTTP/1.1\r\nHost: fonts.reown.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:31 GMT\r\ncontent-type: application/font-woff\r\ncache-control: public, max-age=31536000, immutable\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nvary: Origin, Accept-Encoding\r\naccess-control-allow-origin: *\r\nlast-modified: Wed, 13 Aug 2025 13:41:57 GMT\r\netag: W/\"c8b441e434443e5317dbd52ced7d2e6c\"\r\ncontent-encoding: br\r\ncf-ray: 9d85d1752bcd76ef-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":60472,"size_decoded":0,"mime_type":"application/font-woff","magic":"Web Open Font Format, TrueType, length 60472, version 0.0","md5":"c8b441e434443e5317dbd52ced7d2e6c","sha1":"8b6f5b0e3d541db54c76c47c931195ceb9026d6e","sha256":"88a2ae5e48febe008bb609679f0aed5928f67812ea621baf377d457fd589ad96","sha512":"0561615f9ee8e935c10b44a10e0a0ea1924920e85da08517753bcf6e79727e5e6220ffcf596ed0a2a98b54dce5aec96a4fd264cfb41919710e4becf24270da3a","ssdeep":"1536:0VyKJVaNbn9d4u3jnVnbFdKs0UggxNSlIyq:0VrQ5ImNH0YgIyq","tlshash":"494301603958ccc8bc96eaf95b2da37d393e322941661401cc8dfdc296a71d7dd4a24d","first_seen":"2025-09-26T22:05:13.226599Z","last_seen":"2026-08-13T04:37:21.360603Z","times_seen":871,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":81,"dns":18,"connect":9,"send":0,"wait":38,"receive":0,"ssl":50},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.reown.com/KHTekaMono-Regular.woff","fqdn":"fonts.reown.com","domain":"reown.com","tld":"com"},"ip":{"addr":"104.20.46.121","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:31.305Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"84d97dd5.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:15:03 GMT","end":"Fri, 08 May 2026 01:14:56 GMT"},"fingerprint":{"sha1":"45:9E:64:A7:5F:5D:4A:08:84:41:1C:19:61:0C:8E:F9:07:F9:39:0A","sha256":"BE:61:71:F6:DB:D0:2F:10:BE:6D:F9:49:68:D6:02:00:7F:0F:E6:E2:EA:25:7E:B2:B4:99:56:B9:98:A3:C0:13"}}},"request":{"raw":"GET /KHTekaMono-Regular.woff HTTP/1.1\r\nHost: fonts.reown.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:31 GMT\r\ncontent-type: application/font-woff\r\ncache-control: public, max-age=31536000, immutable\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\nvary: Origin, Accept-Encoding\r\naccess-control-allow-origin: *\r\nlast-modified: Wed, 13 Aug 2025 13:41:59 GMT\r\netag: W/\"944c37658ddfd015ec2d26ace1d57e62\"\r\ncontent-encoding: br\r\ncf-ray: 9d85d1752bb876ef-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":51936,"size_decoded":0,"mime_type":"application/font-woff","magic":"Web Open Font Format, TrueType, length 51936, version 0.0","md5":"944c37658ddfd015ec2d26ace1d57e62","sha1":"b809229ab132914e716ab1b9863cfaf6696f14e5","sha256":"5a17138e7eb4cdebda94066b8081d3a6f5065bedede63136510877c5a8fd23db","sha512":"8a8cb3e83d9a0353c9ab77c4d40e879b24948abb5f170d1c66507cc2e07f3060d75e6d12829d1cd98d6164875c1080610fb71ca1b75bb559d294eae55741d6c9","ssdeep":"1536:yV/p2LNmMiTXr23hA/g0IRuEWNh5tUp/Coue:y6crGhKxEktaQe","tlshash":"c83302482c1b555343f3a6f21ea869e90f40914b776cef0e9d9ea9a6d0852f4c31c3b7","first_seen":"2025-09-26T22:05:13.143105Z","last_seen":"2026-08-13T04:37:21.358469Z","times_seen":873,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":73,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-desktop.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:36.751Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /phantom-bypass2-desktop.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 07 Mar 2026 01:27:36 GMT\r\nContent-Type: image/gif\r\nContent-Length: 3967947\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"5a6a3867cbfe36845cfc495e5ca7f0ea\"\r\nLast-Modified: Fri, 23 Jan 2026 15:05:42 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d85d1973f998be6-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":786432,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"77c8cf44927733853063e12a9c919838","sha1":"e753f4fab619a4ad9c7e362f7dbca7d28c6af569","sha256":"0a412e42c896359759d6f578d9439fdfa66c8387c55de84440861ea71f463e59","sha512":"23e51c246c2f5f89fb1e53fad2bbba306a23f2a5d708b1b58dd8b8a60a382c9e38d475a7b57e90d617d2f87524659ca3c63da65c0248367925c1f5ab8bb570c6","ssdeep":"12288:VEznytgluvfiMoSnqYsA4Xp8fvndMMr95Hl42YSbZQxiVUSmj3+SSB9WV:avufiMHLszpYKMLHl4XSjC3h+s","tlshash":"8ff423e9846d4c8222510261295a753c2053b03eddf7bc39b1acdf9dc69ee3e8ce91e5","first_seen":"2026-02-25T03:05:09.958112Z","last_seen":"2026-03-07T02:01:37.50279Z","times_seen":62,"resource_available":false,"data":null}},"time_used":494,"timings":{"blocked":79,"dns":32,"connect":1,"send":0,"wait":172,"receive":157,"ssl":42},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/test.png","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.883Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/test.png HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\netag: \"264ff-64c1ce4ff5d40\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 156927\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jrF59JDHvbLK2lv0zZCxWwRdGU5F%2FI3ZLq0uHeGbJwXuc%2BbJq6ngy8n2iHvZf6Bkj0503ZOflCcL7OkRUAUH581mz%2FVKhlN2l7xCJOrXLA%3D%3D\"}]}\r\ncf-ray: 9d85d171eba40883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":156927,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 520 x 338, 8-bit/color RGBA, non-interlaced","md5":"8b88ddfe90a92454917586cf84e586d7","sha1":"d16259399d44dff391f5974adf775fc23bac4169","sha256":"68107e0adc7f8fe9b7ae440668500d9a043e3586f2065f7e13171a164a3d666d","sha512":"b3353539596b0e19ebf70f89b678c7d86813cf24c183a5fcb06bca78fa6b6ad9a374f08a1d507273fe885a037e4c252e143f60abde391ebfabf993622589f1ec","ssdeep":"3072:bUgx4JxoUU0NBICSF+fPHFgYZSViXpf//ulwweQQ2ccE8MaWb9:bUs4JJUiWF+fPHFgYwVYNeS2ZE8sB","tlshash":"eae312f7b49fb86372b5f667d407bf477bf54104d2ba4229de60562020a7e11d328823","first_seen":"2026-03-03T14:41:54.83931Z","last_seen":"2026-08-12T06:39:16.035651Z","times_seen":212,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":111,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/avatar(8).svg","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.901Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/avatar(8).svg HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JXS0USI%2FcZUPU5kog5zmvxQ3g3PDQx%2Fflxe8kg4HJhyw8z782t8kZZhtON6HmgdG1yEAg31ONl0DIbu83Zgydmr0o%2BK2MJJidFmdWRmo0Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\netag: W/\"192d-64c1ce4ff5d40\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9d85d171ebb70883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6445,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0ea9a4bfe98bab82267132825543a883","sha1":"53b466669a49ae73ba8fd625eb34da5e8f96480c","sha256":"ce957be782aee1cad31241a0234e065c0cb1ca410174a1003629d9bfa817612b","sha512":"a1f72dc230629929d1ab21ae1bb9f42b799fe4e1a6500c40b2e3272e431cff1728e09a6f53e33a8653d106d9b17e7bfc1e91aa0a551e13f97180a4c563827cab","ssdeep":"96:PBkngBDDDUqQgIsbNigNWGuge4uJO82nDlnRzv45IL80+EHcn:JknqPWgI828ne+6","tlshash":"a2d1a5619b1846dc2a03c7eccff1e0b2272fa0eeb69a07d4f169c731b4039d9d44a458","first_seen":"2026-03-03T14:41:54.908502Z","last_seen":"2026-07-27T12:15:52.320372Z","times_seen":79,"resource_available":false,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/avatar(10).svg","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.906Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/avatar(10).svg HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7Lye0ICXy4qS5zBC0wmr8FpuTMSwkSz1A60Sw0HAPgqigCJUeGifwIWK0U6CwIO6XP%2FRcnPHCKQTRQH67%2B1ZGKW4OWMIu7XvK6rmvw9S4Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\netag: W/\"e51-64c1ce4ff5d40\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9d85d171fbb90883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3665,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"71cf6bfb417699ecd38e939bd9b27d6e","sha1":"2ca023f1cfef9030fcd133ad31510c330b6baf00","sha256":"430835008581dc43f761ed5d9ec3d0a4506f489f575dac51e5fd06bcb6acb3af","sha512":"4e49a74324f22c35059dc60c2e7996aedd19083b333564bc5b5bb9aba7182ac4648195bd54fc85b38f51935a3f1c5b9aa0aa9a8d348a43bca9e5fcc2a920e26a","ssdeep":"","tlshash":"657175a2b908117c181307f9cbf6d9f6232f61ef34c206a5f9ac8772b016657e94b448","first_seen":"2026-03-03T14:41:54.957301Z","last_seen":"2026-07-27T08:03:09.356024Z","times_seen":78,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.reown.com/KHTeka-Light.woff2","fqdn":"fonts.reown.com","domain":"reown.com","tld":"com"},"ip":{"addr":"104.20.46.121","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:31.301Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"84d97dd5.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 07 Feb 2026 00:15:03 GMT","end":"Fri, 08 May 2026 01:14:56 GMT"},"fingerprint":{"sha1":"45:9E:64:A7:5F:5D:4A:08:84:41:1C:19:61:0C:8E:F9:07:F9:39:0A","sha256":"BE:61:71:F6:DB:D0:2F:10:BE:6D:F9:49:68:D6:02:00:7F:0F:E6:E2:EA:25:7E:B2:B4:99:56:B9:98:A3:C0:13"}}},"request":{"raw":"GET /KHTeka-Light.woff2 HTTP/1.1\r\nHost: fonts.reown.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:31 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 42308\r\ncache-control: public, max-age=31536000, immutable\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\netag: \"5e30cfcb50ec25f79fffffaac2364f7d\"\r\nlast-modified: Wed, 13 Aug 2025 15:26:01 GMT\r\nvary: Origin, Accept-Encoding\r\ncf-ray: 9d85d1752bd176ef-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42308,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 42308, version 1.0","md5":"5e30cfcb50ec25f79fffffaac2364f7d","sha1":"76653a388d2ae80ba98b047a9fa20e02ec460eb0","sha256":"1a42c3e5b778748710613a6f6bd648758d2d8ee02f467d3432ebc36f82b54f84","sha512":"c8c6145cfbaec98627143b7a01df0ee5b215e35b0a3afd1594eff09432eef419b3367006d53ffeafdd19f6a25b4892d15461d055a64c213e3330c1f99e189fbb","ssdeep":"768:TDMkmH7mSCRTgwe651Yt9/+KBR6RGrowfrR0szvT83n0/JhHmR:HdmH7w/e65e9XmRGrRfrR0sbT8inmR","tlshash":"b713f2f61a673ecc22be9e1c16834dd9ad85737d4ad23f1074b8b0c2c27c68968da611","first_seen":"2025-09-26T22:05:13.131598Z","last_seen":"2026-08-13T04:37:21.349138Z","times_seen":867,"resource_available":false,"data":null}},"time_used":218,"timings":{"blocked":83,"dns":22,"connect":1,"send":0,"wait":40,"receive":3,"ssl":59},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/pump1.svg","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:31.389Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/pump1.svg HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:31 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AqLf82aUIRZ80zG%2FPrAoGTlG5%2FQNQASbaE%2FtjjaHYYbTPz6EpLcoUNTCC6U%2FcIv5zL%2Bz8uXXIjeyj6K2tQWfqfg4HNFIw%2B4QFLvV0dl6uw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\netag: W/\"a5d-64c1ce4ff5d40\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncf-ray: 9d85d1753c8d0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2653,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7ac045d44726d3ecd7d70cc10fd98c72","sha1":"d3e2dbb1530f6a00a41c9467e977fb61048ed08d","sha256":"2c72b8e06bbd7be8823c2cce4bbe652ba7a36e35074b8a1b27fd668304816379","sha512":"488d3da62f6ba30a36f8bb106262c3342583a719402680e34ce6d99ba26db1aea5d14496d7427aa39544527a3d5f63a0030d6e32d48e4366e07aacd5db5d12a8","ssdeep":"","tlshash":"395171ff7b5448e5de86c2f8eb2a2adb782a24d97120464193d42f29780176c4d8ac93","first_seen":"2025-11-15T00:25:53.758655Z","last_seen":"2026-08-12T06:39:16.068896Z","times_seen":431,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-desktop.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:36.745Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /phantom-bypass1-desktop.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 07 Mar 2026 01:27:36 GMT\r\nContent-Type: image/gif\r\nContent-Length: 2031700\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"a22dc9face81ff1665651f1052a0a99f\"\r\nLast-Modified: Fri, 23 Jan 2026 22:55:18 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d85d1973d83b28a-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":786432,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"eeebcd74061a9dcd7dfad338ebe1d46a","sha1":"23148fe8cd0cfe6b4379103d03dabde517e9bfd9","sha256":"631978ce1c77fdc8360949130dc08a761d8a5cbf0b87875b7b1556706cabc068","sha512":"e151fd7805ccbf649173ed454739604bbb31cbd0daa1dbf057454363c74532c9a5c2310e516f087f21ef09e5cd7de46e91d67e01815274b82573caae494eff45","ssdeep":"12288:/2TA4vVLmF/WbRkFOppRWsWNbGSQHJAUOUsLOsWZssG5bxVWhseThDII57tSKnXb:/2TAaRkFipRWRSlpAzUWOsWWvbLqhDVr","tlshash":"41f4233ac26c0681a9a500112e6526604c337cbc54feea3383eddf3adb5b92d6da5295","first_seen":"2026-02-25T03:05:09.955526Z","last_seen":"2026-03-07T02:01:37.494267Z","times_seen":63,"resource_available":false,"data":null}},"time_used":461,"timings":{"blocked":83,"dns":35,"connect":1,"send":0,"wait":138,"receive":153,"ssl":47},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass1-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-mobile.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:36.754Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /phantom-bypass2-mobile.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 07 Mar 2026 01:27:36 GMT\r\nContent-Type: image/gif\r\nContent-Length: 3967947\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"5a6a3867cbfe36845cfc495e5ca7f0ea\"\r\nLast-Modified: Fri, 23 Jan 2026 15:28:10 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d85d1973835c272-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":786432,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"77c8cf44927733853063e12a9c919838","sha1":"e753f4fab619a4ad9c7e362f7dbca7d28c6af569","sha256":"0a412e42c896359759d6f578d9439fdfa66c8387c55de84440861ea71f463e59","sha512":"23e51c246c2f5f89fb1e53fad2bbba306a23f2a5d708b1b58dd8b8a60a382c9e38d475a7b57e90d617d2f87524659ca3c63da65c0248367925c1f5ab8bb570c6","ssdeep":"12288:VEznytgluvfiMoSnqYsA4Xp8fvndMMr95Hl42YSbZQxiVUSmj3+SSB9WV:avufiMHLszpYKMLHl4XSjC3h+s","tlshash":"8ff423e9846d4c8222510261295a753c2053b03eddf7bc39b1acdf9dc69ee3e8ce91e5","first_seen":"2026-02-25T03:05:09.958112Z","last_seen":"2026-03-07T02:01:37.50279Z","times_seen":62,"resource_available":false,"data":null}},"time_used":399,"timings":{"blocked":76,"dns":29,"connect":4,"send":0,"wait":136,"receive":106,"ssl":36},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/phantom-bypass2-mobile.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-07T01:27:30.554Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\ncache-control: no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\nexpires: Thu, 01 Jan 1970 00:00:00 GMT\r\ncdn-cache-control: no-store\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FsP4LQFXm%2BC1r949XtpzO3Q74AGPdPTS0O2vhJLb2scG3v9apM2qAYHsKxtCGx9nCqnJXk8KJn7I4o7FpVj3jXvuYeMhnvIkFLaaVzLOqQ%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9d85d1703c8023eb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":107952,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (862)","md5":"becdb747adfb803790efa740d83182b1","sha1":"fbf69e41bcd983f2d3d6baf98a2c08f6c7ff5c67","sha256":"c22bfd2b26a373b859470bfa8605548b12eb398cc14a9778ff2ec4ee22006f3b","sha512":"30689905330f635d231177e573c83387f08943ecc019ab54ca6565c8e1f6296ed82531ef2f696b7643d91ec5e9455c3b9c6c0d68655c5178dd31690abe30675e","ssdeep":"768:nOCMO4vdmYKDGAsgkYuYlLGEvu1p1wzqcd+FKfFz1q4BKHm/Y8HtSSQ/pAHw5x+1:nAgnLGEvuD1wzqcd+bmnHSFLf2mzxBm","tlshash":"a7b3866062f1167e205783e4bab2b72f6a58e397d61bd50cb2bc42d11f8bcc5cd53298","first_seen":"2026-03-03T14:41:54.892538Z","last_seen":"2026-04-18T14:19:22.247817Z","times_seen":20,"resource_available":false,"data":null}},"time_used":164,"timings":{"blocked":39,"dns":24,"connect":2,"send":0,"wait":83,"receive":0,"ssl":13},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/test3.png","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.890Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/test3.png HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\netag: \"1cabc-64c1ce4ff5d40\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 117436\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DrbBJtPngFPHDERVFSOk%2BzcYkGuX3wx%2BYLVwpFiF%2B1b8R%2FV4i%2BYb8fj3BY8U94Ywgycpx5%2BBkXRht9a%2BfnroG6zKSS7Vi3iJtvRLAggRCw%3D%3D\"}]}\r\ncf-ray: 9d85d171eba90883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":117436,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 418 x 235, 8-bit/color RGBA, non-interlaced","md5":"54056261002caa913cf0d3734aba1ca8","sha1":"b3c16bbe38282e428fe39c68849fff64f2516354","sha256":"e2ed16081ffc8bf7ce3e532c3c6411d0ae0e743f97f8b50f177435d5106a399e","sha512":"4b7a6b504ee676e47441aafc72bb14f40e859621faa56ef1c03f9e162e7334aa6dcd02c38aa955258b9743a5327dd2b3102262b00d3e4ddd9c12baf473f7909e","ssdeep":"3072:/Hks+B/jZmi9GwJqbGh8mqBeOTAVxFIx7RIyqi1xW1qX/v:B+B/jQwJqbGh8RBeOcVxFIxJI1qX/v","tlshash":"68b3128f922c0851dfc72b45e361f86abc33392257ea6b62917d487700ccc7546ad62c","first_seen":"2026-03-03T14:41:54.917407Z","last_seen":"2026-08-12T06:39:16.061633Z","times_seen":212,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":100,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/avatar(6).svg","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.898Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/avatar(6).svg HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vQnLKERTGsljEgJLz7sDrngEGDU%2BCcVbxhpUOxpqFZf8bqp0iXa4rrwdHUQb86DgVOV6%2FF8CLWGGHYHKUr6c5jvIF%2FjVLcGQXaB5Hz8UJA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\netag: W/\"12f7-64c1ce4ff5d40\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9d85d171ebb30883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4855,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a9f044a906d168b213e7e73ee37db973","sha1":"6948c448395dd2ef74b04ab91a1bdb74e1b04ee9","sha256":"975fb77e516bfeaad1aa3fe1150ef151672629aff5c1d2cf3f7a77da9aed3305","sha512":"ab7a54a39fc96f871e58df6abd9d5ad63b550b7f9b256de71f30bd268f60aafb8f77e14b9dc7e86d87327d77236e0b7512249da12d60d9e997958c8b7e58f1e5","ssdeep":"96:PBkngBnqbB3xoNpLHF4XbPkWZqSRF2kIki748jkl4mSxdZEKyB:JknavbHFMUKF21ki7LFmOyB","tlshash":"10a1a5b25a44157c288303bdcff5a1b1332f61ee7a5606e8b478c771f016ae6c94b998","first_seen":"2026-03-03T14:41:54.921996Z","last_seen":"2026-08-04T05:41:38.502396Z","times_seen":90,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":77,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/avatar(9).svg","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.905Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/avatar(9).svg HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b0hisrPVYNReUe5B%2FPnKEnD3A98kV4PeTd7NoQ2hKwEtAyJ3pS1Y0VD2TRHM4ZiQn%2Bm8%2FU0QP%2BvrlSLUzNL588FN8ZsrKk2W4uNG0dqqtQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\netag: W/\"f2e-64c1ce4ff5d40\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9d85d171fbb80883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3886,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f5bb103a9cb785c5a65fdcece3403c95","sha1":"29638d23bda212e5868b0c8c4dceed6a2523d0e3","sha256":"0c6609f85bae03c61eaf9b65e38a8e81791d59d3ba0e465e7f6d079ea191c58d","sha512":"a235117c71aeb30bfe4187981456f6d5672ccf1f3fbecbfdbfff419cb519e59dbd5889f2731130566f7508f71f9539b1885d2eda5f01c65482f8087dce980154","ssdeep":"","tlshash":"b08176a25b58006c240203f9caf5b4b6373f71de75d40684bdbc8772b4426afc887959","first_seen":"2026-03-03T14:41:54.826694Z","last_seen":"2026-07-27T12:15:52.374155Z","times_seen":73,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/api/v2/handshake","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:34.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"POST /api/v2/handshake HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/octet-stream\r\nContent-Length: 71\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Sat, 07 Mar 2026 01:27:34 GMT\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sY08BlOs%2B0lHqsQa0x9dtvqhjGfZr32vPyoF%2FuPvzyidAxi2U0ERZfAh%2BSWdJwinNt6PeWjfGdkMKA0%2BP%2BgsVGyWwxUawMkppaMXrrYXmQ%3D%3D\"}]}\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=iso-8859-1\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d85d1896feb0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":277,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"346cc77f0f657dfedf63eb94336d1ee0","sha1":"ef6b70be12a389bd980d3cfb50520c51ab892b93","sha256":"dd97f464be0eb59a94fb4b02cecaeee0685c67f0318c804f26cfd601ed481ed4","sha512":"59036fdee4444d66e840b1df11ae9afb0e0c0e72a8bcb29b1c56e821781efc91a7881341b56420aa41004e1b9ad499d07c1efd3a84c58c66e8374ae1388d4ddc","ssdeep":"","tlshash":"11d02bde50836287491214a039c625c2374d12f6a43a42a83dc6e4875298d3ecedb59c","first_seen":"2026-03-07T01:28:01.198545Z","last_seen":"2026-03-07T01:38:42.398098Z","times_seen":2,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-desktop.gif","fqdn":"pub-14c1504681d2427684ac1f489338d075.r2.dev","domain":"pub-14c1504681d2427684ac1f489338d075.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/assets/demo.html","date":"2026-03-07T01:27:36.757Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 08:27:13 GMT","end":"Tue, 14 Apr 2026 08:27:12 GMT"},"fingerprint":{"sha1":"8E:B1:C6:1C:4F:29:20:20:9B:A5:D6:9D:E1:36:5C:9E:97:FB:1D:39","sha256":"37:AE:3E:49:CD:79:B6:64:E2:E2:D7:10:C5:42:B8:60:97:C4:95:B7:D1:0F:FE:B7:2D:84:F2:DC:70:4E:53:C2"}}},"request":{"raw":"GET /solflare-bypass2-desktop.gif HTTP/1.1\r\nHost: pub-14c1504681d2427684ac1f489338d075.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://xn--pnp-doa.fun\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 07 Mar 2026 01:27:37 GMT\r\nContent-Type: image/gif\r\nContent-Length: 8319275\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"ffdbd9550fb16af66a8cf7717da03833\"\r\nLast-Modified: Fri, 23 Jan 2026 22:06:40 GMT\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nCF-RAY: 9d85d19888c82efa-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":786432,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 480 x 807","md5":"589dfc1cda320239b5ffa144fbc72c39","sha1":"bc905d626cc383b1c3e161d585df3a667164c927","sha256":"3ed7ae1939c55ffa191a3d546b810f7d83dae59763af66f696ea8c793aa64128","sha512":"c802caae51ba658070a7a46765e5a6bf8d6d4d7a3d264cfe5b7d13794f087536e4fb417240cb646133ab4d8a83d6823d19e88a2ed0e6ae4510d2aa1bdedf936c","ssdeep":"12288:bw+YEyoNI/qVAQPiktG7xzVnTRZQ7UarysToF0O4aNwT5+8YI7r8CUBJGszdI:bDYQNB1s7x5nT9wysI0jlfn8CUBJRzdI","tlshash":"2bf423b8e03c5657d6a62025391d27c0bde7e0299cfe7d3233c898218bdb5bd1d58a1e","first_seen":"2026-02-25T03:05:09.974212Z","last_seen":"2026-03-07T02:01:37.473104Z","times_seen":25,"resource_available":false,"data":null}},"time_used":452,"timings":{"blocked":225,"dns":1,"connect":19,"send":0,"wait":123,"receive":42,"ssl":39},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","trigger":"pub-14c1504681d2427684ac1f489338d075.r2.dev/solflare-bypass2-desktop.gif","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2020-07-02","description":"Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type","reference":"https://en.wikipedia.org/wiki/GIF","rule":"SUSP_GIF_Anomalies","score":"60"}}],"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/avatar.svg","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.882Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/avatar.svg HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oq9bsj1YEeXdyHq5thsJ6g3YeS86z1VtkBPdBb%2FiOnAB6DpODETtKJKrtuh57GHoO0DyACISX1LoDjJ8QELCu9NUrBVCtnaPM8jL2XzsKg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\netag: W/\"5e6-64c1ce4ff5d40\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9d85d171eba30883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1510,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"18f2fc17ac77fdb973466f124e9ca122","sha1":"68bd6731ed959e1f5dd949626815666e064cffbc","sha256":"b7db6ed11802cefd01a512022a780eb7e2ab34afce94b067af05b000ef74cb65","sha512":"087911d6fc6b0a530a89cfb6f9ef34bc887d37a4a3dec5252e287ccd786eca0fc9a0fa7b48a143c18ec086b3844476b201616d5a96e7321736f92a178fd4790b","ssdeep":"","tlshash":"4d31c29574496822170786a3fefcbd5f403322ef96c540dab9c22853e0b62df1f54b69","first_seen":"2026-03-03T14:41:54.789024Z","last_seen":"2026-07-21T02:09:16.176126Z","times_seen":90,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/test2.png","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.888Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/test2.png HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\netag: \"1e2d6-64c1ce4ff5d40\"\r\naccept-ranges: bytes\r\npriority: u=4,i=?0\r\ncontent-length: 123606\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: image/png\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1XBPDx4ciVrF3Xg1OG0Dz9qZNeHvSGetdXnSmjqXhYxLec70TEjRvfg2M0xfs3k8UdzqHEI0HQ038REcneWaCZsW2dwXdCfGP4buHcp46Q%3D%3D\"}]}\r\ncf-ray: 9d85d171eba80883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":123606,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 513 x 288, 8-bit/color RGBA, non-interlaced","md5":"5b268b59a7ec8a34180e24d3e7ef9387","sha1":"3019ae3aeaf4c4eebe8e261c57894f1a6309bb1c","sha256":"ee8c2dfea7112fa4eea9fec1500268b0f4ea3902c5da8a7d1d5505413f706f51","sha512":"172f886359ed2fcf5b449e43b5f0881c1ab3a7d404a5e3be5ee8c695986b2648d834b69d0b54f55583d0e60deb5a8971aceded086124cf7a6d981f71a66f6823","ssdeep":"3072:2D3VW7DXf8fVcnArfigfgmB17WRRiTo16HV526eHV:6gPXkmnKXiGdHL26oV","tlshash":"9dc312cac17801c7eac5357427dd344ee8acb5271545be730d12e3dd14b2c946abbe2a","first_seen":"2026-03-03T14:41:54.857487Z","last_seen":"2026-08-12T06:39:16.06097Z","times_seen":211,"resource_available":false,"data":null}},"time_used":185,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":106,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/demo.html","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:31.013Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/demo.html HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:31 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\ncontent-type: text/html\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lhf8D1tarp0lM7idogy5ARExWl32oAj3D97jzBsq0xVB8coJizWJQnOg%2BMHo19jiZ6oxghoj70d0D1GOpRC%2BB3Ut6KftFyJrXGaDNup9cw%3D%3D\"}]}\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\ncf-ray: 9d85d172dc1b0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2866601,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (33714)","md5":"081de41f2ca6a28c8f03d16a554f4e07","sha1":"1ebbf100b4f1386b086d610a478f7740ea3bb8e8","sha256":"99b15b0584cbedc55021a0b65d25cca6f6c14e8cb1552120ad39819d5f2127e9","sha512":"9e7b712eaffcd570263b6f616e9407f9a6cbc3fcf0e74021547254ba12c7b376b8011d6b2665231143eac127a51b29871898fbf9f2d7bd9b1bfaee222c3ce2f8","ssdeep":"12288:n44LZxNuaZYNUIFPfLUlKY4Ue+jFy1rq6c5249AZQmYN8Ge5CK3i/R0u4gpJo:n4cZxtaUFBE1r5c52aAZSu3iZ0uTJo","tlshash":"42256cb073a1b07a03eb93d594661100f334941a700d84acfbaca9eb6f959cf957af35","first_seen":"2026-03-03T14:41:54.929999Z","last_seen":"2026-06-01T09:54:50.002646Z","times_seen":38,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":166,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/noir.js","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.872Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/noir.js HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Yiasx2P1GR5dS8etcGGWMXyenRUs5W3uRRjOTDIyMcPMMO8WFbiS%2F2OetN5D2rVs0tyjl28PAx5ySLM%2FaKBaDYMDOGWkxYTNCPOSB6K2kA%3D%3D\"}]}\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=iso-8859-1\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d85d171db9c0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":277,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"346cc77f0f657dfedf63eb94336d1ee0","sha1":"ef6b70be12a389bd980d3cfb50520c51ab892b93","sha256":"dd97f464be0eb59a94fb4b02cecaeee0685c67f0318c804f26cfd601ed481ed4","sha512":"59036fdee4444d66e840b1df11ae9afb0e0c0e72a8bcb29b1c56e821781efc91a7881341b56420aa41004e1b9ad499d07c1efd3a84c58c66e8374ae1388d4ddc","ssdeep":"","tlshash":"11d02bde50836287491214a039c625c2374d12f6a43a42a83dc6e4875298d3ecedb59c","first_seen":"2026-03-07T01:28:01.198545Z","last_seen":"2026-03-07T01:38:42.398098Z","times_seen":2,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":82,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xn--pnp-doa.fun/assets/avatar(2).svg","fqdn":"xn--pnp-doa.fun","domain":"xn--pnp-doa.fun","tld":"fun"},"ip":{"addr":"172.67.223.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xn--pnp-doa.fun/","date":"2026-03-07T01:27:30.893Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xn--pnp-doa.fun","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 05 Mar 2026 15:18:43 GMT","end":"Wed, 03 Jun 2026 15:18:42 GMT"},"fingerprint":{"sha1":"DC:D0:1A:CB:E5:17:DA:F6:2A:32:33:F9:D0:FF:5F:CD:5F:9C:1F:86","sha256":"49:09:94:04:3B:40:74:64:F4:05:8A:C0:27:B3:B6:BE:68:89:E1:AE:4F:45:45:B8:A0:A4:51:D2:6F:B7:8F:5D"}}},"request":{"raw":"GET /assets/avatar(2).svg HTTP/1.1\r\nHost: xn--pnp-doa.fun\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xn--pnp-doa.fun/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 07 Mar 2026 01:27:30 GMT\r\nserver: cloudflare\r\nlast-modified: Tue, 03 Mar 2026 11:20:45 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2B6%2Fo5DLtWCjE%2FErIXSq4nQpcuHCzOwmJcFER%2BCxM%2Bisdb3H2EZFsjLlDYIDg2rY4l8STB47v6hFw6fF7yHtTFWGXjIyz8zzJsHfGpSRUBQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\netag: W/\"1381-64c1ce4ff5d40\"\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncf-ray: 9d85d171ebab0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4993,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"93033a35a53a18e395cc861575b9295f","sha1":"0775ae13f1815ca235ca586b0c2b9c53e2449559","sha256":"2fdd1b66e3c5ee6a7016ff00a4d2d2c61907f2bc8830b16ddfacb30c093136e1","sha512":"813f1a08b8f6d8a0b2c02f6908cb051f0c29a77cb2cde91bbb00d862229f6859fe3e9d2b38c214debdf99751d314fbf54a0de3d3899db04202e259e78ca123cb","ssdeep":"96:PBkngBtXbZQWEge4uJv8UUk6Fwp8OBrfrZU:JknMXbZuXU0tZU","tlshash":"65a1a752596c116c240387fdcbeae0a1233fa0fe75550eb1b9acc773b4075aee847898","first_seen":"2026-03-03T14:41:54.798497Z","last_seen":"2026-08-04T05:41:38.474099Z","times_seen":90,"resource_available":false,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}