{"report_id":"012407ef-ea15-46c1-9525-9e29c421d338","version":0,"status":"done","tags":[],"date":"2026-09-05T15:30:41Z","url":{"schema":"http","addr":"3652vip1.cc/","fqdn":"3652vip1.cc","domain":"3652vip1.cc","tld":"cc"},"ip":{"addr":"34.85.99.0","port":0,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"Japan","country_code":"JP"},"final":{"url":{"schema":"https","addr":"14.128.54.125:8889/","fqdn":"14.128.54.125","domain":"14.128.54.125","tld":""},"title":"14.128.54.125:8889/","dom":{"size":8998,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"0c2af420bd3b39004c71f7e86992bff1","sha1":"29b31a4c8b1c16427984007fe5d8e8d3eaef9f01","sha256":"f10403848450d34aa92a4662af08dea7db8abadeb93e35f50f4f1fe3c611b578","sha512":"d84fcc4f7d016ab9f14db026a8f76dd201e087da5981c85b0d789c1ec8b144551eae48bad78f170cadc48326a0726cb6b11f7ec5e36e1f8eccffb0c87ef49137","ssdeep":"192:GyLloqw271PyYIrq2dYMOp+8KOzkz79p+h+2tbXsY1z3OgGphWBpboZeRZiQ1enz:GqQFh0HRZi8Mc4fh","tlshash":"d802c9056af32596a4135054afe32b1a6270d003d90acc2dbfcc938cdfdb599c9e3b99","dom_hash":"domhashf79b1116d1c7389e2bd14cd50a3a132b","first_seen":"2026-09-02T14:22:48.333631Z","last_seen":"2026-09-06T05:46:02.076955Z","times_seen":4,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"3652vip1.cc/","fqdn":"3652vip1.cc","domain":"3652vip1.cc","tld":"cc"},"ip":{"addr":"34.85.99.0","port":0,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"Japan","country_code":"JP"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-10T15:30:41Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"3652vip1.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"14.128.54.125","ip":{"addr":"14.128.54.125","port":8889,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":7,"received_data":76928,"sent_data":3478,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"3652vip1.cc","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2023-06-14","domain_rank":0,"first_seen":"2026-04-17T09:18:02.066809Z","last_seen":"2026-07-02T05:27:43.382626Z","alert_count":15,"request_count":3,"received_data":2308,"sent_data":1286,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"34.85.99.0","ip":{"addr":"34.85.99.0","port":31887,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"Japan","country_code":"JP"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":514,"sent_data":509,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"14.128.54.125:8889/kefulink/redirect.js","fqdn":"14.128.54.125","domain":"14.128.54.125","tld":""},"ip":{"addr":"14.128.54.125","port":8889,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"063cb5bfa1e770974d123845a973ed70","sha1":"9ef295246ab1b383e679a0b11b36e8add09d62f9","sha256":"ac50cb338b68c2b0db0c2c9f3fc05de99b9b09cc575970bb037ba664914fe94c","sha512":"e15de6fb2e30b5544e75d1b16d634f12ccfdfb3361fede86a9500116ef6a68938b64fa54f014b4dc58e7120c5b645051f3b2448abdc9f825975dd17b456f403f","ssdeep":"","tlshash":"d751fed68ed014255324c27ca38bb70af202042b8ef5e453f54987857fa9b2b627e6cd","size":2855,"data":"","first_seen":"2026-09-05T15:31:03.409481Z","last_seen":"2026-09-24T05:38:00.345209Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"14.128.54.125:8889/kefulink/cslink.js","fqdn":"14.128.54.125","domain":"14.128.54.125","tld":""},"ip":{"addr":"14.128.54.125","port":8889,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"c70d43c4166f7feeff1cb3f3279d42ea","sha1":"60cdaa28675ad4e9e6af2b38f4195b0d745ceb1d","sha256":"bd32d2a968031ec4ffda4b7e19adc87346c7d7f5783d6b8d6c242aae3da56676","sha512":"23f19c8495d1d2b30a0e84273738e7d764155023bd4b27d85f403f0499c976c677f449e7aee068fb50c0b65665f2056ea449f3895c0d3079a244f052a5726ed0","ssdeep":"192:IaC30DBBYUxu1Qx27ehQNfsyiQAT/T3IbtjQwSuOFj:HB3xrx2VNfsNTL3Ip07t","tlshash":"44d1965abd5131fd6635c978ab4ab708f662d167488eec02751cc104bf82ba3513dbc9","size":6700,"data":"","first_seen":"2026-09-02T14:22:48.339362Z","last_seen":"2026-09-06T05:46:02.078511Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"14.128.54.125:8889/","fqdn":"14.128.54.125","domain":"14.128.54.125","tld":""},"ip":{"addr":"14.128.54.125","port":8889,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"024da3134343ad04f04eb5f31466a50a","sha1":"ec0606ee5434c9aee241867f8d2f2e3b30a3656a","sha256":"82230c0adeb59955d052448ad588b404763f7b20fe9c054da5e63e91989b0740","sha512":"ad5d43e62b7bc44be0fd7163e3cfd912570220230434fd0e4429193131f3b85918c9f31a7f8a653bf4dadfab36dc322baeacac6c8e28e6b9b6e43f827fac636b","ssdeep":"","tlshash":"aab0220c22aa0803003b38008a82200822b300ab883c0a0232082bcc0eea3aa022ee08","size":115,"data":"","first_seen":"2026-06-14T23:40:36.13109Z","last_seen":"2026-09-24T05:38:00.354451Z","times_seen":26,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"14.128.54.125:8889/","fqdn":"14.128.54.125","domain":"14.128.54.125","tld":""},"ip":{"addr":"14.128.54.125","port":8889,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"48643ee00dda4957582d97c485ae3607","sha1":"9abf4e0de1857958f58a7a925223267284c5d012","sha256":"5baced78b0ac9c947f8c3735b663678238e3b7a7b835bb3511342fd1bff53ab9","sha512":"e668f4cb36dd9e140085e3e5fdfb1b2d87e1855e3a9995798d41783f542ead62fa68024155f0076b6a4b554fd258d605c6d58f66b4eee1e1b21a7c57ffddb3ec","ssdeep":"","tlshash":"3b700008088a228080e02008020a330e220a28a288308222200008ae32808030820280","size":23,"data":"","first_seen":"2026-09-02T14:22:48.351119Z","last_seen":"2026-09-24T05:38:00.3558Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"14.128.54.125:8889/","fqdn":"14.128.54.125","domain":"14.128.54.125","tld":""},"ip":{"addr":"14.128.54.125","port":8889,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"32462227b8714557bf17534bb95d7d3b","sha1":"53ba4bc0554e03806030a529760ca6c9748465a9","sha256":"6b8cb5c50cecdeb74ab008b8a6c702929984dd152e8fb5d971bb3d28ca2145fc","sha512":"6cad8ab767d47cd239cf2baa6f2b9af4220834e696f389b973a08520d82b6c996b2f94812528b1f670d4cd5d2890de2a5ce2c5ea28f29200d5d4cbc47d0f28ef","ssdeep":"","tlshash":"2b31ae0e52f31e79505b33660fd76208961161132e06ec0dfe4cd3048fbf9a79ae6e99","size":1815,"data":"","first_seen":"2026-08-19T03:57:01.020424Z","last_seen":"2026-09-24T05:38:00.356545Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"3652vip1.cc/","fqdn":"3652vip1.cc","domain":"3652vip1.cc","tld":"cc"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"ffc1fb024b21366b59d5e63e7a0e42b5","sha1":"72b1d3af7d9df602e2c475b8e2072ce077c6d677","sha256":"163a61d631d1ca28a30a7fe561557dd8bf22d553814b4e7e5981d3e4fe2a889b","sha512":"da8ff71e22984937b1bdb02e8c96108f04005f1b723cffcfb997e458dad49d9bfc54f95da4c3dc8ff01e8f5aa3dc9d271b93b143193341b8149deec88e0fde4f","ssdeep":"","tlshash":"3d01f1cc714a38b647621035b2bfa216b17d5ba009dd5120909a68917a75d678307f5e","size":792,"data":"","first_seen":"2026-07-06T14:01:46.699128Z","last_seen":"2026-09-24T05:38:00.352138Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"34.85.99.0:31887/z/eyJ1IjoiL2NjLjFwaXYyNTYzLy86cHR0aCIsInRzIjoxNzg4NjIyMjEzNDk4fQ.js","fqdn":"34.85.99.0","domain":"34.85.99.0","tld":""},"ip":{"addr":"34.85.99.0","port":31887,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"6c57278f41d5f36a3bc7f9c08ffeca9a","sha1":"6a6df5553b23f27f13ef1f866a98ada94ccd90d1","sha256":"dab7deb0ae956f6184c5d9f555dafa817357fa7c270ead0330d508eb83dd1acd","sha512":"9774cc22d8ec80a2a92b975455b1935fde33d7eb2a74903f85a5dc7528582db6b07683731e1953afeffba59a88019e1943b2857d0a76f11731fc9a2c2c944473","ssdeep":"","tlshash":"4ed0a7f150957a75862c554e37bfb792bdd1214b76b1204500dd4d14a45cd4204a9da4","size":242,"data":"","first_seen":"2026-07-06T14:01:46.700403Z","last_seen":"2026-09-06T05:46:02.104528Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"14.128.54.125:8889/favicon.ico","fqdn":"14.128.54.125","domain":"14.128.54.125","tld":""},"ip":{"addr":"14.128.54.125","port":8889,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://14.128.54.125:8889/","date":"2026-09-05T15:30:16.757Z","timestamp":1788622216757,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"14.128.54.125","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Sat, 29 Aug 2026 00:00:00 GMT","end":"Fri, 27 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"92:BC:ED:6C:C2:10:33:2C:C7:53:85:05:75:B0:9E:05:4F:7A:DA:D6","sha256":"56:C8:D2:CD:B9:91:18:8B:09:86:D0:19:2D:9E:22:E2:AE:39:B5:E8:B7:5C:5E:64:8E:BB:36:7C:72:9F:A8:01"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: 14.128.54.125:8889\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://14.128.54.125:8889/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 15:30:17 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 146\r\nConnection: keep-alive\r\nCache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0\r\nPragma: no-cache\r\nExpires: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":420,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-10-15T01:37:32.575351Z","times_seen":568036,"resource_available":true,"data":null}},"time_used":397,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":397,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"3652vip1.cc/","fqdn":"3652vip1.cc","domain":"3652vip1.cc","tld":"cc"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-05T15:30:09.372Z","timestamp":1788622209372,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 3652vip1.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-15T01:38:32.742437Z","times_seen":19111367,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"3652vip1.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"3652vip1.cc/","fqdn":"3652vip1.cc","domain":"3652vip1.cc","tld":"cc"},"ip":{"addr":"34.85.99.0","port":80,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"Japan","country_code":"JP"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-05T15:30:12.923Z","timestamp":1788622212923,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 3652vip1.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 1009\r\nCache-Control: max-age=5\r\nConnection: close\r\nServer: openresty\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1009,"size_decoded":1154,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (983), with no line terminators","md5":"6a82d1dc03f5d4228d4ebeee3e6f139e","sha1":"6fb44b635a465ca2485a23dd02e96bc09891eb6f","sha256":"b5b99e4c85e0c167d9e31a7235ca8bd4548ed04a59c7eee9b9f4d5c62393afc5","sha512":"5b722e6a14ab3528375b33358315e713715ca344865baa1e2b22e67d0fccbb8288148cbdf1d2dfb15fba12b41af292c8fd4727e1712cc3ad9544a4be3718ba3b","ssdeep":"","tlshash":"581132cc380a29a60732107576ffa32eb13957500ed9911090daa8516e36d578603f09","first_seen":"2026-09-05T15:31:03.403016Z","last_seen":"2026-09-05T15:31:03.403016Z","times_seen":1,"resource_available":true,"data":null}},"time_used":531,"timings":{"blocked":-1,"dns":2,"connect":264,"send":0,"wait":265,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"3652vip1.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"34.85.99.0:31887/z/eyJ1IjoiL2NjLjFwaXYyNTYzLy86cHR0aCIsInRzIjoxNzg4NjIyMjEzNDk4fQ.js","fqdn":"34.85.99.0","domain":"34.85.99.0","tld":""},"ip":{"addr":"34.85.99.0","port":31887,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://3652vip1.cc/","date":"2026-09-05T15:30:13.513Z","timestamp":1788622213513,"http_version":"HTTP/1.1","security_state":"secure","security_info":null,"request":{"raw":"GET /z/eyJ1IjoiL2NjLjFwaXYyNTYzLy86cHR0aCIsInRzIjoxNzg4NjIyMjEzNDk4fQ.js HTTP/1.1\r\nHost: 34.85.99.0:31887\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://3652vip1.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Sat, 05 Sep 2026 15:30:14 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: no-store\r\nX-XSS-Protection: 1; mode=block\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: no-referrer-when-downgrade\r\nContent-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';\r\nPermissions-Policy: interest-cohort=()\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-15T01:38:32.742437Z","times_seen":19111367,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"3652vip1.cc/favicon.ico","fqdn":"3652vip1.cc","domain":"3652vip1.cc","tld":"cc"},"ip":{"addr":"34.85.99.0","port":80,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://3652vip1.cc/","date":"2026-09-05T15:30:13.616Z","timestamp":1788622213616,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: 3652vip1.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://3652vip1.cc/\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 1009\r\nCache-Control: max-age=5\r\nConnection: close\r\nServer: openresty\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1009,"size_decoded":1154,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (983), with no line terminators","md5":"200e461531f287bea644dfe6bcff6059","sha1":"7e2eff86b4833a5ab9866ee069316e76c87c2468","sha256":"56435062cdb2939d621e6c1581af1a87ac17e6a7ac16df052701217cb500ee4e","sha512":"1d4678e0d468da2ace50c59392942204b7ee087294086ec447f5b37e622bb9fe9ac50f2296fceb2a1ce4ce012a3688dd62b87e2d5f7bf5a25d3762f8f8568be7","ssdeep":"","tlshash":"801132cc380a39a5073210b575ffa32e713a57500ed9915090daa8516a35d578703f09","first_seen":"2026-09-05T15:31:03.406696Z","last_seen":"2026-09-05T15:31:03.406696Z","times_seen":1,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"3652vip1.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"3652vip1.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"14.128.54.125:8889/kefulink/redirect.js","fqdn":"14.128.54.125","domain":"14.128.54.125","tld":""},"ip":{"addr":"14.128.54.125","port":8889,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://14.128.54.125:8889/","date":"2026-09-05T15:30:16.104Z","timestamp":1788622216104,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"14.128.54.125","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Sat, 29 Aug 2026 00:00:00 GMT","end":"Fri, 27 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"92:BC:ED:6C:C2:10:33:2C:C7:53:85:05:75:B0:9E:05:4F:7A:DA:D6","sha256":"56:C8:D2:CD:B9:91:18:8B:09:86:D0:19:2D:9E:22:E2:AE:39:B5:E8:B7:5C:5E:64:8E:BB:36:7C:72:9F:A8:01"}}},"request":{"raw":"GET /kefulink/redirect.js HTTP/1.1\r\nHost: 14.128.54.125:8889\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://14.128.54.125:8889/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 15:30:16 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Thu, 03 Sep 2026 11:25:27 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a995927-b27\"\r\nCache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0\r\nPragma: no-cache\r\nExpires: 0\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2855,"size_decoded":1428,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"063cb5bfa1e770974d123845a973ed70","sha1":"9ef295246ab1b383e679a0b11b36e8add09d62f9","sha256":"ac50cb338b68c2b0db0c2c9f3fc05de99b9b09cc575970bb037ba664914fe94c","sha512":"e15de6fb2e30b5544e75d1b16d634f12ccfdfb3361fede86a9500116ef6a68938b64fa54f014b4dc58e7120c5b645051f3b2448abdc9f825975dd17b456f403f","ssdeep":"","tlshash":"d751fed68ed014255324c27ca38bb70af202042b8ef5e453f54987857fa9b2b627e6cd","first_seen":"2026-09-05T15:31:03.409481Z","last_seen":"2026-09-24T05:38:00.345209Z","times_seen":4,"resource_available":true,"data":null}},"time_used":343,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":343,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"14.128.54.125:8889/kefulink/cslink.js","fqdn":"14.128.54.125","domain":"14.128.54.125","tld":""},"ip":{"addr":"14.128.54.125","port":8889,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://14.128.54.125:8889/","date":"2026-09-05T15:30:16.105Z","timestamp":1788622216105,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"14.128.54.125","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Sat, 29 Aug 2026 00:00:00 GMT","end":"Fri, 27 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"92:BC:ED:6C:C2:10:33:2C:C7:53:85:05:75:B0:9E:05:4F:7A:DA:D6","sha256":"56:C8:D2:CD:B9:91:18:8B:09:86:D0:19:2D:9E:22:E2:AE:39:B5:E8:B7:5C:5E:64:8E:BB:36:7C:72:9F:A8:01"}}},"request":{"raw":"GET /kefulink/cslink.js HTTP/1.1\r\nHost: 14.128.54.125:8889\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://14.128.54.125:8889/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 15:30:16 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Mon, 31 Aug 2026 00:29:28 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a94cae8-1a2c\"\r\nCache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0\r\nPragma: no-cache\r\nExpires: 0\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6700,"size_decoded":2617,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"c70d43c4166f7feeff1cb3f3279d42ea","sha1":"60cdaa28675ad4e9e6af2b38f4195b0d745ceb1d","sha256":"bd32d2a968031ec4ffda4b7e19adc87346c7d7f5783d6b8d6c242aae3da56676","sha512":"23f19c8495d1d2b30a0e84273738e7d764155023bd4b27d85f403f0499c976c677f449e7aee068fb50c0b65665f2056ea449f3895c0d3079a244f052a5726ed0","ssdeep":"192:IaC30DBBYUxu1Qx27ehQNfsyiQAT/T3IbtjQwSuOFj:HB3xrx2VNfsNTL3Ip07t","tlshash":"44d1965abd5131fd6635c978ab4ab708f662d167488eec02751cc104bf82ba3513dbc9","first_seen":"2026-09-02T14:22:48.339362Z","last_seen":"2026-09-06T05:46:02.078511Z","times_seen":4,"resource_available":true,"data":null}},"time_used":339,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":339,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"14.128.54.125:8889/%E7%BD%91%E5%9D%80-2new.png","fqdn":"14.128.54.125","domain":"14.128.54.125","tld":""},"ip":{"addr":"14.128.54.125","port":8889,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://14.128.54.125:8889/","date":"2026-09-05T15:30:16.108Z","timestamp":1788622216108,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"14.128.54.125","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Sat, 29 Aug 2026 00:00:00 GMT","end":"Fri, 27 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"92:BC:ED:6C:C2:10:33:2C:C7:53:85:05:75:B0:9E:05:4F:7A:DA:D6","sha256":"56:C8:D2:CD:B9:91:18:8B:09:86:D0:19:2D:9E:22:E2:AE:39:B5:E8:B7:5C:5E:64:8E:BB:36:7C:72:9F:A8:01"}}},"request":{"raw":"GET /%E7%BD%91%E5%9D%80-2new.png HTTP/1.1\r\nHost: 14.128.54.125:8889\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://14.128.54.125:8889/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 15:30:17 GMT\r\nContent-Type: image/png\r\nLast-Modified: Sun, 14 Jun 2026 00:54:52 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a2dfbdc-56e5\"\r\nCache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0\r\nPragma: no-cache\r\nExpires: 0\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22245,"size_decoded":21709,"mime_type":"image/png","magic":"PNG image data, 504 x 135, 8-bit/color RGBA, non-interlaced","md5":"5f05bde024db7e1186571e3020d7c8fe","sha1":"6b665db5872891a5d8f894991deb52f9ab8efa7d","sha256":"71ea269ed631b184ed4fe22c50e138c2a624b5a68a3b2b10e99c67454f305f97","sha512":"fcfb31aa7951dfbf1d5161fc1d99b45080ff453fd0dded32a01ace3174c94970ea61ac9a3268c026a42a144dc9189d6a57ed1408d1c0aaeaf20eac91f2852e4c","ssdeep":"384:VnnPskB1gU8c8knT3FOzqNw/eYVpzZdiOybmEgjM4A22rmy6niRZfk5ovX8/qZkw:lJxYGw2YVp9diTqEF4A2ZVnioikSSW","tlshash":"69a2bff1ee08984285e871c49b846543102e63c15ec7b1e6eb8c8f5aed7cfac8c4a743","first_seen":"2026-06-14T23:40:36.128623Z","last_seen":"2026-09-24T05:38:00.3481Z","times_seen":26,"resource_available":false,"data":null}},"time_used":1363,"timings":{"blocked":-1,"dns":0,"connect":320,"send":0,"wait":707,"receive":0,"ssl":336},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"14.128.54.125:8889/","fqdn":"14.128.54.125","domain":"14.128.54.125","tld":""},"ip":{"addr":"14.128.54.125","port":8889,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-05T15:30:14.526Z","timestamp":1788622214526,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"14.128.54.125","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Sat, 29 Aug 2026 00:00:00 GMT","end":"Fri, 27 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"92:BC:ED:6C:C2:10:33:2C:C7:53:85:05:75:B0:9E:05:4F:7A:DA:D6","sha256":"56:C8:D2:CD:B9:91:18:8B:09:86:D0:19:2D:9E:22:E2:AE:39:B5:E8:B7:5C:5E:64:8E:BB:36:7C:72:9F:A8:01"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 14.128.54.125:8889\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://3652vip1.cc/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 15:30:15 GMT\r\nContent-Type: text/html; charset=utf-8\r\nLast-Modified: Mon, 31 Aug 2026 15:06:15 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a959867-223b\"\r\nCache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0\r\nPragma: no-cache\r\nExpires: 0\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8763,"size_decoded":3337,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"2e1d8dbc82d1640a95f8faae267c4455","sha1":"0ecb3edb355e246900685c94d0ba52d384be94d7","sha256":"3a5de460e9274d4e2210d96410904173c9895a50d32a2597c8435810e6776454","sha512":"1bfce067fa4de636568e40e4d84f7577b2f94423994ded55efee2a98718427b66aa76968683db36b633a1bd9cd347cb5c10037140e04584446387c506aed3b13","ssdeep":"192:SyLloqw271PyYIrq2dYMOp+8KOzkz79p+h+2tbXsY1z3OgGphWBpbhaefZiQ1enX:SqQFh0BfZi8Mc4fF","tlshash":"1f02b7056af32556a4135064aff31b1a6260d003d90bcc2dbfcd928cdfdb599cae3b99","first_seen":"2026-09-02T14:22:48.34821Z","last_seen":"2026-09-24T05:38:00.349843Z","times_seen":5,"resource_available":true,"data":null}},"time_used":1517,"timings":{"blocked":-1,"dns":0,"connect":339,"send":0,"wait":413,"receive":0,"ssl":765},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"14.128.54.125:8889/3652lg.png","fqdn":"14.128.54.125","domain":"14.128.54.125","tld":""},"ip":{"addr":"14.128.54.125","port":8889,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://14.128.54.125:8889/","date":"2026-09-05T15:30:16.106Z","timestamp":1788622216106,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"14.128.54.125","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Sat, 29 Aug 2026 00:00:00 GMT","end":"Fri, 27 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"92:BC:ED:6C:C2:10:33:2C:C7:53:85:05:75:B0:9E:05:4F:7A:DA:D6","sha256":"56:C8:D2:CD:B9:91:18:8B:09:86:D0:19:2D:9E:22:E2:AE:39:B5:E8:B7:5C:5E:64:8E:BB:36:7C:72:9F:A8:01"}}},"request":{"raw":"GET /3652lg.png HTTP/1.1\r\nHost: 14.128.54.125:8889\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://14.128.54.125:8889/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 15:30:17 GMT\r\nContent-Type: image/png\r\nLast-Modified: Sat, 13 Jun 2026 23:52:54 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a2ded56-2ed7\"\r\nCache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0\r\nPragma: no-cache\r\nExpires: 0\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11991,"size_decoded":12077,"mime_type":"image/png","magic":"PNG image data, 550 x 68, 8-bit/color RGBA, non-interlaced","md5":"9d8ba84ea2a36c51492d5faf87f3df5c","sha1":"71566cf5865a36a074b9c7d91cd2bcf5d3a18d8b","sha256":"ddfeb2547dc557b0eedf65381905de086e9c0ab76207a86b0090aa41ea7ec477","sha512":"8bc12bac96519275654bac5bc03848b9cc29167a7bc800047e20061f720429d8c0291eb5fc2ea7df672caf7b84b20048a5594f45a44c31a86057f1194e708afa","ssdeep":"192:bbX5OYJcAvr+mOSI6quZ9Q8mY31eCQfCuHKKnvGELYHLmdDAhLvnvms+VxRxD2cr:bgwcAT+0I6zk8mY31eCAPKKvZOyFAhL4","tlshash":"a532c049f7663242ec12ce2763e546e7552b106ad9d5e1403a9fc8e4fca10fced890e2","first_seen":"2026-06-14T23:40:36.117449Z","last_seen":"2026-09-24T05:38:00.338643Z","times_seen":27,"resource_available":false,"data":null}},"time_used":1042,"timings":{"blocked":-1,"dns":0,"connect":326,"send":0,"wait":373,"receive":0,"ssl":343},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"14.128.54.125:8889/wdly-dh_06.jpg","fqdn":"14.128.54.125","domain":"14.128.54.125","tld":""},"ip":{"addr":"14.128.54.125","port":8889,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://14.128.54.125:8889/","date":"2026-09-05T15:30:16.108Z","timestamp":1788622216108,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"14.128.54.125","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Sat, 29 Aug 2026 00:00:00 GMT","end":"Fri, 27 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"92:BC:ED:6C:C2:10:33:2C:C7:53:85:05:75:B0:9E:05:4F:7A:DA:D6","sha256":"56:C8:D2:CD:B9:91:18:8B:09:86:D0:19:2D:9E:22:E2:AE:39:B5:E8:B7:5C:5E:64:8E:BB:36:7C:72:9F:A8:01"}}},"request":{"raw":"GET /wdly-dh_06.jpg HTTP/1.1\r\nHost: 14.128.54.125:8889\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://14.128.54.125:8889/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 05 Sep 2026 15:30:17 GMT\r\nContent-Type: image/jpeg\r\nLast-Modified: Sun, 14 Jun 2026 22:41:11 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a2f2e07-5475\"\r\nCache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0\r\nPragma: no-cache\r\nExpires: 0\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21621,"size_decoded":13871,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2015:05:07 23:27:55], baseline, precision 8, 174x44, components 3","md5":"19e5729e4e086463be09bc8727b55a14","sha1":"a46bf560c19a8827ddcc2c13d1d7945f184a0b64","sha256":"bbf1932d304be451f87e26d65134763c542121a02985ec0df4f9d58783eeab4b","sha512":"06c8abc3a58720198a60b77b7eddf39799757410cdb0260c4b745587bcd31b333e2ed84fb2b1bd4be807e6cff6f35a15be133ed28d622705f804aa08c2d21766","ssdeep":"384:sSpSuw2nZnl8sw3ivbATDY96nIbkA7K3/LVViiizM:NwKlXQuQfjZuzM","tlshash":"99a27c097793af11eec4917a55a2cb478659af7b38e31b0b389c71427f34b816c6de02","first_seen":"2023-09-04T01:29:10Z","last_seen":"2026-09-24T05:38:00.346717Z","times_seen":50,"resource_available":false,"data":null}},"time_used":1032,"timings":{"blocked":-1,"dns":0,"connect":322,"send":0,"wait":371,"receive":0,"ssl":338},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}