{"report_id":"dfe7a110-a88b-496b-aecd-fb4f6f491380","version":6,"status":"done","tags":[],"date":"2026-01-07T13:23:18Z","url":{"schema":"https","addr":"preallocation-cascade.com/","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"preallocation-cascade.com/","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"title":"Cascade","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-02T12:58:27.46376Z","times_seen":17672601,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"preallocation-cascade.com/","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-11T13:23:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-01-07","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"preallocation-cascade.com/","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-01-07","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"preallocation-cascade.com/orion.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"preallocation-cascade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"preallocation-cascade.com","ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":13,"request_count":12,"received_data":6411246,"sent_data":5634,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cascade.xyz","ip":{"addr":"104.26.14.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-12-23","domain_rank":0,"first_seen":"2026-01-02T19:31:55.089846Z","last_seen":"2026-01-02T19:31:55.089846Z","alert_count":0,"request_count":6,"received_data":1790095,"sent_data":3209,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"preallocation-cascade.com/7bafaa2a-86cc-493e-a6b6-6540ee77f99b","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec26a722169cb2cef03353fcf8dd144a","sha1":"6eec6673abcde3d29547796a38361256d9efde1c","sha256":"01861fcd47bc63bb7be76c480bad4c6cc987c8996ab0e023a4e692b68c94b05c","sha512":"c885e5d94bd96fa4a573524356e0ca7398b1489f5a39fc1120cf7f4e469950630ad3e9f48dd0392acd36da390c27a4be1e81da943d1d9ecd48890d1691e416cf","ssdeep":"6144:Ufg7z90bnvLZqnWTI9esVTMuyEvtzXNglxQP92L:VzBe6kEdOxQoL","tlshash":"bf740980b261b07247da24e10477540af339e96c744a40acf6a8d8fb7dbd589957ff38","size":357754,"data":"","first_seen":"2025-07-12T22:38:09.13306Z","last_seen":"2026-06-28T16:47:47.454007Z","times_seen":5087,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preallocation-cascade.com/","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"e7cedee5f4aabfe0f0a25596641b0073","sha1":"9e90df4076abbd3350295826c5ad3ec1856ffd56","sha256":"c2e60dc68f09c70895f8cb98a4a88e16cf3c691d5a96b9c93c3aab931eafc258","sha512":"17dc0e86fcd7af709d5ffb50d255169d2300566d30c2da4345505703e6a6ebf303df263db9561688753bc03af86b134ccfa9f763966f8612ef554be796d6c025","ssdeep":"1536:jQe6pw4biVcuVXdWAgB1PusH2DY7sX3lX56oH:Me6KBVcuVtWAgR2Do2X6oH","tlshash":"7fa340d59a4bd0e08e5a11edd077ed0ae0281aa3cdacf193b92cded1355df22c84753a","size":104467,"data":"","first_seen":"2026-01-07T13:23:26.460119Z","last_seen":"2026-02-14T09:07:38.76649Z","times_seen":45,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-01-07","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"preallocation-cascade.com/","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}}],"urlquery":null}},{"url":{"schema":"https","addr":"preallocation-cascade.com/orion.js","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8256cac1bd4bdcddf5d245ee81fcc52e","sha1":"9a6dedf90a6703f3b2f4cdaecff3226bf689d201","sha256":"ab8c63dd12dd03136ccd032e5b3884c3d6fe72a9a36d8bca6bf99434332dd3bc","sha512":"2a46c67ddb2cb0c7680f68bd4d0e622ead7cc38a0c8034cade6f7bbde1a5c7c4bdce17e489646a28af1126b87c1f525d723f2592bacb4fff47001ab15727965c","ssdeep":"1536:9kaRasaz1dd527mjiIs113usHqBYLsVFX5saB:9kaRcz732aiIsVqBMs5saB","tlshash":"37b340d6594bd0d58e1a10edd077ec09e0681aa3cdacf183ba2cded2755df22884763b","size":107989,"data":"","first_seen":"2026-01-07T13:23:26.426463Z","last_seen":"2026-02-14T09:07:38.758383Z","times_seen":45,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-01-07","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"preallocation-cascade.com/orion.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}}],"urlquery":null}},{"url":{"schema":"https","addr":"preallocation-cascade.com/","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"2fbedb0b3347993aaffda511427d5ef7","sha1":"e20ab6a72f14d0d94e111b2f7b05c3260c936a07","sha256":"0d5314efb310b706bb73a055d0863a287a2636eb5e9eceae221a74a5895a94ec","sha512":"252650d07bdc4223ba829bba1298a0effa6d343cbc58d9651350bb49138d3baa710235fbc428fbc8f5b783f8531f4527b67751143b72a75790efe8f217e525b2","ssdeep":"","tlshash":"ce01f65d27f332b9627f2162d2038489be50506370dadc49741c91894fd6e6464de69a","size":657,"data":"","first_seen":"2025-06-07T13:25:17.713531Z","last_seen":"2026-02-14T08:22:12.898758Z","times_seen":117,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"preallocation-cascade.com/variant-light.svg","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:56.667Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"preallocation-cascade.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 16:48:10 GMT","end":"Mon, 06 Apr 2026 17:46:34 GMT"},"fingerprint":{"sha1":"A1:D4:92:91:60:6B:9B:E5:53:26:75:46:93:4A:81:37:FA:E5:6E:C2","sha256":"BF:1C:AC:05:5D:68:8E:0C:FB:2D:8C:B2:F6:45:AB:DD:D2:6A:CC:E9:4F:35:6C:47:91:7C:77:CC:A6:73:D5:D4"}}},"request":{"raw":"GET /variant-light.svg HTTP/1.1\r\nHost: preallocation-cascade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 13:22:56 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 17:45:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"695d4a40-1bad\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0xghcJ067SUMEzEjs9aKYwV8YhY7vkC%2F7rWm9E%2F3HuvXpyaEVuAZ9n0xGa17s7ruoY39rNifJyvg768Bf48GfqQD6gRefOcz1ssX6y1kQl9fbUhYa1BBabo%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9ba3c4502bb28deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7085,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e383261345387db502ade999cac76204","sha1":"268e4120297a3fa928bf6d6d7f230052edbbde33","sha256":"4db5c3430e3d56e9eeb062341d44b4fbcd9b50b66a677a2e6d72c29b80734f7d","sha512":"7b7fd47badebb60b4a74015d6591a1f2c6d4e7fb5ce987b1a727c35cb5513a1d9a25a90d737a453855a65c1a5cb551decc3c6fd226f56e0f9976cc13c7f4d5ef","ssdeep":"192:ybo/a4H9bSf+lGFhfMpfuIpd1wbQdVTIqV1:ni4H9JGOuYd13sqL","tlshash":"7ee1c5f153d4b2f4e642fb39c92114b17aea38fabbd65704c280cb92b061045aecdce5","first_seen":"2026-01-07T13:23:26.40381Z","last_seen":"2026-03-28T00:19:51.296378Z","times_seen":35,"resource_available":false,"data":null}},"time_used":253,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"preallocation-cascade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"preallocation-cascade.com/auros-light.svg","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:56.670Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"preallocation-cascade.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 16:48:10 GMT","end":"Mon, 06 Apr 2026 17:46:34 GMT"},"fingerprint":{"sha1":"A1:D4:92:91:60:6B:9B:E5:53:26:75:46:93:4A:81:37:FA:E5:6E:C2","sha256":"BF:1C:AC:05:5D:68:8E:0C:FB:2D:8C:B2:F6:45:AB:DD:D2:6A:CC:E9:4F:35:6C:47:91:7C:77:CC:A6:73:D5:D4"}}},"request":{"raw":"GET /auros-light.svg HTTP/1.1\r\nHost: preallocation-cascade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 13:22:56 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 17:45:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"695d4a40-a1d\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jqn%2Bz1FMC63gEmZlTey40D8VXFjmG5ZkGYnLDgTZku5rt5IZUuf0xMcobUP38pSy%2BeNFxmMTcF%2FmmBZvs3rn%2FZgSLI1LoZMkudO0QIclYGAbT%2FnEBpzSIW4%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9ba3c4502bb38deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2589,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e0510a364b68e62f1595f35ee2d00290","sha1":"7621fd0fcda8017748b3cf1484f69680212a7bac","sha256":"6d0223dcd9b582a0777582f7c9a76e5e75a00d08fd52ea270b878b41bc2c559b","sha512":"17f48f15b5239bab3776a483c980cd1ecc041567d84933ebc017ac6aab4185cf859c9fdec220c6e3b4d1bfdec9864c62960c2ecdc899dcc6c1177379e13ffc5a","ssdeep":"","tlshash":"185175f132b8f2c56805f72d1f397868a21b24ff6ac20588d642e91a6c491d61ec1cfa","first_seen":"2026-01-07T13:23:26.408846Z","last_seen":"2026-03-28T00:19:51.291936Z","times_seen":36,"resource_available":false,"data":null}},"time_used":241,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":239,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"preallocation-cascade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"preallocation-cascade.com/archetype-light.svg","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:56.675Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"preallocation-cascade.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 16:48:10 GMT","end":"Mon, 06 Apr 2026 17:46:34 GMT"},"fingerprint":{"sha1":"A1:D4:92:91:60:6B:9B:E5:53:26:75:46:93:4A:81:37:FA:E5:6E:C2","sha256":"BF:1C:AC:05:5D:68:8E:0C:FB:2D:8C:B2:F6:45:AB:DD:D2:6A:CC:E9:4F:35:6C:47:91:7C:77:CC:A6:73:D5:D4"}}},"request":{"raw":"GET /archetype-light.svg HTTP/1.1\r\nHost: preallocation-cascade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 13:22:56 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 17:45:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"695d4a40-913\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bxzc2HxHute2ceHmNi2OmFkcBXRELtQ6UmTmU4Krxn0OpFKyQ2QByeWLBEyT4vS2%2F5xAMAAu08ASVgZIHGpZKo1NXXl%2F9ne5NUWuFfH2ORtPNlNVVqSNCSg%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9ba3c4502bb58deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2323,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e883f4732c81b06a0642fb35625dcccd","sha1":"583e411ee2fe2663de203b0b690ca24a4c2b15a3","sha256":"7664131acc910340bb15e81825b3591defd8dd69a2b82092fe8f0e59a611e288","sha512":"8735fa012c0585bdbdc191b89e523d8b62cdf234722103c075840b10e90a8345f0f6e8d669f6f3940e330f4b5ec24af94eaf906e66a211216a785b2119f15eb7","ssdeep":"","tlshash":"c341456562c084d9da4dabdc2805dcf679335cdc376edfcd86c72b55751904c101ed8a","first_seen":"2026-01-07T13:23:26.41508Z","last_seen":"2026-03-28T00:19:51.280425Z","times_seen":35,"resource_available":false,"data":null}},"time_used":252,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":252,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"preallocation-cascade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"preallocation-cascade.com/","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-07T13:22:55.566Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"preallocation-cascade.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 16:48:10 GMT","end":"Mon, 06 Apr 2026 17:46:34 GMT"},"fingerprint":{"sha1":"A1:D4:92:91:60:6B:9B:E5:53:26:75:46:93:4A:81:37:FA:E5:6E:C2","sha256":"BF:1C:AC:05:5D:68:8E:0C:FB:2D:8C:B2:F6:45:AB:DD:D2:6A:CC:E9:4F:35:6C:47:91:7C:77:CC:A6:73:D5:D4"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: preallocation-cascade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 07 Jan 2026 13:22:55 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 17:45:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BQvX66H2WWI22qWjRXDy6Mrjdva5NxHRnUdT8ubi0%2FDGUrRq5V9VL7SQIcqsSQ%2BANubu7Uy5ochCKxhEmQKXQFq8uq5teOH27USnrMzW4k75gFK2jtRKZrk%3D\"}]}\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9ba3c449b955b1b8-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24574,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5913)","md5":"74e0fcd571bce1ef9d1d748e408a1506","sha1":"42b224dd9a466bfb265a346106017a62941d2719","sha256":"d53ccec6a5b94a17fadb98b5416b69164f62d267e5866c494e2fbd495d157abf","sha512":"c17d881a88ab504a5007a1a97ec257102defcc0a4bba767101a8272f1236d3704420576d071d8288b65f46d8c7d3c8fb154b25138ef392dcdc342f1ce5b8f677","ssdeep":"384:rzNYhUqQbIdBrm/B34Sem7ISrIGK2k2dTohx/sZilmMGUoMLM:rz7ICXTohx/uKm4o1","tlshash":"13b20cd0e532101a961b412bf3e7ef4712589e03c91befa4bbcde1918f855859eb3728","first_seen":"2026-01-07T13:23:26.422536Z","last_seen":"2026-02-13T19:37:59.463961Z","times_seen":4,"resource_available":false,"data":null}},"time_used":416,"timings":{"blocked":75,"dns":59,"connect":1,"send":0,"wait":262,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"preallocation-cascade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"preallocation-cascade.com/orion.js","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:56.100Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"preallocation-cascade.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 16:48:10 GMT","end":"Mon, 06 Apr 2026 17:46:34 GMT"},"fingerprint":{"sha1":"A1:D4:92:91:60:6B:9B:E5:53:26:75:46:93:4A:81:37:FA:E5:6E:C2","sha256":"BF:1C:AC:05:5D:68:8E:0C:FB:2D:8C:B2:F6:45:AB:DD:D2:6A:CC:E9:4F:35:6C:47:91:7C:77:CC:A6:73:D5:D4"}}},"request":{"raw":"GET /orion.js HTTP/1.1\r\nHost: preallocation-cascade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 13:22:56 GMT\r\ncontent-type: application/javascript\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 17:45:36 GMT\r\netag: W/\"695d4a40-1a5d5\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mFYekHSYVmkNjvar8lSg6PTpNbi2EHDqnwIX4Ks8KMnPiqD530qBzLz3OU9uDhlyjCRWlBf%2BXxoPgowYuMIHnByxilppLc9dwAi6lB1pKTM5OhPJaalzndY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9ba3c44c9afd8deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":107989,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"8256cac1bd4bdcddf5d245ee81fcc52e","sha1":"9a6dedf90a6703f3b2f4cdaecff3226bf689d201","sha256":"ab8c63dd12dd03136ccd032e5b3884c3d6fe72a9a36d8bca6bf99434332dd3bc","sha512":"2a46c67ddb2cb0c7680f68bd4d0e622ead7cc38a0c8034cade6f7bbde1a5c7c4bdce17e489646a28af1126b87c1f525d723f2592bacb4fff47001ab15727965c","ssdeep":"1536:9kaRasaz1dd527mjiIs113usHqBYLsVFX5saB:9kaRcz732aiIsVqBMs5saB","tlshash":"37b340d6594bd0d58e1a10edd077ec09e0681aa3cdacf183ba2cded2755df22884763b","first_seen":"2026-01-07T13:23:26.426463Z","last_seen":"2026-02-14T09:07:38.758383Z","times_seen":45,"resource_available":true,"data":null}},"time_used":310,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":265,"receive":45,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-01-07","alert":"PHP webshell using some kind of eval with encoded blob to decode","trigger":"preallocation-cascade.com/orion.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Arnim Rupp","date":"2021/02/07","description":"PHP webshell using some kind of eval with encoded blob to decode","hash":"1d4b374d284c12db881ba42ee63ebce2759e0b14","license":"Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE","rule":"webshell_php_encoded_big","score":"50"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"preallocation-cascade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cascade.xyz/_next/static/media/06ba6ef833b337bc-s.p.0faac26c.woff2","fqdn":"cascade.xyz","domain":"cascade.xyz","tld":"xyz"},"ip":{"addr":"104.26.14.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:56.653Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cascade.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 01:03:31 GMT","end":"Fri, 03 Apr 2026 02:03:29 GMT"},"fingerprint":{"sha1":"D5:23:F1:72:34:43:B4:9C:CF:2C:7A:63:EF:51:94:FB:90:F9:D7:60","sha256":"CE:C4:D0:20:72:21:5B:FC:FA:0B:9B:6D:97:FC:8F:44:FE:12:06:C1:F3:0F:FC:4C:B3:DF:6D:70:BD:40:15:C0"}}},"request":{"raw":"GET /_next/static/media/06ba6ef833b337bc-s.p.0faac26c.woff2 HTTP/1.1\r\nHost: cascade.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://preallocation-cascade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 07 Jan 2026 13:22:56 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 48432\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 0\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-disposition: inline; filename=\"06ba6ef833b337bc-s.p.0faac26c.woff2\"\r\netag: \"65850a373e258f1c897a2b3d75eb74de\"\r\nlast-modified: Wed, 07 Jan 2026 10:15:20 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /_next/static/media/06ba6ef833b337bc-s.p.0faac26c.woff2\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::c92p6-1767792176737-386a4a736f34\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2fI2fb0CUsu%2FlgqQVVvpY7UO7bX1EXLF%2BpMWVodYvWoZyS72XXdO3v2cu%2FXUxUNAypqrLbYluzz4Eek37%2FdfwX69zjpOHDWLpgk%3D\"}]}\r\ncf-ray: 9ba3c4504fb88be6-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":48432,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48432, version 1.0","md5":"65850a373e258f1c897a2b3d75eb74de","sha1":"1dc044f4824fd5af6bfed67fee48be70fa069f3f","sha256":"c940764593d0fe5d596be327ca7558855e018039fb78509aa21921fd3644c3e4","sha512":"df2683f3dd9724de589451a47bc608c9925d54b874ad97b733dd465ef41f9db75e9e31604762415c2fc1433d050e45fdefc6ecd7ecadf58d1243d9ca5f4bf74b","ssdeep":"768:3IkDHBYoX5Pi4JxTGz9CDR0s1ROSsA8mF77YNt7wFhVq9oN2WfpdqWjBA:tNYoX53xTl/R8W77YNtUFrWoUWvdA","tlshash":"56230251f5f8624a7fc3003fbc317bd862909fe5996ee5d91288f30225611dd29ee017","first_seen":"2025-05-30T12:57:00.85385Z","last_seen":"2026-08-02T11:59:48.350619Z","times_seen":85511,"resource_available":false,"data":null}},"time_used":164,"timings":{"blocked":38,"dns":4,"connect":5,"send":0,"wait":68,"receive":2,"ssl":40},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preallocation-cascade.com/secureproxy?e=jscdn/getFile","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:56.683Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"preallocation-cascade.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 16:48:10 GMT","end":"Mon, 06 Apr 2026 17:46:34 GMT"},"fingerprint":{"sha1":"A1:D4:92:91:60:6B:9B:E5:53:26:75:46:93:4A:81:37:FA:E5:6E:C2","sha256":"BF:1C:AC:05:5D:68:8E:0C:FB:2D:8C:B2:F6:45:AB:DD:D2:6A:CC:E9:4F:35:6C:47:91:7C:77:CC:A6:73:D5:D4"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: preallocation-cascade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://preallocation-cascade.com/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://preallocation-cascade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"eo2upuit3j1bi7kc0oxl\"}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 13:22:57 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncast-mode: default\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-frame-options: DENY\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-security-policy: default-src 'self', frame-ancestors http: https:\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jdhb0LR6pH3uTkcJ6DL6q9cWxPcJ2phvJSMNAyb02CtsaUIn6fi%2F4VMg%2FcjIBGZ1TXAcABNJ%2FBdGuhtGfqjDVxjD2FXY4jbztYbWSnSYmykXXw%3D%3D\"}]}\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\ncf-ray: 9ba3c4504bb98deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6030252,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"b1c154c025262630efaad55b062de969","sha1":"7049c8e4b0c6be9be115f6b2507f6d7af5cec126","sha256":"a08eb9ab341f6c18853214e88dbc9a75d8c62637c2c8da7ad9c6cac24464c0d5","sha512":"05a68f748dfcb2f04fdfb7d424f95a3231192e939e497c92e0712b6a7386cb51ce5c5760c36875b70b31e6341e281ef93b36e249ba75187eead4afcae29460ad","ssdeep":"24576:94jH0G+OfL76l8EUgNg5hiD+f2UiP8OzLbLYxjBDlG7VWIH:+jH0G+OP080gDh+9XL6jBDlekq","tlshash":"9e2512e7b48670d36a649879bae02ecdbc5e408af5db1a361c40fcc0595a0fb8d94dd2","first_seen":"2026-01-07T13:23:26.434101Z","last_seen":"2026-01-07T13:23:26.434101Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1489,"timings":{"blocked":4,"dns":0,"connect":0,"send":0,"wait":744,"receive":741,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"preallocation-cascade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"preallocation-cascade.com/icon.svg","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:57.111Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"preallocation-cascade.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 16:48:10 GMT","end":"Mon, 06 Apr 2026 17:46:34 GMT"},"fingerprint":{"sha1":"A1:D4:92:91:60:6B:9B:E5:53:26:75:46:93:4A:81:37:FA:E5:6E:C2","sha256":"BF:1C:AC:05:5D:68:8E:0C:FB:2D:8C:B2:F6:45:AB:DD:D2:6A:CC:E9:4F:35:6C:47:91:7C:77:CC:A6:73:D5:D4"}}},"request":{"raw":"GET /icon.svg HTTP/1.1\r\nHost: preallocation-cascade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 13:22:57 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 17:45:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"695d4a40-d20\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O0eYguEss0%2BcfNTQDeMVFWfgwR4MC1JHFmYJ9B3Wr8Od0htAz3R06KnyrtjsP2beDYn9iL6hAmF36nvXdQGvwSTSwvL%2B7pFCnGGnM8UqFis7zjQbXbzXhro%3D\"}]}\r\npriority: u=6,i=?0\r\ncf-ray: 9ba3c452ec038deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3360,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5b950857d9231f965042bc878fbd2e2b","sha1":"9c8c792df7fad885409d5a53fdeeca7dbd6555b4","sha256":"55da57823a16e7936fbf425d0b2834679c8f897ba483ac1977a961352e1a3a96","sha512":"7a23984a4c8515a66b0ded2668c9038625ce46ceed4866d4d7a361a44ed04ab420610510070558a8691eb92e0379bf5a456f84b82d73a78aee8f42f63ec13c98","ssdeep":"","tlshash":"bd6164f222dc21d868475760aa294c26332e20fff70dd70e8e4d2760a5510dac99fcc0","first_seen":"2026-01-07T13:23:26.438833Z","last_seen":"2026-04-28T14:14:03.89029Z","times_seen":17,"resource_available":false,"data":null}},"time_used":253,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":252,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"preallocation-cascade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"preallocation-cascade.com/5e2ccd6a7d0edc8e.css","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:56.102Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"preallocation-cascade.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 16:48:10 GMT","end":"Mon, 06 Apr 2026 17:46:34 GMT"},"fingerprint":{"sha1":"A1:D4:92:91:60:6B:9B:E5:53:26:75:46:93:4A:81:37:FA:E5:6E:C2","sha256":"BF:1C:AC:05:5D:68:8E:0C:FB:2D:8C:B2:F6:45:AB:DD:D2:6A:CC:E9:4F:35:6C:47:91:7C:77:CC:A6:73:D5:D4"}}},"request":{"raw":"GET /5e2ccd6a7d0edc8e.css HTTP/1.1\r\nHost: preallocation-cascade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 13:22:56 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 17:45:36 GMT\r\netag: W/\"695d4a40-1b25b\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6P1AdaEjvHOs1CBJ3%2FFavWVID1es9jRy0Z7HXDoF%2Bn4OQZ7eL2lmvcvYOCRjETc2ooXZY9kd%2FYH8xve8CVLFvr93tgEGtAMnILZPrzUUkbyiNLrzga87VuE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9ba3c44c9aff8deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":111195,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (51549)","md5":"2e6aae9b083fcff6109d69e262bcff9f","sha1":"43be41c2379d116af28e2a3c4d2416a119af6500","sha256":"097fd3a8dde4de970abce26e97060fecb0e4fb950bb65136bee43453c320177d","sha512":"3ff54b4e7674477fcf5f4c314a7b43671bcfcb90134a1324cec4cc70da6114ee225cf395f4352f3eb38a6b20c817a8ac91d5f61be56c0cd9ed8e4a2d51f4fe35","ssdeep":"3072:7V2Qhf+K7s9Xv6928f3yKYMdiYAX/3b+Q:7V2Qhf+K7s9Xv69YKK/3b+Q","tlshash":"47b37420e12a9d3bbd33d8fd639cf84e610a6092ae3167d9fb1235119ac76f71d72214","first_seen":"2026-01-07T13:23:26.443982Z","last_seen":"2026-02-13T19:37:59.453978Z","times_seen":4,"resource_available":false,"data":null}},"time_used":290,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":275,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"preallocation-cascade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"preallocation-cascade.com/logo-light.svg","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:56.104Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"preallocation-cascade.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 16:48:10 GMT","end":"Mon, 06 Apr 2026 17:46:34 GMT"},"fingerprint":{"sha1":"A1:D4:92:91:60:6B:9B:E5:53:26:75:46:93:4A:81:37:FA:E5:6E:C2","sha256":"BF:1C:AC:05:5D:68:8E:0C:FB:2D:8C:B2:F6:45:AB:DD:D2:6A:CC:E9:4F:35:6C:47:91:7C:77:CC:A6:73:D5:D4"}}},"request":{"raw":"GET /logo-light.svg HTTP/1.1\r\nHost: preallocation-cascade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 13:22:56 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 17:45:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"695d4a40-1735\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7UoiGti1hhO8%2BX%2Byuy2eEP8wlXPxJxD7WwvNQCUdIrqZaQVIXmKjDC6AevIrRxzG%2BQtJr%2FKSc2K906vDdI6nGkfdTKPyyeYG4w4JgC51xBdRFwBGwbDwDQg%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9ba3c44c9b008deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5941,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f5b178d57ed13e3016dbf346d9b9059f","sha1":"3c099973d5f4f89eae689909b0c7b51ab85a0a52","sha256":"b46a13152de6095612bb7cb3d95a32b2621dad0079e37e21bbb2576be34b6600","sha512":"6a32d5f92c5aa16a81cf41d105064521e67b577bf5af25d2bb4d0cd489251c6b03490d189f044368b717cd291129dbfe339590c75aa43eaee275c450e5e025a0","ssdeep":"96:3is6W+FUUT2ZcdFPrcVWpeooTY/IJ5aMUzTqp+30cuM+UG/zOaADsTzWGBnF39wA:3T6W+FUU9dwWY2bzTqpm0cuM+UG7OnIH","tlshash":"8ec193ddbe3856b9b809ebf2c9009065bd4f45fa23134a28d3da47d220c787bd406cc6","first_seen":"2026-01-07T13:23:26.447701Z","last_seen":"2026-04-28T14:14:03.879045Z","times_seen":40,"resource_available":false,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"preallocation-cascade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cascade.xyz/fonts/GT-Standard-L-Standard-Medium.woff2","fqdn":"cascade.xyz","domain":"cascade.xyz","tld":"xyz"},"ip":{"addr":"104.26.14.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:56.634Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cascade.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 01:03:31 GMT","end":"Fri, 03 Apr 2026 02:03:29 GMT"},"fingerprint":{"sha1":"D5:23:F1:72:34:43:B4:9C:CF:2C:7A:63:EF:51:94:FB:90:F9:D7:60","sha256":"CE:C4:D0:20:72:21:5B:FC:FA:0B:9B:6D:97:FC:8F:44:FE:12:06:C1:F3:0F:FC:4C:B3:DF:6D:70:BD:40:15:C0"}}},"request":{"raw":"GET /fonts/GT-Standard-L-Standard-Medium.woff2 HTTP/1.1\r\nHost: cascade.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://preallocation-cascade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 07 Jan 2026 13:22:56 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 62772\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 21181\r\ncache-control: public, max-age=14400, must-revalidate\r\ncontent-disposition: inline; filename=\"GT-Standard-L-Standard-Medium.woff2\"\r\netag: \"63798a2003d6cef7aafa2bc41619ae1d\"\r\nlast-modified: Wed, 07 Jan 2026 07:29:54 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /fonts/GT-Standard-L-Standard-Medium.woff2\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::8ktv5-1767792176737-d755ba5d2334\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GTyxxtyAKBBT6JmuhlnHg5AGjKzmnTOiC7qPsmFwDEeMTz20j%2BlE%2B3ThbbBPqwc%2BxLk7%2F6mPIYCz4QepKkVlXJc23Ru76uGjEXw%3D\"}]}\r\ncf-ray: 9ba3c4505fd88be6-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":62772,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), CFF, length 62772, version 1.0","md5":"63798a2003d6cef7aafa2bc41619ae1d","sha1":"f64015cc03a534422197219a161ee709f941a3e6","sha256":"faabee27a4bb26b35c9fba04560a6993db1701689942cdce0922c0af1ec9d1a6","sha512":"332400952b041e6e6513de8e93be27afbc97e37abbfc713506f661cc5d98fec11f29ad5f0e5c58b7b340015191ad696fd84196f90ffcf6d405004c3ce73ff091","ssdeep":"1536:5Zc1VnD3vlBOjO/h5WET6W1Usvt10UujRrVEE:XwBbvHOjSnT6SUsl10UujvEE","tlshash":"4a5302bd03956f81e5c04f1ac79e2cbae8805b1792db77c55a9395cf8453163278f8e0","first_seen":"2026-01-07T13:23:26.449369Z","last_seen":"2026-07-31T08:51:20.880775Z","times_seen":29,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":64,"dns":14,"connect":5,"send":0,"wait":55,"receive":11,"ssl":43},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preallocation-cascade.com/cbventures-light.svg","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:56.671Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"preallocation-cascade.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 16:48:10 GMT","end":"Mon, 06 Apr 2026 17:46:34 GMT"},"fingerprint":{"sha1":"A1:D4:92:91:60:6B:9B:E5:53:26:75:46:93:4A:81:37:FA:E5:6E:C2","sha256":"BF:1C:AC:05:5D:68:8E:0C:FB:2D:8C:B2:F6:45:AB:DD:D2:6A:CC:E9:4F:35:6C:47:91:7C:77:CC:A6:73:D5:D4"}}},"request":{"raw":"GET /cbventures-light.svg HTTP/1.1\r\nHost: preallocation-cascade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 13:22:56 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 17:45:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"695d4a40-d1b\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kuuinHcuhO%2F3nE%2BqShrF20ogIsPBlZUwC9YWb0PDLwOwoiXV3QGdL3b5oI8Rn4CBwpmRcFcnKk0nRZEnfjwDw9ihiwsxxY%2BiDVFXAxg2kbgDMDMRU0fNFcc%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9ba3c4502bb48deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3355,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7b8319948f2ea385a464563266e9e731","sha1":"76428a1ba18620e8a7bde07529ac740489853bb2","sha256":"90bd0490a72bed7b987000309d26d35b914be5d1aa01709097facc27d704e1a9","sha512":"ef5463fa6d2ccda672e42e27083b6cf03e077816978583c3421bc8ef14b402c8ed6b04d1e1a066be3d054600d70d94f1268387397419d4e83f48c92b5b106567","ssdeep":"","tlshash":"5c6175eba22493d0a44bd3788e14a0f166ef34f67fc546f88391fd999a340d24a89844","first_seen":"2026-01-07T13:23:26.451119Z","last_seen":"2026-03-28T00:19:51.290017Z","times_seen":35,"resource_available":false,"data":null}},"time_used":251,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"preallocation-cascade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cascade.xyz/_next/static/media/06ba6ef833b337bc-s.p.0faac26c.woff2","fqdn":"cascade.xyz","domain":"cascade.xyz","tld":"xyz"},"ip":{"addr":"104.26.14.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:56.682Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cascade.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 01:03:31 GMT","end":"Fri, 03 Apr 2026 02:03:29 GMT"},"fingerprint":{"sha1":"D5:23:F1:72:34:43:B4:9C:CF:2C:7A:63:EF:51:94:FB:90:F9:D7:60","sha256":"CE:C4:D0:20:72:21:5B:FC:FA:0B:9B:6D:97:FC:8F:44:FE:12:06:C1:F3:0F:FC:4C:B3:DF:6D:70:BD:40:15:C0"}}},"request":{"raw":"GET /_next/static/media/06ba6ef833b337bc-s.p.0faac26c.woff2 HTTP/1.1\r\nHost: cascade.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://preallocation-cascade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 07 Jan 2026 13:22:56 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 48432\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 11256\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-disposition: inline; filename=\"06ba6ef833b337bc-s.p.0faac26c.woff2\"\r\netag: \"65850a373e258f1c897a2b3d75eb74de\"\r\nlast-modified: Wed, 07 Jan 2026 10:15:20 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /_next/static/media/06ba6ef833b337bc-s.p.0faac26c.woff2\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::c92p6-1767792176737-386a4a736f34\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3t0VGT5ZJkiWxnM6eSw7VKkG%2Fu6tEkh7Er40DL8zDXyqWHsd43VWNP5kNHQEQ1aiP6OY1uPqa5XwmsDK36iCBPvHfjlhvKV%2BGXQ%3D\"}]}\r\ncf-ray: 9ba3c4504fb48be6-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48432,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48432, version 1.0","md5":"65850a373e258f1c897a2b3d75eb74de","sha1":"1dc044f4824fd5af6bfed67fee48be70fa069f3f","sha256":"c940764593d0fe5d596be327ca7558855e018039fb78509aa21921fd3644c3e4","sha512":"df2683f3dd9724de589451a47bc608c9925d54b874ad97b733dd465ef41f9db75e9e31604762415c2fc1433d050e45fdefc6ecd7ecadf58d1243d9ca5f4bf74b","ssdeep":"768:3IkDHBYoX5Pi4JxTGz9CDR0s1ROSsA8mF77YNt7wFhVq9oN2WfpdqWjBA:tNYoX53xTl/R8W77YNtUFrWoUWvdA","tlshash":"56230251f5f8624a7fc3003fbc317bd862909fe5996ee5d91288f30225611dd29ee017","first_seen":"2025-05-30T12:57:00.85385Z","last_seen":"2026-08-02T11:59:48.350619Z","times_seen":85511,"resource_available":false,"data":null}},"time_used":80,"timings":{"blocked":8,"dns":0,"connect":0,"send":0,"wait":64,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cascade.xyz/apple-icon.png?apple-icon.819a356a.png","fqdn":"cascade.xyz","domain":"cascade.xyz","tld":"xyz"},"ip":{"addr":"104.26.14.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:57.109Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cascade.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 01:03:31 GMT","end":"Fri, 03 Apr 2026 02:03:29 GMT"},"fingerprint":{"sha1":"D5:23:F1:72:34:43:B4:9C:CF:2C:7A:63:EF:51:94:FB:90:F9:D7:60","sha256":"CE:C4:D0:20:72:21:5B:FC:FA:0B:9B:6D:97:FC:8F:44:FE:12:06:C1:F3:0F:FC:4C:B3:DF:6D:70:BD:40:15:C0"}}},"request":{"raw":"GET /apple-icon.png?apple-icon.819a356a.png HTTP/1.1\r\nHost: cascade.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 07 Jan 2026 13:22:57 GMT\r\ncontent-type: image/png\r\ncontent-length: 3325\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 33047\r\ncache-control: public, max-age=14400, must-revalidate\r\ncontent-disposition: inline; filename=\"apple-icon.png\"\r\netag: \"3f13dce7cc4fe57ae8e88d63484779df\"\r\nlast-modified: Mon, 29 Dec 2025 22:45:49 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /apple-icon.png\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::kf9sj-1767081397183-4b3b6db1025b\r\ncf-cache-status: REVALIDATED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GmOj5wZ9k%2BJy5AVX3GLsRUHqrBeIHMWdmt0EYORhcv%2FrW5E%2Fv6li9INLMPYqljRmPgngEr9jis%2FEeeTe8rn7cXX3QOZfvSig\"}]}\r\ncf-ray: 9ba3c452ef6856be-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":3325,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGB, non-interlaced","md5":"3f13dce7cc4fe57ae8e88d63484779df","sha1":"469db33808df4aaec239dcbdf9d9d774dbb8f941","sha256":"96c4889ca2f9011e9c2a70b4c2eca3fd4a5d1c3fcb9888e7c23dd0bcd3605a63","sha512":"8ea1a6d997eadf4e6f2d1634b700afa2d2e38a9caff14c79fe9baa320a067fa71eca9d3bd3bb3e127f33a19dd96dfba5ad71a5f747ff9f94b7145043866158bb","ssdeep":"","tlshash":"f961f88be4465c01159ae5b0a4eed243eaa2ce81c98019896cedd5135c396fecd1839f","first_seen":"2026-01-07T13:23:26.452208Z","last_seen":"2026-04-28T14:14:03.888031Z","times_seen":43,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preallocation-cascade.com/hero-48-static-light.png","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:56.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"preallocation-cascade.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 16:48:10 GMT","end":"Mon, 06 Apr 2026 17:46:34 GMT"},"fingerprint":{"sha1":"A1:D4:92:91:60:6B:9B:E5:53:26:75:46:93:4A:81:37:FA:E5:6E:C2","sha256":"BF:1C:AC:05:5D:68:8E:0C:FB:2D:8C:B2:F6:45:AB:DD:D2:6A:CC:E9:4F:35:6C:47:91:7C:77:CC:A6:73:D5:D4"}}},"request":{"raw":"GET /hero-48-static-light.png HTTP/1.1\r\nHost: preallocation-cascade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 13:22:56 GMT\r\ncontent-type: image/png\r\ncontent-length: 83068\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 17:45:36 GMT\r\netag: \"695d4a40-1447c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SdVok9wpR7OoTY%2Ba5koKjDUw4CkSFmbRFjy32h5NhSesHeyL2gq1p%2Fob5XlILqXfxNASj30EmvBxGDDuRo%2F%2F5e4tN3glkoPdEo1U3nThq9j9djPwz1uybec%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9ba3c44fdba48deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":83068,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 3840 x 2160, 8-bit/color RGB, non-interlaced","md5":"8918d338d5fd292f3cad3cf9fc464d6b","sha1":"afe0b6bb9063ef7fb95786560a02c7200a060ea2","sha256":"5fa237271e0469cc9a3ac35630589953803c70337f02587ab5191da0f95d2841","sha512":"5201978b3dc8834977a3e406d1b8bf2c5b5514fd048b3f2412de05981baab75228643892506d94d7e6db1946988c805b03789b31c8ec33966a8311feca5846c1","ssdeep":"1536:LYdYMukPLtmzZMqPxdvOe9uNgX5uj3txfCcQpES53mHZlt5TqOhoa:L4Y24ZMkdvOes6XUjqFpES53mHLq+oa","tlshash":"4b836b1ad8564d65ddc409324cb74f38bfe84adee844c2438377b2268fd3b895a5ca4e","first_seen":"2026-01-07T13:23:26.453999Z","last_seen":"2026-05-05T08:45:50.022419Z","times_seen":36,"resource_available":false,"data":null}},"time_used":385,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":283,"receive":102,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"preallocation-cascade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cascade.xyz/_next/static/media/06ba6ef833b337bc-s.p.0faac26c.woff2","fqdn":"cascade.xyz","domain":"cascade.xyz","tld":"xyz"},"ip":{"addr":"104.26.14.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:56.627Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cascade.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 01:03:31 GMT","end":"Fri, 03 Apr 2026 02:03:29 GMT"},"fingerprint":{"sha1":"D5:23:F1:72:34:43:B4:9C:CF:2C:7A:63:EF:51:94:FB:90:F9:D7:60","sha256":"CE:C4:D0:20:72:21:5B:FC:FA:0B:9B:6D:97:FC:8F:44:FE:12:06:C1:F3:0F:FC:4C:B3:DF:6D:70:BD:40:15:C0"}}},"request":{"raw":"GET /_next/static/media/06ba6ef833b337bc-s.p.0faac26c.woff2 HTTP/1.1\r\nHost: cascade.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://preallocation-cascade.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 07 Jan 2026 13:22:56 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 48432\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 0\r\ncache-control: public, max-age=31536000, immutable\r\ncontent-disposition: inline; filename=\"06ba6ef833b337bc-s.p.0faac26c.woff2\"\r\netag: \"65850a373e258f1c897a2b3d75eb74de\"\r\nlast-modified: Wed, 07 Jan 2026 10:15:20 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /_next/static/media/06ba6ef833b337bc-s.p.0faac26c.woff2\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::c92p6-1767792176737-386a4a736f34\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1APb9Za3Nl73M6hBUFI6QxCTdvLSPoTFFZ1gJwXe1vlzpra%2BVOQRXHIyDTk%2FPNUUbjg0MeukY90wC9w9gnaFrvIKN0zO27nVwnU%3D\"}]}\r\ncf-ray: 9ba3c4504fb28be6-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48432,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48432, version 1.0","md5":"65850a373e258f1c897a2b3d75eb74de","sha1":"1dc044f4824fd5af6bfed67fee48be70fa069f3f","sha256":"c940764593d0fe5d596be327ca7558855e018039fb78509aa21921fd3644c3e4","sha512":"df2683f3dd9724de589451a47bc608c9925d54b874ad97b733dd465ef41f9db75e9e31604762415c2fc1433d050e45fdefc6ecd7ecadf58d1243d9ca5f4bf74b","ssdeep":"768:3IkDHBYoX5Pi4JxTGz9CDR0s1ROSsA8mF77YNt7wFhVq9oN2WfpdqWjBA:tNYoX53xTl/R8W77YNtUFrWoUWvdA","tlshash":"56230251f5f8624a7fc3003fbc317bd862909fe5996ee5d91288f30225611dd29ee017","first_seen":"2025-05-30T12:57:00.85385Z","last_seen":"2026-08-02T11:59:48.350619Z","times_seen":85511,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":63,"dns":21,"connect":1,"send":0,"wait":66,"receive":3,"ssl":45},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cascade.xyz/backgrounds/hero-48-1440p-light.mp4","fqdn":"cascade.xyz","domain":"cascade.xyz","tld":"xyz"},"ip":{"addr":"104.26.14.192","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:56.664Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cascade.xyz","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 03 Jan 2026 01:03:31 GMT","end":"Fri, 03 Apr 2026 02:03:29 GMT"},"fingerprint":{"sha1":"D5:23:F1:72:34:43:B4:9C:CF:2C:7A:63:EF:51:94:FB:90:F9:D7:60","sha256":"CE:C4:D0:20:72:21:5B:FC:FA:0B:9B:6D:97:FC:8F:44:FE:12:06:C1:F3:0F:FC:4C:B3:DF:6D:70:BD:40:15:C0"}}},"request":{"raw":"GET /backgrounds/hero-48-1440p-light.mp4 HTTP/1.1\r\nHost: cascade.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\ndate: Wed, 07 Jan 2026 13:22:56 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 3201640\r\naccess-control-allow-origin: *\r\nage: 32407\r\ncache-control: public, max-age=14400, must-revalidate\r\ncontent-disposition: inline; filename=\"hero-48-1440p-light.mp4\"\r\netag: \"d49fc477a7dd6b2decba2644360359bf\"\r\nlast-modified: Sat, 27 Dec 2025 09:05:37 GMT\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-matched-path: /backgrounds/hero-48-1440p-light.mp4\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::dc6wk-1766858744872-9e9df34cf0c8\r\ncontent-range: bytes 0-3201639/3201640\r\ncf-cache-status: REVALIDATED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mlPn97h2DPIeVJH9k3UeCTG40ZIPMsPkrzc4AEZc%2F79xh1SdYkyRHde5KNEharvGnwd7%2BO%2Fds94s8OKBk7Nhib5QPa2fD3gt\"}]}\r\ncf-ray: 9ba3c4507d2056be-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":1572864,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 v2 [ISO 14496-14]","md5":"3a7497f04862ee434a7cfc3e8f4d95a4","sha1":"1dc33b5e9f0ba5533bceebf65a5a87de9d73fd60","sha256":"58ed6ce25aad6c64c6c1450d5d8ab776f22729b04bf05a81fb1e7e9d851ab082","sha512":"d23f784a0a1675dd2775b162f106eb0033094e1b9ea2afb40a86988ba79f17a4467ee0764f27d128e0b203f4ea2fe862e31694a056d1db959e3397f9f9794105","ssdeep":"24576:ym2UfSkgdkkcbEFABOPBD6x/tPmo2Ovl8cymLwr:D2Uf9CkkchIcJIo2mlHymLc","tlshash":"db25239443763d07ec150fb0e5e996702ad7c4aa468e238b969c2b50ee4cd720ef9d7c","first_seen":"2026-01-07T13:23:26.456538Z","last_seen":"2026-03-28T00:19:51.287202Z","times_seen":33,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":51,"dns":7,"connect":2,"send":0,"wait":62,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"preallocation-cascade.com/polychain-light.svg","fqdn":"preallocation-cascade.com","domain":"preallocation-cascade.com","tld":"com"},"ip":{"addr":"172.67.139.198","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://preallocation-cascade.com/","date":"2026-01-07T13:22:56.666Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"preallocation-cascade.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 06 Jan 2026 16:48:10 GMT","end":"Mon, 06 Apr 2026 17:46:34 GMT"},"fingerprint":{"sha1":"A1:D4:92:91:60:6B:9B:E5:53:26:75:46:93:4A:81:37:FA:E5:6E:C2","sha256":"BF:1C:AC:05:5D:68:8E:0C:FB:2D:8C:B2:F6:45:AB:DD:D2:6A:CC:E9:4F:35:6C:47:91:7C:77:CC:A6:73:D5:D4"}}},"request":{"raw":"GET /polychain-light.svg HTTP/1.1\r\nHost: preallocation-cascade.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://preallocation-cascade.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 07 Jan 2026 13:22:56 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\ncast-mode: default\r\nlast-modified: Tue, 06 Jan 2026 17:45:36 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: br\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\netag: W/\"695d4a40-46dd\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nxPyib8qv8ujjX9o%2B0l3Tmg7qVxpCFFkk1hZNvJtS8Bw%2FVLk%2FTwA%2FPmdY1%2Fq8oByzMwelmscAIeaCJ6DjBvQxcwwEU4URn2QE4syQIpsf0JHwTJGzYGGDdY%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9ba3c4502bb18deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18141,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"60e9779c04baeb68caf173791a7e267f","sha1":"a2bce35b7586b0a7811c563e055217145f209781","sha256":"d30d5dc22f681701f2a4c687bbe03c36f917042c2792ccba97eae032ca85b5ee","sha512":"32bbea79ab714628e807d9f72d1ee54682845ab151e5ed52b90c0473cd97ca3995654562f66cd58ae532a08cb92349a21ff0034c816c7e0148660aea3ca51fb3","ssdeep":"384:a3cQmGhm4cYIw2cwdquz6COenZdLvKs6fj7o2XKc:qBoVXrcwdqbCnZJZ6fjU26c","tlshash":"218294f177e871f4e806f798d333c8ac7606187e3ba5c75a82a8ad64a51149c8ccdce5","first_seen":"2026-01-07T13:23:26.45801Z","last_seen":"2026-03-28T00:19:51.293883Z","times_seen":35,"resource_available":false,"data":null}},"time_used":296,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":292,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-07","alert":"Sinkholed","trigger":"preallocation-cascade.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}