{"report_id":"02c3dbac-bfa1-4630-b938-8cde98a7cef0","version":0,"status":"done","tags":[],"date":"2026-10-04T06:22:44Z","url":{"schema":"http","addr":"20010926.com/","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":0,"asn":202412,"as":"Omegatech LTD","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"20010926.com/index2.html?shareName=88258280","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"title":"澳门新葡京","dom":{"size":29488,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (3238)","md5":"270ed406890dae95f97c6432bcd0cab0","sha1":"7430516d1c48d9adfde0fbdf94467f5f51969b31","sha256":"0754c6aad5b4c707ab60a4af5f96e4b93a0686bcf87ad909893ee82011a673b8","sha512":"5cb4d6a541e24ea6b94807eb73d1fd0a50a235e2e65d58fdfada4695c364a738722da1c905de1b65dc7049a9381bf2bf0f3f3667d25b0e5977e93d2f9bf1ffc3","ssdeep":"384:Mh9WRUxl0iIIw+wHwunwwwawLwmwBnwpwnw3IEwMwHw9wOw9w5wUw8wPwIwmI2w4:8dINdYInIGfJGU","tlshash":"bed2f020e68d2cd300330b82627566aa14ae5536ef134ca1f2ff0b9af7d9cb5191f6d5","dom_hash":"domhashc2af4d2e9644b1da67f5f2fa987f38df","first_seen":"2026-10-04T06:23:02.373471Z","last_seen":"2026-10-04T06:23:02.373471Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"20010926.com/","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":0,"asn":202412,"as":"Omegatech LTD","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-08T06:22:44Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.frontstakecodenica.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2026-03-19","domain_rank":0,"first_seen":"2026-03-25T19:43:12.173129Z","last_seen":"2026-04-08T06:13:01.173759Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":573,"comment":"","tags":null,"fingerprints":null},{"fqdn":"20010926.com","ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"domain_registered":"2026-10-01","domain_rank":0,"first_seen":"2026-10-04T06:22:53.790107Z","last_seen":"2026-10-04T06:22:53.790107Z","alert_count":48,"request_count":48,"received_data":3017925,"sent_data":25242,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Swiper","description":"Swiper is a JavaScript library that creates modern touch sliders with hardware-accelerated transitions.","website":"https://swiperjs.com","common_platform_enumeration":"","icon":"Swiper.svg","categories":["JavaScript libraries"]},{"name":"jQuery:2.2.4","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"d37uxtopjf4fiw.cloudfront.net","ip":{"addr":"65.9.60.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2008-04-25","domain_rank":0,"first_seen":"2025-06-17T21:38:18.792636Z","last_seen":"2026-05-17T05:13:40.043155Z","alert_count":0,"request_count":1,"received_data":2652988,"sent_data":548,"comment":"","tags":null,"fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"20010926.com/js/screen.js","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":false,"md5":"3f6f131f8448e32e753636f5e08abb30","sha1":"5b942844c04bf5dc088f0f3bd65b4713eba7560e","sha256":"dc3e578dd1a9fde1a8247b4ef3cb586080816cc12b2d3ca7989b994c60543bba","sha512":"8da964c3fd564c7f2ffb9591fb5516af145d8a275482e9cf3dd4e9e0ba0e0351c21d36ffbb0ca1de403eaec0f04c2304af775593cd2d42f35fe64bc25beb04fa","ssdeep":"","tlshash":"1d017d3a64d0163991673c4b36bf621e6d7e5142232e5410fd3cc7908f92866c575fd8","size":661,"data":"","first_seen":"2026-10-04T06:23:02.390276Z","last_seen":"2026-10-04T06:23:17.289878Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/js/decryptImg.js","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":false,"md5":"f98447b271f3d92ce28f9d3198712626","sha1":"bbf2bb61f12955e083814789bdd2a70e80448e6e","sha256":"08d8cb4d5d8dbff216f7c25a149566539421d3392712d00090b2339f2f663f31","sha512":"e8641823af3ced6be5d8dbf67bf50aaa939bc6d9f84d6e3c0a2ae20fc0e727efece547a43d3056e21b0c0c8d353f507c5aa65b6133bd2106e5317a98ffa2fb9c","ssdeep":"","tlshash":"5d611098aea810b93b133475eaff424470b448132118ce19f85df1515fb4e35e2feae9","size":3432,"data":"","first_seen":"2026-10-04T06:23:02.392414Z","last_seen":"2026-10-04T06:23:17.279219Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/index2.html?shareName=88258280","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":true,"md5":"74c12c6272955593f884e4d14c237070","sha1":"dcc46baad5009c20d1ff862b2a6863d99984b7af","sha256":"53b7f4048365a8219f4aa296dfa28470268d67b83443025a987b3af1fd80ed31","sha512":"9e8bf7708956beaea1910650c71f6f139acff4544a65b3c837406681ef76f1d54aa3b6c5c783b76ec5a003c37291f33abb37b614f2bf546aaea5bba0747734ce","ssdeep":"","tlshash":"3ee06848109391507ea3e12d9fdf360861b37243a10edd20b80e83422f321ae8a5acdf","size":413,"data":"","first_seen":"2026-10-04T06:23:02.465865Z","last_seen":"2026-10-04T06:23:17.299065Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/index2.html?shareName=88258280","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":true,"md5":"8078b53c94a33757e1beb3d44ab78295","sha1":"7531b35ebd2acd3df15d77aaf3cc67be0aed75d0","sha256":"563dbc594a15e55d90cf7af95f64948967f67e362c565eaa4db42008e25beb69","sha512":"8da313c90207ad3198dd5082eb7af8b6440ad1b6de93a280ea6cadb099c682b8fd99e3e8d039a8f31a4a7719686253972678591490fbec4cace43a9988044449","ssdeep":"","tlshash":"d33100d8a78c61779427218b786a26c8219f723b1c48ec13ff636a108ed1e1b176edd4","size":1583,"data":"","first_seen":"2026-10-04T06:23:02.467636Z","last_seen":"2026-10-04T06:23:17.299655Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/index2.html?shareName=88258280","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":true,"md5":"16dae5cdcdbedfdb535a68cd9663bbd4","sha1":"24c2b3d1318b62369d4f97017f52f02e5b376728","sha256":"68dd0415edd8d80d11ab9eb3eea6ffad7c6a6722b60c5cddd2a7583c8ec9e7ce","sha512":"d6f08afb0aaf22c1d0fe6ef4e7e67b467bf547cd96edb6a96afbf156c484e72be08ce26b4447782e80913b3c4d863c7bd0a2ddd0ec0e888227ac0730afa0db7e","ssdeep":"","tlshash":"22b0926dd28e0c210f30230d022d109a007c22baf7ab0e07f860442885e8b4d00a2942","size":125,"data":"","first_seen":"2026-10-04T06:23:02.469453Z","last_seen":"2026-10-04T06:23:17.300346Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/index2.html?shareName=88258280","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":true,"md5":"16a6fe9ed24f18ca07e1bbfb150a125b","sha1":"7575b1d3cea2806ce6a3988916500cfcd111c934","sha256":"76b4c93663f277a483468cd9406de1b621e1c43721ab7b175e8427acd9ccdcfc","sha512":"5adf8389859bfc9caa4291019218d30b726fe6bb90632e6e2b1e14ba45409e74ed49741dc4080c38b3756f7463bf34fdfaf0f5a3817fc4b03beb2cc83220f4af","ssdeep":"","tlshash":"e851e0c0f74d357b0677aa1a5aed72cade3c00319c5658bafc604d26d8e923b518ed14","size":3135,"data":"","first_seen":"2026-10-04T06:23:02.471109Z","last_seen":"2026-10-04T06:23:17.301157Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/index2.html?shareName=88258280","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":true,"md5":"3fa4473f25b70cb0b72896ffed4528cd","sha1":"6de01067bc06037d19aa0389ae27fac4f429183b","sha256":"ec2c419c707b6c5d8131581a5f626b41bc3f68f5c8e266e15953cc0c9849ce0d","sha512":"799e29f75b41196cdca36521f08829c24990039b9969acb338f96fa856c70e9ab91475244c891281f3e28bb0582bb735b39b641a0098e8b2d8cc0f5fe04361e7","ssdeep":"","tlshash":"30119e54f9e583c9a97f30613b17275c301a326b1044d804fecf23046f18c2f698a6c6","size":988,"data":"","first_seen":"2026-10-04T06:23:02.472879Z","last_seen":"2026-10-04T06:23:17.301951Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/js/swiper.min.js","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":false,"md5":"b36bad31d359f84f524b3b717bca2690","sha1":"1d3140392dc35099ad09c34b0a7012a34bd6842c","sha256":"23f560595a3b312980648a0bbe18583918f0b36f104cb2177e5d7031624074cf","sha512":"c4cf481ccc692a31e8c6bbf9560b7327a81425a8c2c55a877b6aada74b06238e949ff59e5b825c1b66a066a5919c3f8bce54f1340225fd516de53f76e1b13c8a","ssdeep":"3072:wsYR/IWH28wysj4DC3zKcMwigNM0GgQHSa82AFQVGSU:rY9IowysvzKcMwlM0GgQHSa82A9j","tlshash":"ddf39585e3dc256ac993710f8e7dc5c8927d543aba1188be7dac54d92c9c82c03bdeb4","size":161332,"data":"","first_seen":"2026-10-04T06:23:02.401539Z","last_seen":"2026-10-04T06:23:17.274317Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/js/jquery-2.2.4.min.js","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":false,"md5":"a041e21db7c08523ade457437e125735","sha1":"473775e13d4b5f6b7aa846f036d1b66a0c746db8","sha256":"de5b8a683a413df4efeb26a26f68946a5cdafeed543e5301215a96196d06b8c7","sha512":"f428bee6dfad49ee020fde35a4ec84b5f2746fba13b03e04c5a8f17e08b25891b1c228a3314c78c468b11c6873a4298505ed8f1a63608eff969076231dcf4dd7","ssdeep":"1536:MYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:n4J+OlfOhWppCW6G9a98Hr2","tlshash":"8683c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","size":85579,"data":"","first_seen":"2025-09-27T10:41:37.429856Z","last_seen":"2026-10-04T06:23:17.28145Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/os2.js","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":false,"md5":"d6db738daa5db707583f16a502ba3f02","sha1":"3dd8166b9514f50d71339f660a9bc81980e765be","sha256":"a745c0ccbbfdc5b0a6bb5a9785f4a3edd25b1896280130e50458f765e7cc62d3","sha512":"060d2de5c2090c335f1037f89e7b73b7055b8b358e7ed1f5660d7be086d361e63d455b8c72eb18e3b8401817e2557c774c9aa7c63dd4196e5fdf19cd38248bc0","ssdeep":"1536:7ab7c4ArjofL5+SuTbREYIk61nJXVxWRU:GerUfr5gDU","tlshash":"6e53f85a72c2b13a9357b0719c8f4845f63dad29624d88898a1dd5e4b8b482cc37edfc","size":65169,"data":"","first_seen":"2026-10-04T06:23:02.425447Z","last_seen":"2026-10-04T06:23:17.282104Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/index2.html?shareName=88258280","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"eval","is_inline":false,"md5":"ae3e12b7d4a50bd0694027697ba25706","sha1":"620e984cb5e902365d1929405a32596d86da4f41","sha256":"603203fccf22a2cb395bad15c07e2631cf873794df8804e66dbd2e6b5fc734b3","sha512":"1e7225ae0442e2ffba4ec3aae321345863ead92cc3c450250abe6e86de851753a6a04d822a31ec9930c1171eeda663188b0ee0af6a0656901223d202024bca44","ssdeep":"96:JXj9xqRS5PAABv0ZgpzNEXWLdbFE6Szwexlo9k+LDRkTkYzIS4Rc8p8NF/LJ2URI:NBxsS1cupzNEXWh1SsezDgYzn4RPpKF2","tlshash":"18c109183182a879c5ca9236084f524eb936706a658cd080e53adce4bfbce5b9137f36","size":5862,"data":"","first_seen":"2026-03-21T16:11:59.418095Z","last_seen":"2026-10-04T06:23:17.298516Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"https://20010926.com/","filename":"https://20010926.com/","line_number":47,"column_number":12},{"level":"log","text":"不兼容","filename":"https://20010926.com/os2.js line 17 \u003e eval","line_number":1,"column_number":4976},{"level":"error","text":"Error:NetworkError when attempting to fetch resource.","filename":"https://20010926.com/os2.js line 17 \u003e eval","line_number":1,"column_number":4343}]},"http":[{"url":{"schema":"https","addr":"20010926.com/img/yhc.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.329Z","timestamp":1791094930329,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/yhc.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-37c11\"\r\nexpires: Tue, 03 Nov 2026 05:13:07 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":228369,"size_decoded":228691,"mime_type":"image/png","magic":"PNG image data, 910 x 1120, 8-bit colormap, non-interlaced","md5":"bd10366632abd74a52ff58c9a3d652a2","sha1":"c3f7a1ce640d3b25c8d7c7dacfa333c04699176b","sha256":"a06ead73b29dc0d68770cb3d0d13bc748b48e055c88c49e53fcd224b60048d74","sha512":"23fcff555717ad1c48b22330be22d86b59c1afb43da12dcace0de49a86c293047db37e330f32befc64f862e1885715a5823d8e159e77152c2233ac8e2a824f50","ssdeep":"6144:7Iu/CRY5mCZkbEjC4yiWSW/CAdvvRd/RuxSyb:sY5zXNyiWSeCg//RGSyb","tlshash":"e724239cc151060e7a28f55f49666816f7458d3f54d0a30cc9820a59eb8bf2f7abf38e","first_seen":"2024-10-11T08:29:39.180942Z","last_seen":"2026-10-04T06:23:17.297953Z","times_seen":4,"resource_available":false,"data":null}},"time_used":178,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/playgame5.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.350Z","timestamp":1791094930350,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/playgame5.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-67dc\"\r\nexpires: Tue, 03 Nov 2026 05:13:09 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26588,"size_decoded":26948,"mime_type":"image/png","magic":"PNG image data, 200 x 260, 8-bit colormap, non-interlaced","md5":"d8ef49628fea6e0fff1aba19b18ed5ea","sha1":"dd43c98674033c0e6f9ce3132a1b205c21c44ba9","sha256":"9f392951a65b838caccd1033563decb571952fdeca9aa4edacda960fc5d8b822","sha512":"fb479bce7363f310fd59efc85ea03190f00fa9aed925ebe743ad7f4d6b921d31cba56fc6782aa231583057ca15231812cb1a76ba1bb267ad23f9f1b7e14ae382","ssdeep":"384:GorI3JlWVax5WiR8KgPwlIowd/Fm3WUOtZ/fTbsjuYyUkZqrNsxB4sKLKxA6bv:PqrnR8rYqbd//fTAaYyUSn7Y/6L","tlshash":"f5c2e03d8aacd60f450c00f52525b39994730bbb3ab087473e45eaa88917591dd3dfe9","first_seen":"2024-08-17T10:39:32Z","last_seen":"2026-10-04T06:23:17.285947Z","times_seen":385,"resource_available":false,"data":null}},"time_used":290,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":290,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/playgame15.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.360Z","timestamp":1791094930360,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/playgame15.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-5c15\"\r\nexpires: Tue, 03 Nov 2026 05:13:09 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":23573,"size_decoded":23933,"mime_type":"image/png","magic":"PNG image data, 200 x 260, 8-bit colormap, non-interlaced","md5":"f07afe37c312275559d321981ca5d017","sha1":"621a249f8e714c6a2dd802bb90d533f588618b92","sha256":"ec42d297fb499ef3fd9dc986dd09e4dbf951509b216eb7ff9e3157b9b7041dbe","sha512":"40097f95301ec9a9af200aeab07a740d748293645bc93ca93d8209fa1dc272039add3673e384054079105b164b4d1736c80de911784cb41539e3e37a2f701a7b","ssdeep":"384:4xumhfCrQm25nYNZSaWa3lYD7NoDS9Sef9fTL2HxgdOnIKS5nE1fXdkhFtkclxTh:4Ze25nc+D6DS95f9TL6xGOnIJ5nEIVkg","tlshash":"fdb2d044b03e1c49d88a5e5eb230e5de1dd42b7298330413127a4e85ea33c2ee98b37e","first_seen":"2024-08-17T10:39:32Z","last_seen":"2026-10-04T06:23:17.270197Z","times_seen":372,"resource_available":false,"data":null}},"time_used":337,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":337,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/card05.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.365Z","timestamp":1791094930365,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/card05.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-395d5\"\r\nexpires: Tue, 03 Nov 2026 05:13:10 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":234965,"size_decoded":235386,"mime_type":"image/png","magic":"PNG image data, 280 x 452, 8-bit/color RGBA, non-interlaced","md5":"9d7b2853327fb48d3779939966cec63d","sha1":"4c8c8557ea560069ca3901212554da539b4d6002","sha256":"3531bddb525c356c13679b843e03c9351697a9c89df8002c85c6df78fa164ccf","sha512":"df8abe7a23570cd65466a73e4370e7b1a13c3d32ab39c0ebe1e3614bd5aa8b0ca152f30ac25f976522e71f5bc9a6c1a6a341d930c5bc01004b274547fe440405","ssdeep":"6144:MsRNctcx5jb5aBhHTYfwe4wehKFh6Wccl2nMLtk:MsRNcyx5jb53Ie4LKGWccsnMS","tlshash":"d634238eb1eaa236418501df296d5f4818fcb9cdeecc07e775311176ec8e48468d6cd6","first_seen":"2024-12-01T01:30:06.795859Z","last_seen":"2026-10-04T06:23:17.292298Z","times_seen":19,"resource_available":false,"data":null}},"time_used":331,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":331,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/closebtn.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.509Z","timestamp":1791094930509,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/closebtn.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/css/style.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-11cb\"\r\nexpires: Tue, 03 Nov 2026 05:13:09 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4555,"size_decoded":4599,"mime_type":"image/png","magic":"PNG image data, 140 x 140, 8-bit/color RGBA, non-interlaced","md5":"40633e16323b8d067379347aef1c4429","sha1":"af22ef675f93f468cf390ef76cfc3e15fd8ef36a","sha256":"7ee664f36413ebfa7a966bb55b34fd356bfa6f722ec9fc448f7428b3918b847b","sha512":"fa4df3379ae969ffdded14405b7d389097529ab56215964bdf779509b1cfc180ae083c4920258bfed110f54145ed3bcfc156fe9b8801e65a0c316b936516620c","ssdeep":"96:j2QbKmMErMqm9HI3I+GzMJG7Vh3QfFafaJeWNjhmDZWC:rVMYLKo4fMwVh3Ffce+j3C","tlshash":"f7912a67b95c8f485207aa675da5405a18578600d3c3fc60b69a70373ef45bde68d3c8","first_seen":"2024-10-25T07:37:51.917015Z","last_seen":"2026-10-04T06:23:17.297305Z","times_seen":11,"resource_available":false,"data":null}},"time_used":248,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":248,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/bottomdown.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.511Z","timestamp":1791094930511,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/bottomdown.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/css/style.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-1a4c\"\r\nexpires: Tue, 03 Nov 2026 05:13:09 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6732,"size_decoded":7092,"mime_type":"image/png","magic":"PNG image data, 200 x 60, 8-bit/color RGBA, non-interlaced","md5":"b505caba5ae6a7820251058497d6d7cd","sha1":"36b02a6b58e5d3e10ccd23a17e9764280620771c","sha256":"1a54d354250e23070bef26102d2840ec436da01670b29b03b18d314c672e0538","sha512":"c759f2ca0673f15b6fefb93d053503a5acdfc5da060b723ca3d2cae442d4c74390895d2c21f4d427d5c180f5d167495d7459fd90cc378ec8229f263829cc1c45","ssdeep":"192:ZhEfg5rAuFDFw/wzmQLB7A9dW2WKJGBzIvvuTNxTm:DE8FDFw/wK0B7AKxIvvuvTm","tlshash":"e3d19d61cae7597811ef3cf74af4480b2820768e2713c4494df857830dbbb7a21f1994","first_seen":"2024-12-01T01:30:06.768853Z","last_seen":"2026-10-04T06:23:17.280827Z","times_seen":20,"resource_available":false,"data":null}},"time_used":246,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":246,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/playgame4.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.349Z","timestamp":1791094930349,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/playgame4.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-621f\"\r\nexpires: Tue, 03 Nov 2026 05:13:09 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25119,"size_decoded":25479,"mime_type":"image/png","magic":"PNG image data, 200 x 260, 8-bit colormap, non-interlaced","md5":"e4c4bd0ea48905eb4558a39c451226ab","sha1":"b7135f47ede7d6cdc9b287e928e574edb4efb14e","sha256":"add9b69a7d87ffbe29fc2129c3bec1bba5f64e1870b54aec1bd8e417b21871f2","sha512":"441bb0ee284c9d7c9c4962b9f5b99aecdc36614302ca7f6efc491caf212f286a65b2222d515a4654f4c87334081703febf321dfc74e95151e4bc7b0358f7e5a2","ssdeep":"384:PuzSby20LwyymkjDkDbAtomC/OtUrWF0oq6VeJiY1zNWxaV8MqeUaF6oW/DORcRf:PaQjFDkgC/8UreFVe/xEMCB68ScRn","tlshash":"b9b2e08cc56119fe68019a93cc6efbb7061dbd029a0ce070c195e0f58e79348a9b7e0e","first_seen":"2024-08-17T10:39:32Z","last_seen":"2026-10-04T06:23:17.294835Z","times_seen":386,"resource_available":false,"data":null}},"time_used":291,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":291,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/playgame7.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.352Z","timestamp":1791094930352,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/playgame7.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-a0b1\"\r\nexpires: Tue, 03 Nov 2026 05:13:09 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":41137,"size_decoded":41502,"mime_type":"image/png","magic":"PNG image data, 200 x 260, 8-bit colormap, non-interlaced","md5":"1a3d3671b1b7686ac2128e65de3c2fa7","sha1":"4d07d678e397e51d60fb090e9a6ed6d53fb4b0b4","sha256":"bc6c1b5c8f9bc04d38085a5d57df6c8ceebbcd38d72f47ae3594d7b3dca69853","sha512":"ea786246060c4afa8a996c0eb5c1ba1bfe8f9336c50bc2bfcfd30cba2de75775e7392c101f268240dcb85d7c63f7b35872ddb2a8a384d95324e33665f0aa9367","ssdeep":"768:ZxSKIc7uILPZbMhIV2NUlBFkE2CBlmzeooXi+57QW53XbP:ZE9NIjWqV2KWRIlUV0TT","tlshash":"0d03f16ed58fe972fa5c3e0896a34b16e35c973d3e482330192918161e830eb5f58325","first_seen":"2024-08-17T10:39:32Z","last_seen":"2026-10-04T06:23:17.286531Z","times_seen":368,"resource_available":false,"data":null}},"time_used":288,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":288,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/js/screen.js","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.114Z","timestamp":1791094930114,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /js/screen.js HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 661\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\netag: \"6ab47b60-295\"\r\nexpires: Sun, 04 Oct 2026 17:13:07 GMT\r\ncache-control: max-age=43200\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":661,"size_decoded":997,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text","md5":"3f6f131f8448e32e753636f5e08abb30","sha1":"5b942844c04bf5dc088f0f3bd65b4713eba7560e","sha256":"dc3e578dd1a9fde1a8247b4ef3cb586080816cc12b2d3ca7989b994c60543bba","sha512":"8da964c3fd564c7f2ffb9591fb5516af145d8a275482e9cf3dd4e9e0ba0e0351c21d36ffbb0ca1de403eaec0f04c2304af775593cd2d42f35fe64bc25beb04fa","ssdeep":"","tlshash":"1d017d3a64d0163991673c4b36bf621e6d7e5142232e5410fd3cc7908f92866c575fd8","first_seen":"2026-10-04T06:23:02.390276Z","last_seen":"2026-10-04T06:23:17.289878Z","times_seen":2,"resource_available":true,"data":null}},"time_used":124,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":124,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/js/decryptImg.js","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.116Z","timestamp":1791094930116,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /js/decryptImg.js HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-d68\"\r\nexpires: Sun, 04 Oct 2026 17:13:07 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3432,"size_decoded":1486,"mime_type":"application/javascript","magic":"ASCII text","md5":"f98447b271f3d92ce28f9d3198712626","sha1":"bbf2bb61f12955e083814789bdd2a70e80448e6e","sha256":"08d8cb4d5d8dbff216f7c25a149566539421d3392712d00090b2339f2f663f31","sha512":"e8641823af3ced6be5d8dbf67bf50aaa939bc6d9f84d6e3c0a2ae20fc0e727efece547a43d3056e21b0c0c8d353f507c5aa65b6133bd2106e5317a98ffa2fb9c","ssdeep":"","tlshash":"5d611098aea810b93b133475eaff424470b448132118ce19f85df1515fb4e35e2feae9","first_seen":"2026-10-04T06:23:02.392414Z","last_seen":"2026-10-04T06:23:17.279219Z","times_seen":2,"resource_available":true,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"d37uxtopjf4fiw.cloudfront.net/dncj.gif","fqdn":"d37uxtopjf4fiw.cloudfront.net","domain":"d37uxtopjf4fiw.cloudfront.net","tld":"cloudfront.net"},"ip":{"addr":"65.9.60.213","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.342Z","timestamp":1791094930342,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.cloudfront.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 25 Aug 2026 00:00:00 GMT","end":"Wed, 10 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"5E:9C:8C:03:23:F3:2C:16:F1:D3:F8:2D:AE:8E:8E:2D:88:E9:60:56","sha256":"BB:D2:A7:53:57:A1:50:6D:AC:51:47:E7:F1:6F:3E:26:93:2E:AA:72:59:0F:B9:AA:5F:E3:C3:E3:99:D6:69:2B"}}},"request":{"raw":"GET /dncj.gif HTTP/1.1\r\nHost: d37uxtopjf4fiw.cloudfront.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: image/gif\r\ncontent-length: 2652469\r\nlast-modified: Mon, 10 Mar 2025 14:57:15 GMT\r\nx-amz-server-side-encryption: AES256\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Sun, 04 Oct 2026 02:00:12 GMT\r\netag: \"0f9b376a00a51d0f3727b033d9931052\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 6a5b7b01c87fd24c09aedb45d99294e4.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN52-P1\r\nx-amz-cf-id: _tYV-q91TyX3grFp0zKwGqhkoFdEF3e89U610m5NxfUqyWyzG-vguA==\r\nage: 15720\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":2652469,"size_decoded":2652988,"mime_type":"image/gif","magic":"GIF image data, version 89a, 653 x 731","md5":"6020b784c852aa53fa7da105782d0910","sha1":"f96fc6605af70d1259a466ffcfa6152694cbee7b","sha256":"39d637909605dcb62a2a0e88941a1b1da6a4e43d80e6f796835d2d09ad0f00c0","sha512":"b045f7dcb4d878a57deb1f747d02f8d5a4445ca6fa823edc182b2b75831f6446d0a66c76df0451b2df002a5c90aff5fc340adede467852956dd0dadff5fc4689","ssdeep":"24576:AyjrUVL6tw+CurXh4K4Vz9ZGg+RC0iwEwp7aZ6xnw:3/oTOhd4ZGNI58w","tlshash":"402533229112de522ef2d2a684bbe505e1f37e6d618760300cacf6c7cb1b4b29555f73","first_seen":"2025-10-11T21:23:17.063439Z","last_seen":"2026-10-04T06:23:17.294182Z","times_seen":3,"resource_available":false,"data":null}},"time_used":226,"timings":{"blocked":-1,"dns":24,"connect":19,"send":0,"wait":38,"receive":125,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/title1_play.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.344Z","timestamp":1791094930344,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/title1_play.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-35c9\"\r\nexpires: Tue, 03 Nov 2026 05:13:08 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13769,"size_decoded":14129,"mime_type":"image/png","magic":"PNG image data, 357 x 63, 8-bit/color RGBA, non-interlaced","md5":"63d8ea21b39164b44ef2219bb43c1475","sha1":"48a1b39fb46e8693113db61a5f02648d1aff9b55","sha256":"9c99ae0e91c689a8ed438439f8a6cd386363a5aeb7e08245ff78d625cdde89c1","sha512":"3fbca95ea1134005e93dcdd75221fad15302a08d94829af2806c04ac2e89931fe0b9403c7bcff2909e04b41627696597ece7b03d307a3892a2dc87cf16931b1b","ssdeep":"192:sBxlW7MrDpmbIzH+f8+I6RPY5JUEXVFirPIplMtNhMdVcOBIzMk1/6LKfmnmUfS8:sBT1mbkE2SEXsulGQV4zR/6L/nmUFgj+","tlshash":"1952cf23dbc19dd9e98df347c8c848544dad9fbade0f8259cb52740ea1e201c192bec6","first_seen":"2024-12-01T01:30:06.786543Z","last_seen":"2026-10-04T06:23:17.274971Z","times_seen":302,"resource_available":false,"data":null}},"time_used":295,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":295,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/card03.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.363Z","timestamp":1791094930363,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/card03.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-3b44b\"\r\nexpires: Tue, 03 Nov 2026 05:13:10 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":242763,"size_decoded":243189,"mime_type":"image/png","magic":"PNG image data, 280 x 452, 8-bit/color RGBA, non-interlaced","md5":"31048768d79d39b5ade37b235e23be3e","sha1":"fe24253da581dac5aed12a2717b13e319e91cb97","sha256":"042ec72cdacea77ba5307a313fe627c365b9dd7d98117ef3c3c8a52e20ce7ccf","sha512":"5d778cb2adff10e2dfbb968680f8087c52c9f3a5809f8543964bbe75e04f50534a2cb633d40922da4362619514e9f6e634a12e3abec30c60cba6b1ed38b44b95","ssdeep":"6144:kITtbezghPeVSIjkuoXZnFuzvAyTLEeIfvddfcRSy9k:75beeySldPyTKvddfcRSKk","tlshash":"bb3423d74e85019b0684d2661bbe953eb98fd091977250dac4ff8c83f698e73388c6e1","first_seen":"2024-12-01T01:30:06.775942Z","last_seen":"2026-10-04T06:23:17.288324Z","times_seen":19,"resource_available":false,"data":null}},"time_used":333,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":333,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/card04.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.364Z","timestamp":1791094930364,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/card04.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-2e734\"\r\nexpires: Tue, 03 Nov 2026 05:13:10 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":190260,"size_decoded":190653,"mime_type":"image/png","magic":"PNG image data, 280 x 452, 8-bit/color RGBA, non-interlaced","md5":"949e1c6cccdb8c51b285551f462d3999","sha1":"5af66402f6dd25d77a8d2e2f90818a835c1b933b","sha256":"69500bb36b77c76f3e74a0944bff014aced3bdbdf78b948d09616663da0b1e3b","sha512":"0a1af474527f295bd870ff9471d0f0b9c47f52a3f99c5064225f668835284ed0bfae82fe82677f74589b3bcbd5a4211ade9cc09c7bb2553e64eb5d5e12a50f5b","ssdeep":"3072:GVJ98Rup+/vbU8ihhpNWebMlhyD5hn6uj+++qtnuYSGSErUxCr/hXZ467qiG+zWE:y8W+/vbchIwchyDTnLxduYSdiZ6iGA","tlshash":"7d0422a9e094b826fdb7c3139f09262cd77a47650bb5b9eba0754b1688f54c834e334c","first_seen":"2024-12-01T01:30:06.758803Z","last_seen":"2026-10-04T06:23:17.291676Z","times_seen":19,"resource_available":false,"data":null}},"time_used":332,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":332,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-04T06:22:08.577Z","timestamp":1791094928577,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:09 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-803\"\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-04T09:32:38.525077Z","times_seen":18823076,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/js/swiper.min.js","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.117Z","timestamp":1791094930117,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /js/swiper.min.js HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-27634\"\r\nexpires: Sun, 04 Oct 2026 17:13:07 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":161332,"size_decoded":38108,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"b36bad31d359f84f524b3b717bca2690","sha1":"1d3140392dc35099ad09c34b0a7012a34bd6842c","sha256":"23f560595a3b312980648a0bbe18583918f0b36f104cb2177e5d7031624074cf","sha512":"c4cf481ccc692a31e8c6bbf9560b7327a81425a8c2c55a877b6aada74b06238e949ff59e5b825c1b66a066a5919c3f8bce54f1340225fd516de53f76e1b13c8a","ssdeep":"3072:wsYR/IWH28wysj4DC3zKcMwigNM0GgQHSa82AFQVGSU:rY9IowysvzKcMwlM0GgQHSa82A9j","tlshash":"ddf39585e3dc256ac993710f8e7dc5c8927d543aba1188be7dac54d92c9c82c03bdeb4","first_seen":"2026-10-04T06:23:02.401539Z","last_seen":"2026-10-04T06:23:17.274317Z","times_seen":2,"resource_available":true,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/playgame8.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.353Z","timestamp":1791094930353,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/playgame8.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-8c3e\"\r\nexpires: Tue, 03 Nov 2026 05:13:09 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":35902,"size_decoded":36267,"mime_type":"image/png","magic":"PNG image data, 200 x 260, 8-bit colormap, non-interlaced","md5":"42696c028aa6896abbeb861e7a4b0c64","sha1":"3b8ceae3d32757fe57d6a877c9f3cab9959e951f","sha256":"00f9eb0a9c75c97459fbd74ddde5f6d9ed174e3391eb8be8f41334d9ad482f7c","sha512":"ed9ac4fc5d8401f72da2ef51a6395fd76ba0a5f4007391f43ed473bcf5badffe496034f46e613fbab235dea32f7a20c5384ec28f54643bf16c978a6524e04577","ssdeep":"768:LHLDPgheFrpUBIgnPVGmN/6zmXtc6U9C0ZmMriP1:fDIYFtUBhnIy/60tcTCemMO1","tlshash":"aef2f252567353f3f2a9d2d6663d7acf1934c64cb81ab4d9fa70114a28ce1513928f0f","first_seen":"2024-08-17T10:39:32Z","last_seen":"2026-10-04T06:23:17.28714Z","times_seen":369,"resource_available":false,"data":null}},"time_used":287,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":287,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/playgame14.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.359Z","timestamp":1791094930359,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/playgame14.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-8945\"\r\nexpires: Tue, 03 Nov 2026 05:13:08 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35141,"size_decoded":35506,"mime_type":"image/png","magic":"PNG image data, 200 x 260, 8-bit colormap, non-interlaced","md5":"ba00a88cbf5dc4d1c4ce05285493d625","sha1":"b01938a6164b1a485962b897054e615d12146c9b","sha256":"f082e9a243799ebd0fd6170c67f8eb2ef5e3b1ce47299af4a8aefb89a3b0721d","sha512":"6b1f67d09616d889540a413ec014d1767444c99eb806ec994f5bc828ad9fee38215a6ecf9b764a1ff2242ecda18b4696b4980455403f19c98efc6adbab272012","ssdeep":"768:mDehLRKgZtbgSlB8CjPZ6DTVPOURfT3cBBP0:mDehkgHbPjPADqBN0","tlshash":"2af2e151a251e3e7f9b0b349883f1e2aad89b2273a3d0451a4d731d3a3218c429b7d6c","first_seen":"2024-08-17T10:39:32Z","last_seen":"2026-10-04T06:23:17.296109Z","times_seen":369,"resource_available":false,"data":null}},"time_used":337,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":337,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/title3_card.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.361Z","timestamp":1791094930361,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/title3_card.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-417d\"\r\nexpires: Tue, 03 Nov 2026 05:13:10 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16765,"size_decoded":16861,"mime_type":"image/png","magic":"PNG image data, 357 x 63, 8-bit/color RGBA, non-interlaced","md5":"9eea0c2375755869ef4c3030db53c38a","sha1":"c4e89fce8358addbbc84b13bbcef73e678fe06d4","sha256":"a60f1b8fbf42985ce95cbe2e22f0769200ade8ad3a93ba0c374cb8c69deda1b9","sha512":"5dbcb0f872f43278e647046d234976ae66e3422b4edada6762a3c4c35dc5451ca9b331c3d76aed4754813d659ac7a86a9d1354f719e24e9121d3020ffca7a5d8","ssdeep":"384:dq8hCgWrXFn0dCEOADDMgFn1wOi1tp06rheb:dq8hCDkem+vcOq","tlshash":"4172c02e4bc47b48f2b3de97e51622026707cb61c859f061b0abcd57c8a79652d1dce2","first_seen":"2024-12-01T01:30:06.780897Z","last_seen":"2026-10-04T06:23:17.287747Z","times_seen":11,"resource_available":false,"data":null}},"time_used":336,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":336,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/quality_3.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.371Z","timestamp":1791094930371,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/quality_3.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-425f\"\r\nexpires: Tue, 03 Nov 2026 05:13:10 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16991,"size_decoded":17351,"mime_type":"image/png","magic":"PNG image data, 150 x 180, 8-bit/color RGBA, non-interlaced","md5":"ac3cef43b52b289a10055ed9cc41897b","sha1":"6dee9fa178a66a00ca712431a82eac970d170d63","sha256":"0cf6212a45f0f4202adc614215d573a176d376ad53b14da3d20ef4acffa0f413","sha512":"9f11f3e17e99c06f6fb34f0fddc95b8e7b61804caf85fbf7efffd4d6d108e0c95eb93c488c7d36624af4d882f11957db643115464e41677c1c6a7333047fefe2","ssdeep":"384:qdATw8qOaGtABYhFfcj4SUNLBaHqNw/3UxIbqumm1xu8o8YTu2:OTJuFfcj4SqLjw/lnG8o8YTB","tlshash":"b372c089040f2a3985a76febf6820736965a819bd423ec4346cf3a1b100bd562b7d3c8","first_seen":"2024-12-01T01:30:06.761819Z","last_seen":"2026-10-04T06:23:17.272237Z","times_seen":19,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":326,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/quality_4.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.372Z","timestamp":1791094930372,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/quality_4.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-4937\"\r\nexpires: Tue, 03 Nov 2026 05:13:10 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18743,"size_decoded":19103,"mime_type":"image/png","magic":"PNG image data, 150 x 180, 8-bit/color RGBA, non-interlaced","md5":"26c0f9b54b63334b8ac5949eac3bcb49","sha1":"13419d9cc1ac57013339d3ae7c3b6f496880dc28","sha256":"2c799fccdc1e901631c20364aaaca02b8b8ee4d90b70bfcb56b165c2a2c5db5e","sha512":"fe5dcce4fac832c8e0cd5c4e68e5b2ac2293f1e37d19aa755a7431627f8a055bdba7b7810c0c67e0fec11a189cf739a8aba4e3ed0053d9a296340fc6fd81bf9d","ssdeep":"384:ChBHrZyOKvFpLEWuk8cDdNE8GMl1royE0+6AtLP1Hs3Vyx0XvhwJBu:6BHrUOqEovDdi8f1kj0MLWYKXvhG8","tlshash":"7582e163fd044e530652434b506af3840d9f5f394aa75e0ba413bf58e6b7e019bce8da","first_seen":"2024-12-01T01:30:06.797013Z","last_seen":"2026-10-04T06:23:17.296684Z","times_seen":19,"resource_available":false,"data":null}},"time_used":325,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":325,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/service.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.374Z","timestamp":1791094930374,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/service.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-6834\"\r\nexpires: Tue, 03 Nov 2026 05:13:08 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26676,"size_decoded":26779,"mime_type":"image/png","magic":"PNG image data, 100 x 140, 8-bit/color RGBA, non-interlaced","md5":"f3bc6a2c2ba9242a4aa961b5bc73545a","sha1":"0e9fbbf7e788fbfdeb514ab25d9aad4ebf763d2d","sha256":"bacd306fb9018a5051106484b2d1019e115b44c9fdc2f6894803dad2d635553c","sha512":"473ea733cb21b1cf3ba30b2a7c37db31f5d05edfed6d921e7e8e869bdb0b43d98de90fe8faa62d8120c38d471b0b126ae0ac6e5734d14043cc05020dca5dd312","ssdeep":"768:Jef2Sh0Cjej/mzhngeGDKwAaOpJsJFZ9Dtp:Jefn9jejyhngeEKwlbZTp","tlshash":"1fc2e10acc2b328cb280495fd0fa25bd68a518f5985da5f399d7631b78037a0e027dc9","first_seen":"2024-12-01T01:30:06.763034Z","last_seen":"2026-10-04T06:23:17.277534Z","times_seen":23,"resource_available":false,"data":null}},"time_used":323,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":323,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/index2.html?shareName=88258280","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-04T06:22:09.724Z","timestamp":1791094929724,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /index2.html?shareName=88258280 HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:09 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-377f\"\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Swiper","description":"Swiper is a JavaScript library that creates modern touch sliders with hardware-accelerated transitions.","website":"https://swiperjs.com","common_platform_enumeration":"","icon":"Swiper.svg","categories":["JavaScript libraries"]},{"name":"jQuery:2.2.4","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14207,"size_decoded":4038,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"9586d03ea44fe10e7a004f3997a12c25","sha1":"3322f960845d9eba028b720c53d61633bb263aac","sha256":"942c3fbb758d0a9fc8045ba5dc60b7e8d1ddd31d035b1772d847644608f7f373","sha512":"d2f8ac8173a1a0619a39e346f5625b932195a1c453b9a9967e44f3045138717da8a25cb83f6a6233a42599d4a28d86100c9edd7a24306a9e80e9ff9a601a41bd","ssdeep":"384:Ah9tqRUziTWnwFwEwHwGwtOlwIw7w6wGwtOywIw5wSwzwtOrECz/s8oc6mk3:439i","tlshash":"d352135456cd6df7013302822a3e328e289f4e37a923c8a2f9ff0a05ebd5d668d1f541","first_seen":"2026-10-04T06:23:02.41603Z","last_seen":"2026-10-04T06:23:17.278718Z","times_seen":2,"resource_available":true,"data":null}},"time_used":346,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":346,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/card07.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.367Z","timestamp":1791094930367,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/card07.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-3912b\"\r\nexpires: Tue, 03 Nov 2026 05:13:10 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":233771,"size_decoded":234189,"mime_type":"image/png","magic":"PNG image data, 280 x 452, 8-bit/color RGBA, non-interlaced","md5":"4861a97046d0cc98454a3ca17097d585","sha1":"b11bf65ae77b25ee4da15d83fd040e5d1f7c99a8","sha256":"42f02edb23fa086f78e4b31a44a0c8175a505ca167f22e5fb21a08d63a27564b","sha512":"5372df7f12180bae88a591cf48e59da31b5e096398c21cd763d50c5d3b8d2dbf6a477ad2ce052e3927c2a3cd7c9e4d135b6ee3e646318ecda4a2e09c3bf7b337","ssdeep":"6144:rkoCHqn/9p9kjvkK1MF25dzTJz1jcWQWvFf7gEx:rvMknkjvkT2b3JzGWh57gC","tlshash":"5f3422018bb9d0a1510a0d95ac6e8ba4c1bd7d9dc77cf794fefc8ce9e64b9c64d4200a","first_seen":"2024-12-01T01:30:06.777154Z","last_seen":"2026-10-04T06:23:17.293557Z","times_seen":19,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/quality_2.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.370Z","timestamp":1791094930370,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/quality_2.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-4e60\"\r\nexpires: Tue, 03 Nov 2026 05:13:10 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20064,"size_decoded":20424,"mime_type":"image/png","magic":"PNG image data, 150 x 180, 8-bit/color RGBA, non-interlaced","md5":"b70779170afbbfe1fedc80b0692ae7b9","sha1":"5abaa75ccab6ffee5db87199b4e784efd20a474e","sha256":"8ea8c19131194893fcca4c277027a18ec70659b01cf24037a4b54480547f18fc","sha512":"dece5f3e0485defbc85bfd769ea036aab7a4ed04502fe6e9c1c096029f118a9ef1f8bc796eb917b4b123d3614c83adea2e447072c8b3e05107bb1f079fa24c46","ssdeep":"384:VsPbQLUn4opgC6NcdkPeoABBtalxjsNR1U56ShlOxitO3qpJ8AgHd6:+PAUnSzIFdY7sNR1glQopJy4","tlshash":"2892e1d4653d503bc973d8911313ea8cefb12696ed0837c4f85a8ce9b44dd3b451c988","first_seen":"2024-12-01T01:30:06.783247Z","last_seen":"2026-10-04T06:23:17.280177Z","times_seen":19,"resource_available":false,"data":null}},"time_used":326,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":326,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/bottombg.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.373Z","timestamp":1791094930373,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/bottombg.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-721e\"\r\nexpires: Tue, 03 Nov 2026 05:13:09 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29214,"size_decoded":29274,"mime_type":"image/png","magic":"PNG image data, 750 x 108, 8-bit/color RGB, non-interlaced","md5":"a11ef28aaad8de2e224b8fe6a057e658","sha1":"0a1f330c349d842bdac35c132b5a67a24f237388","sha256":"a6a0e4ad3c32d513c0065ac937f02d3e9dbb3f5dd2f81fd373945d56af0d3c78","sha512":"c4e6d4116541da0447b3b3ade9eb13f794f2d2133405baf21919ac768c38afe7c2f277db61043a56301be17e5e8366ff3b346f10425ca126bb7b1b59b1e421d4","ssdeep":"768:qVlmi7mhCjjBtJSl2Y2r+7opVpYNm9K876C3To:q4UcIFSsxU","tlshash":"02d2f1830340e16e05443e49a304cdd5b69299cce654853bd1b5fa8dfe7b3a7ea38b6c","first_seen":"2025-07-13T11:45:53.517521Z","last_seen":"2026-10-04T06:23:17.27291Z","times_seen":5,"resource_available":false,"data":null}},"time_used":324,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":324,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/favicon.ico","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.985Z","timestamp":1791094930985,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/favicon.ico HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Sun, 04 Oct 2026 06:22:11 GMT\r\ncontent-type: text/html\r\ncontent-length: 140\r\netag: \"6ab47b60-8c\"\r\nserver: openresty_edge\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":140,"size_decoded":325,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"710df0a9fd3319ce46d908acb4262389","sha1":"9b77218ed9b4d20918c17302b288bf6194ac874b","sha256":"aa3cf0871f04876f5d031a35ea6b8ebaf20d8679ee343a5958552691fe404421","sha512":"bcb605e3305d637dc3505bf2e4656bc09d2bc1fae312b60b7c675e6e371daf79d572ead3358e73d58aed685094081d3f02d9362b4a6d4d90d4a0566f235ee67b","ssdeep":"","tlshash":"96c09b5d755356485913156167c33641d197837fa8aa84510943c593e0cf69ac4c73a9","first_seen":"2026-01-08T09:45:31.423944Z","last_seen":"2026-10-04T06:23:17.278177Z","times_seen":34,"resource_available":true,"data":null}},"time_used":345,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":345,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/os2.js","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.120Z","timestamp":1791094930120,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /os2.js HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-fe91\"\r\nexpires: Sun, 04 Oct 2026 17:13:07 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":65169,"size_decoded":24317,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (44736)","md5":"d6db738daa5db707583f16a502ba3f02","sha1":"3dd8166b9514f50d71339f660a9bc81980e765be","sha256":"a745c0ccbbfdc5b0a6bb5a9785f4a3edd25b1896280130e50458f765e7cc62d3","sha512":"060d2de5c2090c335f1037f89e7b73b7055b8b358e7ed1f5660d7be086d361e63d455b8c72eb18e3b8401817e2557c774c9aa7c63dd4196e5fdf19cd38248bc0","ssdeep":"1536:7ab7c4ArjofL5+SuTbREYIk61nJXVxWRU:GerUfr5gDU","tlshash":"6e53f85a72c2b13a9357b0719c8f4845f63dad29624d88898a1dd5e4b8b482cc37edfc","first_seen":"2026-10-04T06:23:02.425447Z","last_seen":"2026-10-04T06:23:17.282104Z","times_seen":2,"resource_available":true,"data":null}},"time_used":331,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":331,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/download.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.344Z","timestamp":1791094930344,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/download.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-e694\"\r\nexpires: Tue, 03 Nov 2026 05:13:08 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59028,"size_decoded":59398,"mime_type":"image/png","magic":"PNG image data, 475 x 90, 8-bit/color RGBA, non-interlaced","md5":"e4280bad11df82e7723b4491c17e125c","sha1":"7a78376738d4a50ff750b1cc9fe50b9bc2334acc","sha256":"293a74dbf591179980aeb6cc57efbb7cf821c7363e8f47caa17107f41db12ea0","sha512":"4aeb488e881c5a8cb022393a131fbbaef201b0b9e5dc025de10c5221bd2cd060343cbd41360357a468b4079b2c2c9440dc08ef27836a8453f0c87427e8525885","ssdeep":"1536:FhSCm6tR2R8nbOARxVj020CVbjv+LzxLcF+uBHCRolhKDJh:r5R2R8nbvR82nexLcF+vmC","tlshash":"9143029e4588f41414d7912c8848752033f7e6f6886b69cb4b276ab1fc1fada7121fb3","first_seen":"2025-01-05T00:57:32.933964Z","last_seen":"2026-10-04T06:23:17.269498Z","times_seen":20,"resource_available":false,"data":null}},"time_used":296,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":296,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/playgame2.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.346Z","timestamp":1791094930346,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/playgame2.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-9325\"\r\nexpires: Tue, 03 Nov 2026 05:13:08 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37669,"size_decoded":38034,"mime_type":"image/png","magic":"PNG image data, 200 x 260, 8-bit colormap, non-interlaced","md5":"1bae99b04df40e5d3d411b80f678d6d9","sha1":"560834f9210bd28914d63acd765a498c2e0ab4de","sha256":"8b5a911c9d8349c754ef63cd6167dc14c1b9038ea8ec088555a33f462b6f2110","sha512":"3f2937e6f9ef4753c7491b917844b6cc8f86bcbec47db1addb2d7281dcd82f072fb228c3714065edadba24bf27d087803d0a6ef231d520f1e9e0eccf61e48df9","ssdeep":"768:UJ/ou8d5sZI4/qEt/OwmH54i017WqDbFbFpdD3dE+51lbWjdmGOW8pEJB:UJu5GJzOBf017WmLfDq+51lb8mpWVJB","tlshash":"5b03f21a3077bd1fd367e0a419bdae64b5222ecccf19b3e4579c72e6478c64054088f2","first_seen":"2024-08-17T10:39:32Z","last_seen":"2026-10-04T06:23:17.275584Z","times_seen":377,"resource_available":false,"data":null}},"time_used":294,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":294,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/playgame10.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.356Z","timestamp":1791094930356,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/playgame10.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-7e1f\"\r\nexpires: Tue, 03 Nov 2026 05:13:09 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32287,"size_decoded":32647,"mime_type":"image/png","magic":"PNG image data, 200 x 260, 8-bit colormap, non-interlaced","md5":"31d32eae1e8bdb4372673249fb80bb82","sha1":"4f21d588fbf01698ed5ab2975ba4b528e9227a6e","sha256":"94973e06c958777353bfd31ffdbb787ccfb6d0dc9a64fb77f7d4c6ae80ffe541","sha512":"64709d1ef54bcfee321dc9d1c8c97aef73f79c58b5502d766c88db421744f98e22ce993d48bd8cf6c390a8e2fe49ddaa0e5b8256b256cd117e714f6bc58c324b","ssdeep":"768:t4rERxnOzOyKMMVyhE6sshu+MPfKbqgJ1kRiaxQfvugCXNqa7:merz8h8+S0D1kfxQfodqY","tlshash":"5ae2e1df0291551f5670ad5cc87db9278b4ee82b3c366ef2d008439616e5a0b4b4a2f7","first_seen":"2024-08-17T10:39:32Z","last_seen":"2026-10-04T06:23:17.2833Z","times_seen":370,"resource_available":false,"data":null}},"time_used":285,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":285,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/card01.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.362Z","timestamp":1791094930362,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/card01.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-3a4e5\"\r\nexpires: Tue, 03 Nov 2026 05:13:10 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":238821,"size_decoded":239214,"mime_type":"image/png","magic":"PNG image data, 280 x 452, 8-bit/color RGBA, non-interlaced","md5":"9fb38866a9995a3144f7a5bd54fa9740","sha1":"69e3f148ef41216ac31268117a46823a08f00b38","sha256":"dfc7010d9979e34a0a2eeed0d329203fbbe51e626e7dfe7a4a32be581dc48df1","sha512":"8433b8a8d3fe02b901576a46747d4c02d5ba2ef786b13402585a776b3b063111c10eaa860aae695b5b1ece8b050e0d816031bead9f240ec8b9866674ee036890","ssdeep":"6144:6sfHnT5P/7xJ+3Dz89rX91YNg4zk+ZJTSxlYIVl:J/TN7xJyDz8dt1UzDZlSxma","tlshash":"d13422e5e42ec673b811b8975526a8219dd0c10e97504e66c8feb7fc076c6180c7fabb","first_seen":"2024-12-01T01:30:06.774733Z","last_seen":"2026-10-04T06:23:17.270829Z","times_seen":19,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/card06.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.366Z","timestamp":1791094930366,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/card06.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-2a584\"\r\nexpires: Tue, 03 Nov 2026 05:13:10 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":173444,"size_decoded":173837,"mime_type":"image/png","magic":"PNG image data, 280 x 452, 8-bit/color RGBA, non-interlaced","md5":"13fc77e13166b60c48ac8abb3e51f98b","sha1":"592a37b43fde706293a5debf6bfdd6ea21ed6269","sha256":"dd6f63a80ecd587568cbd21a56702d44006873b74ce05ecf56656670d49757e8","sha512":"4c1fc2746a85f2fa36ee105fce6397193bc800e5b7ca3e156595798de2b12e38656f3138c4eb2e48d09ad0e2b9feb0d39ad1208e67c89c27609b7e002bcfe2d7","ssdeep":"3072:lrFeyqXpOfYfJ3LDBtTbU1jcLzVfwZ8rCNpoo9JiZ7I9R54W2pkzJEablTCUU:9FCAf03LDBtTbQwnVZrCnXo7Im7kz7Ta","tlshash":"7f041262bece7139ed2482dba52cd9745d535d20afa11372b94c31a47ba22b313181be","first_seen":"2024-12-01T01:30:06.760604Z","last_seen":"2026-10-04T06:23:17.292929Z","times_seen":19,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":330,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.frontstakecodenica.com:9527/download/site","fqdn":"www.frontstakecodenica.com","domain":"frontstakecodenica.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:20.924Z","timestamp":1791094940924,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"OPTIONS /download/site HTTP/1.1\r\nHost: www.frontstakecodenica.com:9527\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type,fwid\r\nReferer: https://20010926.com/\r\nOrigin: https://20010926.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-04T09:32:38.525077Z","times_seen":18823076,"resource_available":true,"data":null}},"time_used":1038,"timings":{"blocked":0,"dns":250,"connect":261,"send":0,"wait":0,"receive":0,"ssl":527},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/logo.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.331Z","timestamp":1791094930331,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/logo.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-51d0\"\r\nexpires: Tue, 03 Nov 2026 05:13:07 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20944,"size_decoded":21304,"mime_type":"image/png","magic":"PNG image data, 350 x 50, 8-bit/color RGBA, non-interlaced","md5":"f324d88b672271c7179be0172fb386ed","sha1":"2df32c13862de36964788d1f365153f997b681f5","sha256":"5e2c74776dbc7b5d7eb7695b65876054e026822d6c28aca9bf6cffe468cf6284","sha512":"3dde5d16076141e4278aeb94483d0f5b5bf814c58874a29b4bd682488d5926aee8cfbd3ad5782e17336d6d92f460adad078e626ce9d51aaeeb1777417676da17","ssdeep":"384:vdxhe9okyNqLJXI/l8wojzrKaBYIpfn+yFAyaqrquiXdzdFXPZ6T:1xhe8NOJXId8wkrKCYIBrFA6rcXl/PZw","tlshash":"3f92cfdd77378596b05fb028c48be4887e9b681aee7db5462eb2c82431463c5f1481ef","first_seen":"2025-07-13T11:45:53.48741Z","last_seen":"2026-10-04T06:23:17.290491Z","times_seen":5,"resource_available":false,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":254,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/hengfu01.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.343Z","timestamp":1791094930343,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/hengfu01.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-15edc\"\r\nexpires: Tue, 03 Nov 2026 05:13:08 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89820,"size_decoded":89680,"mime_type":"image/png","magic":"PNG image data, 750 x 220, 8-bit/color RGB, non-interlaced","md5":"a031e4b6c8820a52452842a3a7aa7852","sha1":"20fa3f342a346a01cec1acf44c3b9575fdd04167","sha256":"ffd2ad0ab512d79510de75a7dfbab838ce0881e336709df2020922f2e271257b","sha512":"dfc8c252db0c2d0539f5825a70fb08214dad178c839782fa55b80d34a1d27c872f0b3a53399035bcaad573bb698d6a175e699463dfb0e83e21233a9327136c64","ssdeep":"1536:GeQkPOuGEdIQOjGWa8Ti4hD9eoa/gtMinyiuO4MLRTNVpvtkeSvc:GAOUOjGWaq9BKinyiuILRTjpVkeSE","tlshash":"a89312f11a03de931e943422395e0eb7c233582a82744b98ff4c7d5d287bd66f618a9d","first_seen":"2025-07-13T11:45:53.50625Z","last_seen":"2026-10-04T06:23:17.284408Z","times_seen":5,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":297,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/playgame1.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.345Z","timestamp":1791094930345,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/playgame1.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-8e0d\"\r\nexpires: Tue, 03 Nov 2026 05:13:08 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36365,"size_decoded":36730,"mime_type":"image/png","magic":"PNG image data, 200 x 260, 8-bit colormap, non-interlaced","md5":"54f50cdc6551ea44a527dde7fbe22c36","sha1":"8b3bccc200cfcbec595fd26de552ff25c1123b3f","sha256":"c7fef7a6326a21de34a2e4edb8f66843592507373c69dce973fa1fee17b83ae8","sha512":"4c22da20d81602f20ed9c1b9f117d7751933e7e02d8f6cb181ccf8530c54b782a8c32daf727753b8e95812af2975312938dd1e6d165f26cbf5f72c9815a3f93c","ssdeep":"768:LT+8sF+oaHvzu2FD5JWsJJwbxhkcxwftBA79:LT+8sFnAv6kis0bf81BQ","tlshash":"2ff2f167becd02717d35cf9520deae25eb7bde8e3036e4205657c8f2981a080434d5a2","first_seen":"2024-08-17T10:39:32Z","last_seen":"2026-10-04T06:23:17.264511Z","times_seen":372,"resource_available":false,"data":null}},"time_used":294,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":294,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/playgame3.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.348Z","timestamp":1791094930348,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/playgame3.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-904b\"\r\nexpires: Tue, 03 Nov 2026 05:13:08 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36939,"size_decoded":37304,"mime_type":"image/png","magic":"PNG image data, 200 x 260, 8-bit colormap, non-interlaced","md5":"651dadb1a967303be0e70d48a41dae92","sha1":"27884c6075934b51be7426fd49f3b1e60865f235","sha256":"f738702c2fda79dc69fe9b253c68fb4c800bcd3b83b7cc1bd913fa33d4a263f1","sha512":"e1d76c6a0b1bf777080afc2a74e42c3707e88daa29b442a356d08db4cb5ae94ca5cb524574c99c273fabe4d7e19d22f79fae72bb06c90288f6df46fbd539f894","ssdeep":"768:azeRhPYXo9W+w/sXStPLhuDxeDk9I7iq2E8WPN6e:azGhPVmlJLUpIv8WPN6e","tlshash":"e4f2f1365279b3182811c2f15f1040cf699f96e78f0550dac8a7eefd5d1481c1ab6d7b","first_seen":"2024-08-17T10:39:32Z","last_seen":"2026-10-04T06:23:17.285019Z","times_seen":379,"resource_available":false,"data":null}},"time_used":292,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":292,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/card02.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.362Z","timestamp":1791094930362,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/card02.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-3913f\"\r\nexpires: Tue, 03 Nov 2026 05:13:10 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":233791,"size_decoded":234217,"mime_type":"image/png","magic":"PNG image data, 280 x 452, 8-bit/color RGBA, non-interlaced","md5":"79a353fb89a230704d555a322d657510","sha1":"220e4a32ef3a00495d9372ae23ed478058770c0e","sha256":"a58ac6588b52b4d80591fca57977386cca6612286cfe024f0cb36a5115b2f29f","sha512":"e343d78da4dc9984258cd7600bc5c6ec7b3b4727004dbe13a0860a3116ef74b8f2de6e0435f338faeb796bbbcb8b6acc3fca3434ab0957ae7c26ac32dfbfbe74","ssdeep":"3072:aDLBBQzIZIq3ZZwCB2E4gcTskAe6kTTI8i12Mn8qpvm83JMrT4iHfUeCVBPk:MTItqJdBN4JZN7TiktqF3CkzPk","tlshash":"e2342376fbef0062a7f90312480784eca804b51186bd8b540a51d7b2ede8df5e69cfd2","first_seen":"2024-12-01T01:30:06.757516Z","last_seen":"2026-10-04T06:23:17.29112Z","times_seen":19,"resource_available":false,"data":null}},"time_used":334,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/js/jquery-2.2.4.min.js","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.118Z","timestamp":1791094930118,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /js/jquery-2.2.4.min.js HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-14e4b\"\r\nexpires: Sun, 04 Oct 2026 17:13:07 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":85579,"size_decoded":30411,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32065)","md5":"a041e21db7c08523ade457437e125735","sha1":"473775e13d4b5f6b7aa846f036d1b66a0c746db8","sha256":"de5b8a683a413df4efeb26a26f68946a5cdafeed543e5301215a96196d06b8c7","sha512":"f428bee6dfad49ee020fde35a4ec84b5f2746fba13b03e04c5a8f17e08b25891b1c228a3314c78c468b11c6873a4298505ed8f1a63608eff969076231dcf4dd7","ssdeep":"1536:MYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:n4J+OlfOhWppCW6G9a98Hr2","tlshash":"8683c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","first_seen":"2025-09-27T10:41:37.429856Z","last_seen":"2026-10-04T06:23:17.28145Z","times_seen":13,"resource_available":true,"data":null}},"time_used":305,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":305,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/playgame12.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.357Z","timestamp":1791094930357,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/playgame12.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-8154\"\r\nexpires: Tue, 03 Nov 2026 05:13:09 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33108,"size_decoded":33473,"mime_type":"image/png","magic":"PNG image data, 200 x 260, 8-bit colormap, non-interlaced","md5":"200d7a53aed09e131b78cc81cec5cf8a","sha1":"bd9649dece3c1149962c4675a643d7a4604b059f","sha256":"93b88f75280a35b138c6889f57a1dac49d9bea898b620c03442eb4158768a379","sha512":"20b0cdbdeb2f04e57614d547ef5a865b41b9bcfd130de25ce8e72fb41f13160540394830deea41870033e9df8727148526cedade09c9a65e5c2eacc4f1e8861b","ssdeep":"768:zYv+K3f6dCPfFowIRBRdbji8g7sgTsqdSNiE0dO99ho7/QR:MId0fe/Q77sgTs/8koDc","tlshash":"bde2024643967534cad80922d33ce82de986eda972036b3a24bc770c82687f1479cf5f","first_seen":"2024-08-17T10:39:32Z","last_seen":"2026-10-04T06:23:17.28381Z","times_seen":369,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":283,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/playgame13.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.358Z","timestamp":1791094930358,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/playgame13.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-7697\"\r\nexpires: Tue, 03 Nov 2026 05:13:09 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":30359,"size_decoded":30719,"mime_type":"image/png","magic":"PNG image data, 200 x 260, 8-bit colormap, non-interlaced","md5":"027c0b73f6aeaed608f6bce9aac409ba","sha1":"417d05dc323feab51b432aec85d6bf0a5ce14625","sha256":"bc177fefe224f539b854c059b2b34258dcd53ea41473014ee7335869f9b3d6c5","sha512":"b934c7c3f4e9a77d7e51f09f12dfcd4cc2e82f7160b7e555d883b9b29f6f4eab2bd05db83cebf9f44c1fc039b78df7e7804479bbbfefc88c7125a1270828b9de","ssdeep":"768:MV7vdlVYsJ6C0OQO8UISgzYKdB+SsULIevtCbJOzwP:M5vdlVhQC3QpUI7B+SsULHOP","tlshash":"e1d2e102ed005d9f985795f0ed60201d3fa2147893f49371df32ed792ea6e2af6125c9","first_seen":"2024-08-17T10:39:32Z","last_seen":"2026-10-04T06:23:17.295494Z","times_seen":372,"resource_available":false,"data":null}},"time_used":338,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":338,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/title4_quality.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.368Z","timestamp":1791094930368,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/title4_quality.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-319a\"\r\nexpires: Tue, 03 Nov 2026 05:13:10 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12698,"size_decoded":13058,"mime_type":"image/png","magic":"PNG image data, 357 x 63, 8-bit/color RGBA, non-interlaced","md5":"2c19f9e477a410bff7188805151cef64","sha1":"3fd29b7e3d0330ea509b3aae27829634959d899d","sha256":"d9ac510900c639ec907d2f744e7488b0fbc0f5258dffedc21b1d695061c8f289","sha512":"b9fea8e95401fecd3da58c945c959dde72d399414059fda49fcf5b444a032b1397758772afb961d98b56e97068444a070169090bb7cf681efd547e88ca8de486","ssdeep":"384:yUUdhQ8oy3iRIxlxp+hoGvZj2ns5MjGtYxRRvoYiuBeb:38oy3iWVAdvZSKbIRRvoVb","tlshash":"4d42cf87ced25fe3b590a38f06d740846b889163913ebd458e70f2b5cb6c542d94ab12","first_seen":"2024-12-01T01:30:06.752529Z","last_seen":"2026-10-04T06:23:17.265586Z","times_seen":19,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/quality_1.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.369Z","timestamp":1791094930369,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/quality_1.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-46d4\"\r\nexpires: Tue, 03 Nov 2026 05:13:10 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18132,"size_decoded":18492,"mime_type":"image/png","magic":"PNG image data, 150 x 180, 8-bit/color RGBA, non-interlaced","md5":"74f0b000d1e27ebb329df01ac7507d09","sha1":"c5d9e171280e122cd15d2fb11e2a9af4e2b9e7ff","sha256":"5991ca56ead4c1e35844d59c49fe8ce8364c6fda39fcace46d1343eb20995d89","sha512":"6d9697025b1bb7c5e9204636dd6019f3399e9f5f7c59cb5f7c8bf9425e9206d26e064150f90e8e8368b018f718983981b608fe1f6152c2f3a810ec0c601adc8e","ssdeep":"384:slvIGIeSxWGwpV7zLFmzLSUsw4WnK0aOOlgj4gn:aIp1QpV7zcarUK7OMgj1","tlshash":"d782e101f35fa81ddcf279a08b4ac91a6bfb6973634f44b5211d22784e32611a6d7fc2","first_seen":"2024-12-01T01:30:06.78205Z","last_seen":"2026-10-04T06:23:17.271568Z","times_seen":19,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/css/reset.css","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.110Z","timestamp":1791094930110,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /css/reset.css HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-1d0f\"\r\nexpires: Sun, 04 Oct 2026 17:13:07 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7439,"size_decoded":2028,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"ca11ff5f19c9dbfc2022717c0f25a858","sha1":"4ec6ebb4ebada3a97445def19fb09b5d463a39c7","sha256":"85f5c850166b81f4ba251def9646519688aa52de9c1fa6cdcbcb90b232425405","sha512":"9482f723b2b77617ceef3069cc590d1ff71b3269511899fb5dc5384563ca05e8012ddbd29d2f8906117b8cc9fddf3506edc355c6a9e0760c5983487f98d31fcb","ssdeep":"96:ztNctcoA8Pnd2Sp/ImpUYYsBib/pz7ZYVOuJO7ZNyJEMZ6EPVO/VOHVOA:5CoujpImpzjMbYVBJiZNyJBZ6wVKVwVD","tlshash":"02e111de2945318d42134ab517f90f64ac388073af7341fd709a4bad8342a9c23537eb","first_seen":"2024-08-17T10:39:31Z","last_seen":"2026-10-04T06:23:17.267492Z","times_seen":39,"resource_available":true,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/playgame6.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.351Z","timestamp":1791094930351,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/playgame6.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-8e43\"\r\nexpires: Tue, 03 Nov 2026 05:13:08 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36419,"size_decoded":36784,"mime_type":"image/png","magic":"PNG image data, 200 x 260, 8-bit colormap, non-interlaced","md5":"18c4a8d033d22bb07089f372ffb7a130","sha1":"1c72d72725febfc48a3df203d0a0152f4d7d0764","sha256":"c7032ab121789c16603ef097965e14fa31646f45f38c9eb0601157408cbe12c8","sha512":"e4e0817bb8e65e667744bc87e212598338a4bbf6819e39a34fc1f11d5d5db255748977294858e0cb25519a1da8d816ce128cfe6ac1e3c5c61625f515a4124fe6","ssdeep":"768:rpFRyrGRKjZ4lVkwqh3IkalrOtzNzPWtBPBvxF0hUR5ktgEInl8x:rHRyrBZYV/q2nmS3xePgEIl8x","tlshash":"3df2f21fc5488f0d7de6a2cb48795788857b722f9e4f2b732b4219b88dfc522e499c01","first_seen":"2024-08-17T10:39:32Z","last_seen":"2026-10-04T06:23:17.282679Z","times_seen":370,"resource_available":false,"data":null}},"time_used":289,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":289,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/playgame9.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.355Z","timestamp":1791094930355,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/playgame9.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-8d64\"\r\nexpires: Tue, 03 Nov 2026 05:13:08 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36196,"size_decoded":36561,"mime_type":"image/png","magic":"PNG image data, 200 x 260, 8-bit colormap, non-interlaced","md5":"1a7c13163018d9b01fc0bae8f43d318d","sha1":"3d0cc649181946358a5efb0b1e805974ad19f848","sha256":"b2a9d5284095e33ad1ada69e360338c155166a3f95557b6d9115bd99a25c69ef","sha512":"fbda7aecb5568b15177a26dba620cfc2138f37c3e8b14a85223ab8b47a4ae2c362bd5887ea0251e05d654ccd359ffb08c1527f3fbb448da53f8499bf3ff0bb36","ssdeep":"768:JLeF2rqdcDaybqmH+zdAZ2ahCM9gV85D5rez3GdvpAJq1si:JLeoa6BIahCLmzr+3GdhAJMp","tlshash":"66f202d640ec4173c69c62ecd6bbf0af4eb0dd1fb60628d1e44084a4d4f4e65ab6274d","first_seen":"2024-08-17T10:39:32Z","last_seen":"2026-10-04T06:23:17.276243Z","times_seen":370,"resource_available":false,"data":null}},"time_used":286,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":286,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/img/playgame11.png","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.356Z","timestamp":1791094930356,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /img/playgame11.png HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-9498\"\r\nexpires: Tue, 03 Nov 2026 05:13:08 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38040,"size_decoded":38405,"mime_type":"image/png","magic":"PNG image data, 200 x 260, 8-bit colormap, non-interlaced","md5":"2b4879b5b72d6910c9fca6f039477846","sha1":"183be72a1be7e04b325648c97a47eed7f54e7152","sha256":"80cea2a13fb3456a88d85a2a0a3d1ab0630a83cab23b48c4119060fbe955930b","sha512":"75203e5c3100f34dfdf7428ca938c6eee2be35d54c840f01ea8ab3b60310aa69e3532dba8f33da1e78fe7614c09fc5721c33ec6fffd085a5b381ab9d9cf7995f","ssdeep":"768:+SuYLMPgekVIsqeuapM4WGZNHSw9C3DC+8D+OHBfYSf9H4CYJSrt:+SuHoHIO9R15s++8qX89LYJSrt","tlshash":"7403e1eef2df6185194dec3ece82ca32c34129224d9913152c6aba8e5c9a5909193dcf","first_seen":"2024-08-17T10:39:32Z","last_seen":"2026-10-04T06:23:17.276894Z","times_seen":367,"resource_available":false,"data":null}},"time_used":284,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":284,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/css/swiper.min.css","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.112Z","timestamp":1791094930112,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /css/swiper.min.css HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-52ed\"\r\nexpires: Sun, 04 Oct 2026 17:13:07 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21229,"size_decoded":3504,"mime_type":"text/css","magic":"ASCII text, with very long lines (1467)","md5":"d60b2050f1f30cd4afc0366231aab9bb","sha1":"d1eaaf6f2884727f21c1920cc6564c6c6d9e1416","sha256":"8d1b2c3c370b65efca2e08b61e077d61c4329358ad1c0e559e06eec31a3a76fd","sha512":"6cc0c0de79fd11f6f4008994ab5665596feb5d80ce58a88ac0a550a65dadd85ef3b47eedb3ad1eb7b2f5782bef61ca63532bedee73250bf4c5cf49fb3eacc8f8","ssdeep":"192:pvBD1JVboUpR4nhEf1cvPE+vKllLdP8PPfww6n+/0zNwzj3czt/8r26rE:pvBDfVboUpR4nhEdcvpanJzNwz2h","tlshash":"7d92634c17102446aa368e1d4bd96b34cb59c8935e039cef7241ad4ce37f5ac32afb5a","first_seen":"2025-10-11T21:23:17.050027Z","last_seen":"2026-10-04T06:23:17.273631Z","times_seen":3,"resource_available":true,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20010926.com/css/style.css","fqdn":"20010926.com","domain":"20010926.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://20010926.com/index2.html?shareName=88258280","date":"2026-10-04T06:22:10.113Z","timestamp":1791094930113,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20010926.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 01 Oct 2026 16:11:21 GMT","end":"Wed, 30 Dec 2026 16:11:20 GMT"},"fingerprint":{"sha1":"3F:74:57:E5:B9:EB:60:CC:A0:2B:C9:39:E2:EE:D5:C4:2E:92:29:08","sha256":"37:68:AE:1C:EB:78:DE:99:C3:01:E2:11:29:3F:74:EF:0F:2C:13:B4:96:E4:DE:67:D9:81:2A:F7:1A:35:0E:D8"}}},"request":{"raw":"GET /css/style.css HTTP/1.1\r\nHost: 20010926.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20010926.com/index2.html?shareName=88258280\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 04 Oct 2026 06:22:10 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 24 Sep 2026 01:22:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab47b60-1ef9\"\r\nexpires: Sun, 04 Oct 2026 17:13:07 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: openresty_edge\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7929,"size_decoded":2428,"mime_type":"text/css","magic":"ASCII text","md5":"06f15e9e5089cd5d2cca36a45b7a610c","sha1":"113833519fb9c0ec70a4cc4c2626251deca5a6f3","sha256":"f13936449b198f17a9c453767ee2365561149257f0131cf3942e98a610618372","sha512":"1e1ada9ed303e48cf8c84ae335fb26aedbd4d93319bf4653b882c8db66e631f0f676e56e25524c3d284ed43c28fedd5de9d9afc8c2227e3e0293a2ae794975de","ssdeep":"96:1hLJAfNHUCf5ezY2KsgKfuR6FTlMDtVFTEkbcaBGpRqXs7DoH+F7v+FoM2:xAlZw/fQ6xeVxap0sXol+b","tlshash":"eff1132d37553c88d51b95a97e68abd4492d0450bf0f4d6f60237e78e78a1f80273b8e","first_seen":"2025-07-13T11:45:53.4853Z","last_seen":"2026-10-04T06:23:17.288941Z","times_seen":6,"resource_available":true,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-04","alert":"Sinkholed","trigger":"20010926.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}