{"report_id":"03c81251-2786-415c-b753-af8ea8a4a5e7","version":0,"status":"done","tags":[],"date":"2026-07-13T12:28:37Z","url":{"schema":"http","addr":"g12b.top","fqdn":"g12b.top","domain":"g12b.top","tld":"top"},"ip":{"addr":"103.27.177.163","port":0,"asn":135357,"as":"HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"g25j.top/home","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"title":"welcome-BET365","dom":{"size":424557,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (49937)","md5":"54cf3b159f7e4ad39926fa77ba5101eb","sha1":"497b0b5c1cf7e613d5d1ade2a4c35629bab5f039","sha256":"bbfd3842058f632fe8e7cf281b095dc970d48006436f29c0b412010c4f33b7a6","sha512":"d37514e5c0ac48b680cfb3bebcc96f523946490b6679e1079c76895ebaf7437b12f26eff462cfd56e56a29f4497f716811c80c030da033a732d355e6c869b59c","ssdeep":"3072:rMqlqyqCquqkqDqjqhqu9yHEleUq6TO1l/TMIlPXS1Vn:oqlqyqCquqkqDqjqhqu94Enq6TyQIE","tlshash":"a6943bf4435c03f5e40b8b8dfc763d6232e230abbfc54548f3ad4a919bb2986946d856","dom_hash":"domhashe0c4600e72590522ced1a3b7185774b1","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"g12b.top","fqdn":"g12b.top","domain":"g12b.top","tld":"top"},"ip":{"addr":"103.27.177.163","port":0,"asn":135357,"as":"HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-17T12:28:37Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":7}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g12b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g12b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g12b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g12b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"ssl.hw301.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"g25j.top","ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"domain_registered":"2026-07-01","domain_rank":0,"first_seen":"2026-07-10T23:44:11.762878Z","last_seen":"2026-07-10T23:44:11.762879Z","alert_count":276,"request_count":138,"received_data":9601562,"sent_data":78659,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"photo.365live88.com","ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"domain_registered":"2022-08-16","domain_rank":0,"first_seen":"2025-11-02T03:06:46.95373Z","last_seen":"2026-07-07T01:51:41.89849Z","alert_count":0,"request_count":28,"received_data":1572657,"sent_data":16296,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"g12b.top","ip":{"addr":"103.27.177.163","port":443,"asn":135357,"as":"HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED","country":"Hong Kong","country_code":"HK"},"domain_registered":"2026-05-13","domain_rank":0,"first_seen":"2026-07-13T12:19:58.034218Z","last_seen":"2026-07-13T12:19:58.034218Z","alert_count":4,"request_count":1,"received_data":174,"sent_data":477,"comment":"","tags":null,"fingerprints":null},{"fqdn":"ssl.hw301.xyz","ip":{"addr":"23.224.132.157","port":8900,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"domain_registered":"2026-04-19","domain_rank":0,"first_seen":"2026-04-22T11:08:02.807624Z","last_seen":"2026-07-10T23:33:31.605978Z","alert_count":1,"request_count":1,"received_data":252,"sent_data":545,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"g25j.top/home","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-17T13:12:32.347914Z","times_seen":89082,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/chunk-init-c0d76f48.1781011881923.0f397bb1.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"815f2acbd0918250f25d4f71409219b0","sha1":"d5778078df7eada22b3175f9182b8b22e828c433","sha256":"12a61f287da39190db34dff1de7188c3d8b76ffbd1c11290962db88fd5e2ab46","sha512":"5ba4adaf4b36b4a402c30c3aaa5be5f02e292391d79400d353a5ca6c61405cb40e5179858abddb1af6dad243899e420111e49004d01d339ce9de23d8f522c379","ssdeep":"1536:zG5qxPvO2lSV822bv0bcbpM/igw/aIwC23QOoKILbjxo4wc0tvB6xVS/J+pKY3Ns:iQz/Dp5/92xoKa/x5wc0dB5/J+UU0","tlshash":"5ef31b987392b1b847dba6e152371075b57e1dd73088e8f0c169a6803f31a9cd52afec","size":161226,"data":"","first_seen":"2026-05-11T06:12:53.502908Z","last_seen":"2026-07-17T12:51:05.055539Z","times_seen":631,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-17T13:40:09.02358Z","times_seen":724782,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-17T13:43:17.012675Z","times_seen":234063,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/21954.1781011881923.57c97863.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"35aef3c03c45b75cc6c2851265c30f23","sha1":"54874afc1d2d6391142418c6c17d7639247b6c9b","sha256":"c7a0283f3d2fde40ce97fe3bb5e79621f9939000c50c3c781a4597c3242ebae2","sha512":"f74356629d65ff26f6928ad3183ba8e6e01848921202f9c14c5aef758ef72acdcabf523209e892df42d230d9c87cb47cda7bd106105ed8447718fc502b2d71db","ssdeep":"768:U/aSfmzKrMdvf0eMQ/96loumY1PI1yBK9LudEz+yUy51y9y0yk6Dio+ILqpTeY:z81R6Ipyk6o","tlshash":"33132088fac2b06dd3eb7330857f505ae66a1dc0668c5434e260d6917e7198dc1fb9f8","size":41946,"data":"","first_seen":"2026-05-29T16:01:53.086335Z","last_seen":"2026-07-17T12:51:05.11082Z","times_seen":604,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-17T13:12:32.347914Z","times_seen":89082,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/home","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-17T13:40:09.02358Z","times_seen":724782,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/chunk-init-1656f0b4.1781011881923.32336986.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"149a9a32eef525724cd200e4dce7a032","sha1":"29b091925cae6d90319391653e40685f6e6c5735","sha256":"10fcb7c4e44a141964cb31c527462c6e56f78d95c956fb02c50c61fc576cefd2","sha512":"62d80403786c13019e86e1c6b991d73cf52ff5bd25d4eeaec34ca12125d677604a269fc6c56ef301f074c42798f8e7935df623d6a0a62559d70749e53082085f","ssdeep":"1536:z2twqIPBoVbzfsO9ZuqpiXXIOU6Qgpp6KkB2EnBDsAxdrkm4SgiqvHynjM5TCif9:z2twqhOIK2nCLdyACifMur06/D","tlshash":"6dd3ec54b7d0b4b442cf13e6711b2475e3a61ca22058e8f0e31dee647f35689d26faac","size":136038,"data":"","first_seen":"2026-06-12T19:29:57.333908Z","last_seen":"2026-07-17T12:51:05.018981Z","times_seen":628,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/83749.1781011881923.02b71cf6.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"c1d2645de169d30e7a814fdbd1c1a47d","sha1":"41959bb5171f196d813c4b3c27bb3135d993ff43","sha256":"a400126839acc7fff4ce08e50633afc5560f3eb3e8aae7ec697fff30423bd26a","sha512":"21e02eeba3e71baf0938766c7abf83b68a4f54b149ea679f43c221c429729dacd395ed0e54233ff22be739636dcaf0104cd58083c50df9b6c521fcb2c3e27419","ssdeep":"1536:lcK/KnqHB3vmxuHXvKe+Gruc7iSxTcgOX8JwTl0sI5pQiVFFsdt+H+Xk:rB3vywXSex7HYgOXawTl0sgQi2tkwk","tlshash":"3693e7c4b5f4f5f8279ec5a2973644b8b02527c5b1c8ace0d2e96e147f19b62b0718bc","size":91749,"data":"","first_seen":"2026-06-12T19:29:57.252198Z","last_seen":"2026-07-17T12:51:04.936312Z","times_seen":574,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/83876.1781011881923.7ce40e6b.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"abf84df30621edc23a82d05ff0b8a83a","sha1":"e727ad94ce5d5f5b8fabec0e0b5a966fb6e6594f","sha256":"c3b02d056ac034939c3ff75a10a2da23f5f05f96a36ca1e5cea2157ce0fe12be","sha512":"db2a2a00f51cc6f75cfcbb6d988df74403fae93255982a054710e5f87a2d8407f4f8f02fef8ef1a0e5edb289736296b2d11a3b77cad6c6d9089bb831cda45be5","ssdeep":"6144:0/rOTU2/xB0Jjytg7DiQPkcsz1aL3p2YO+WidjHrrL:0iUjytgPJPT3p2YpHrrL","tlshash":"2f442c44b291f0b8879b42f7922b4056a17f48a1308cacb4f265f990be7555c927fbfc","size":262269,"data":"","first_seen":"2026-06-12T19:29:57.272405Z","last_seen":"2026-07-17T12:51:05.034087Z","times_seen":617,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"2bbd69200a3d758f89e8076a123ed982","sha1":"dfe2d66f2d85ddc2008401ed15dcba3515392f37","sha256":"b79cd0c532adb639e6139c9394527b217982efdbff4969494986edacd943e2b7","sha512":"ffb7e75ea86b911ed842f7525c08ad5cd4ef5085736e757c47f3b4e09b3c9497dad089fae69953dd819f57b3ac1cb3a54ba037f9a8ad3fa37d7aeac9ac36bcb3","ssdeep":"","tlshash":"07c0c0770f2c7f14110310230174f3ac5431c028fc15b302331f40018b50b0d0c30e40","size":178,"data":"","first_seen":"2026-05-25T23:43:55.293244Z","last_seen":"2026-07-17T12:51:05.11406Z","times_seen":730,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"da7d6cf21ba9b37cce394593785671f7","sha1":"aabeaf8e874da29cee7e1645707577446b8de63b","sha256":"6912a38811267077bd6dd2630bccd25ba04b653b4967a636d75a6ec97c5bd2fd","sha512":"9739d97867822d248e0083a78d8657485d85e70bbb7a75e0fccd283c2bdb980ded0ea78b1a4fb0540c529e602ba88286021df0553bb23e45fc91281f64a4db49","ssdeep":"","tlshash":"de31ce286eb29531a413612a1f6ff2843235d62f3148ef003f0cc7651f24d6ba6356d5","size":1686,"data":"","first_seen":"2026-06-12T10:00:06.928319Z","last_seen":"2026-07-17T12:51:05.114826Z","times_seen":670,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"a15b4803f5b926cf35dd50ad665005e3","sha1":"0dd0dd998736dc9db4ab3c7ee8f7cabc8e1e341b","sha256":"201c5550359d1e530619f58a4f77bfbe382200e2b0c85d4136df96523aee625b","sha512":"e21d282a7abbc3b8aba31153d7969b54c647e3c2bc2f1c786a6f3894ee0322540fc37d99351e5d8998991198a98b26c470c16fef19e5627cff75e0a6157f6e2d","ssdeep":"","tlshash":"b7700000be08a0a80000a0202828080c280238a0803b03080802c8023aa8c80288a802","size":24,"data":"","first_seen":"2026-05-25T23:43:55.294961Z","last_seen":"2026-07-17T12:51:05.115618Z","times_seen":730,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"8f54a6c689ae3fb37bcded37e79fea08","sha1":"0861325faf70167325da7dfd6b4059a6991136aa","sha256":"c9a960988ba6d8cfea2c7e709385252a139280898d9b4010703981ce03184a1c","sha512":"08111d473c9567e7da677c4a5e61e232f670b58e2bac4f1a1d96005b83214368e6bdcf36efa1b99aa4708beb8a11bb3378270d70d1a8faa3b2fbea3abb10b4e6","ssdeep":"","tlshash":"82700008ec0088ab0000a00028000cc8380a00208a3b838f8a00008a2ea28b0000ac00","size":24,"data":"","first_seen":"2026-05-25T23:43:55.29586Z","last_seen":"2026-07-17T12:51:05.116403Z","times_seen":730,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"c45b02b1f350ecba8716f39faa1d6dd9","sha1":"323d186c69f92adfbf21ac33010643886a3ada59","sha256":"81d9bb79dfb8f66568da929cceb338198f5fb8ef0d422c9bc19a97944981d729","sha512":"6cb26d6b01335a5779cf876ebce242b675745c80857fe191e0f42b927c5b8c40ff0896f64e6c28640c9bc1d9380344c6282790f6a7341d5ab74eba28fe93f4d2","ssdeep":"","tlshash":"eb017d9e483788107b2225bd537f5089f1a2516f8e8bcc103c1e5b00eff48ab25a2bd9","size":738,"data":"","first_seen":"2026-05-25T23:43:55.296647Z","last_seen":"2026-07-17T12:51:05.117203Z","times_seen":730,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"077d4be9ad272f7d475481152daff715","sha1":"2f46a2943ac225687c445e0416015d1f97b7f0a1","sha256":"8d289c243d18cc7608ad59bd1b5d4c5edc5a26521213972903495b5ce1f78ff7","sha512":"310f88318435a5cee999868c4f24f906af4f7ba99540a2a5bf79b68f1cc1dc5fcd84b3c45051e8bc2e8ad3e36873f746fbd95aa84b6b92a27a76c5c84fec37d3","ssdeep":"","tlshash":"ac41027d826245a51973346a1f9e730836f340b31149e9113e5c8a802fa9a5f82b7bfa","size":2321,"data":"","first_seen":"2026-05-25T23:43:55.297422Z","last_seen":"2026-07-17T12:51:05.117997Z","times_seen":729,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"e2d3475f1cf5b92ebde88c18cfb52625","sha1":"b178b44e61169b2fc5f25b0120206d3812b19cc1","sha256":"3a448e6329733e72eb2a1d80d1897a5ddf20226acbafb032eecdf71d83fe307a","sha512":"802939763c96de22534a93d89f00066ef7cd4cf58814954ebaa18ad6e77aaf19e99745c8a677625be818d3f378e5fe285ec537561be58e12504a1f3eaa23f363","ssdeep":"","tlshash":"00f0a00e0ee548131963706a4c0f9201203b2513414eea08bffe9bb24f92a6886174cc","size":538,"data":"","first_seen":"2026-05-25T23:43:55.298337Z","last_seen":"2026-07-17T12:51:05.11875Z","times_seen":730,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"196e0f8d81dba38fb58a2eef3490451c","sha1":"4c70fb540d5f49bd92603d0cccd3005fea9b4c4f","sha256":"eabeb94d65d8704477ca411952b078a4fde998d61c9b3cb12b6940389dadfd90","sha512":"17596a9ca2ed22c2f13f6ec692ae8c32bc6aa1a1a4c7a888639c8ea5f2596a16efb37dcbd14bbc8b514c8bce98bc3f7ace246f5fdfe4070417cd670834883566","ssdeep":"192:q2wqx5Cvtib5XOQRzlaECoXZTAoV51nsPhwzvBa/id3+36a/E/97g6I52MdobsIS:q2VwiYwJvSoVXsp+pa/iZcVk97g6nMuQ","tlshash":"78322b69a5b71bba25673036277f301889b080630319fd947c0ff61e4fa54366297be7","size":11902,"data":"","first_seen":"2026-05-25T23:43:55.299247Z","last_seen":"2026-07-17T12:51:05.11962Z","times_seen":694,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"4429af1150d1fa3b53d1df1756276b64","sha1":"1921726e78a10af853be137ddf92f3d86deda32a","sha256":"2f7789347336fe8f5baaeba0f2285060e84c161bd59ee0aa3c7d8c47cf27d580","sha512":"416f1e1d8ee3a03067609ca187a88c5e3a77cb751e8769f902a12c6115e6394121254e4d60e469c50ade2b044dff176c0f7ef93912c563c510279de31d61823e","ssdeep":"","tlshash":"0c11cc5a99e28132aa5b303735bd43887728a023d184df413dcc99456fa8da5cabf6c4","size":930,"data":"","first_seen":"2026-05-25T23:43:55.300055Z","last_seen":"2026-07-17T12:51:05.120414Z","times_seen":694,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/home.1781011881923.a94e73ca.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"7ad9af47a2c0c93f65e42ff84b45dad7","sha1":"eed3b4bd1191c75416f457ee41317595880f8635","sha256":"c9d64aef33c7a35945a5963b08b2bc3157f403dc91a5c9c9463c82a0d4075af6","sha512":"757a63f9b96bc8a36491424f8e0ae9fd6813983817ab2da87bb3455e18b5cb5f71d5e682919941194e4a588bea925c790888e4d27f8531ee03c777c1e2c92678","ssdeep":"3072:T5daS9tSIMcewi8uJBuoMfqFf2GMkvVJuhxffj7TEOiGRlc:T5ES9tSIMcewiLQqFRmzffjAGHc","tlshash":"93141880b5f0e275575fc2a7d7371025b2271786d0ccac60e1f66b187e2879ab236db8","size":203243,"data":"","first_seen":"2026-06-12T19:29:57.277471Z","last_seen":"2026-07-17T12:51:04.963206Z","times_seen":580,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/home","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-17T13:43:17.012675Z","times_seen":234063,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/65246.1781011881923.03480a32.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"b98dafd31fe547add2f96acf9bea9922","sha1":"e63706f4b83ed72ce8a0ffee74c7d606968bd280","sha256":"92014e9ab9f7e62a6651d0a69b63f69a84ed58e15ee5dd8e287d46b28fe610cc","sha512":"a676475f44bd6ec6ab9e7421deb8c29430404be3852f96d012418d03e9135d3ec450ee58b4871a4f8ed2a053656c9a9a6523853d6238d701144d9b72c6df8ab8","ssdeep":"1536:f2+iDvYvNjx4Uyao0L8oDNzAuMMsTAQ0mqt2pXYzA4dANVO:e+iDYvPo0L8oZzAuMMsTA7mqt9zA4dAO","tlshash":"a673a501f78272385fa7e290220f2026e16e191505ac5ed8f179ffb93ef0954aa7d7b4","size":73415,"data":"","first_seen":"2026-06-12T19:29:57.345997Z","last_seen":"2026-07-17T12:51:05.052141Z","times_seen":574,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/13575.1781011881923.cda1d494.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"65e5fffbcacf52710ad963a4aeede3be","sha1":"f9c16a3c86649aeacf18e736faacff0cf78192e7","sha256":"36f42498ee253b0d1d5e7ec8bdf406f05c4c91e72f64169b1ff67435d2069099","sha512":"96e8263c115ca75ff63f6ce70ba8ad5af370662f86c2f95a8960a5aa5a30ce4134fa01d7fbd1694ce37f111b69e3e418f0542a7ab1bae4cec570c8c3d8d08986","ssdeep":"1536:917BBHFeKRKp+3ELSPtj6x2DgJoG7PIDmj9VA+s69JAFdE6WIzl+Ik1+eXMa7a4H:7jHoKRKphCnDgJoec+IDWIzls+7Xr0X7","tlshash":"23141a84764170b8c396a165322f601ae22f789650dd9c24f3789ba47f7470df26fabc","size":194916,"data":"","first_seen":"2026-06-12T19:29:57.266361Z","last_seen":"2026-07-17T12:51:05.016487Z","times_seen":624,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/60024.1781011881923.e9a203dc.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"ac04ba4305a374571b2d241fe1f50dc2","sha1":"e559b9a0a338e35fb6605942f7d14e96c031ae71","sha256":"788282499d13bd0bb6207ed41a15a3d0b2058ca97003d1e1a872e81401f02aa7","sha512":"6edc613a3f8585bf6cfb8c034199265c1c1daf368d0d3a6e2c41bf441a334a7f93139c0b0fb4147b98264567be9b135fab3cbe923e8fe040ec553e9fec04c8ae","ssdeep":"96:UR4NFRSZqe65bD7RM/Rsxkw9usN6tKex9sX2NaenPdqUDDEz:UR4NFRSZqesbD6Rgks0RxeX2NbnPdqUE","tlshash":"3491cbd876d2f071426f9678862f285fe27bead074ccb415d1c1e690aef062d8933d68","size":4601,"data":"","first_seen":"2026-06-12T19:29:57.341024Z","last_seen":"2026-07-17T12:51:04.974081Z","times_seen":576,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/configPage.js?v=6/9/2026,%2021:37:10","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e6aa74bb352ef198ba3e1c9a4b01b014","sha1":"2ea8bd6b5045475a36432f7665a129728e822d9e","sha256":"73828e873c0b6e847b37d78941ca436247471dfc90a12f743964f869f75abd5c","sha512":"2faaf24fdf1e4da637af8e9f82d1778bf061b00752dfca0c8f73432ba236a7b69410a7ad2a73727bc83e6cd631fd6555c3cc0d9d3a5d8a7f81818dd66566011f","ssdeep":"","tlshash":"be117aaf57444dffcf1d7e00a08b0a5ea8bc61d261889d4da8e9cf29e1c99002378978","size":949,"data":"","first_seen":"2025-09-04T00:49:32.949926Z","last_seen":"2026-07-17T12:51:04.9763Z","times_seen":2409,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/index-a3dad144.1781011881923.1093b11d.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"0fc0f4a0379e369b442d93ffb72561fd","sha1":"497d95fced30bab2efe9ad3a561c35cd40ad5e9c","sha256":"da926a537d946d3158d41a8531082a740aec7a6a4e3b98599d35546182f20806","sha512":"ef5664991d7fb472281b2696b3b25a322bf51f9bcbccf2043f77fdb67ca9a84d90b893029e93bedea935724bbc4b58a77154b35ac40b15f8e691b539cc3102e3","ssdeep":"6144:LrbhFOufhu/LHEY/T8CPis7lVV4YlRlNsmq9D7:3zBw/LHEY/TBas7lVVhsp9X","tlshash":"ed742b90f76ce1bd875e55ff7a329094902c1b41b0c89e58d29e2944fe6b385eeb04bc","size":356584,"data":"","first_seen":"2026-06-12T19:29:57.253128Z","last_seen":"2026-07-17T12:51:05.045354Z","times_seen":597,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/45540.1781011881923.25dfba7d.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"7983a109fba451279f84fe7b75724983","sha1":"9487dc955240c6083cf3497e806dff89bec2061f","sha256":"80bb5c781336a9095ee3e8ae99d724f58a409c7f3c159bf0f320a9c948afe030","sha512":"ddf49f5cfb4721100ef951228391607209e248a8733d48229ff5196fd8a32fc3e759d90c1040dd591b1c0bd97ab83a1c8baaffa70fa96bbe2d556af2379478b0","ssdeep":"6144:1YD4wFsYiSGfKnCKPP6Xm9sm3MCln1OSgpozfEe5a:1YD4wFsYiSAKNH3TY5","tlshash":"e724f894f294f1be075fc1f1d23b501af35b5e6120cc9ca0d296e6942e20b49da77eac","size":229366,"data":"","first_seen":"2026-06-12T19:29:57.328205Z","last_seen":"2026-07-17T12:51:04.995275Z","times_seen":625,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/config/telegram.js?t=1783945689993","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"4ef2154bcfb8399f256c2da15a4cb409","sha1":"e0f8f5578b2e0773ec1d79bb1cec54e1f5d6373d","sha256":"73fa4926373755b52fecfdf3145a0c9953c08af374ea69dda46fe2b3b9ddb022","sha512":"8b64643161386bdefbb7eab04416e78e5e183c50acba7b25b146aa6e733744a326566a01eb7eabb1a0a3f5b87ac8461a7ab3b9ad1c44de37ecea25af09e3eb41","ssdeep":"1536:WK4KZK+Klt3LbbdS4V+vO14KtA9phXTQ+fcZl8LDh7j8d3K+V4WMrnf/NunqxF00:Wj+dgdLbbdSA+1XTQRZ1jSBl","tlshash":"14b31c4c5cf3216285a7b1be8b9f925072759893304def203c4d9ba45f98d3c53eaad8","size":116886,"data":"","first_seen":"2025-05-31T08:16:48.368096Z","last_seen":"2026-07-17T12:51:04.927009Z","times_seen":1967,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/chunk-svg.1781011881923.7ca9cdc1.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"2e885a50d7dc711be337a96fe33f0c2e","sha1":"8c767dd1bdcbf35f2577bd215ff6fe495cbd0f43","sha256":"603d14d58a247671742688b96c517d62e9c636443b960bc421af5352df4c01f7","sha512":"09289e06b0db84915693f0b78ab40149972b29693d0d6b1e66e4fbe9bddf00380f5f4e8e78961512d91a132226494572994ceade62d3d8a878126fdcdeb8fd95","ssdeep":"3072:/8nz2uaLZSZvx6Q/sIPrekK+mB6Ua94sRZI7gbpF/:/8nz2uasNxpXPrekK+mB6UHsE4pF/","tlshash":"c0a4fcb4c190f4edf704ce196e7c9e1c50321688e0a9e9e52da9fe0d9e85d6b241cdec","size":470763,"data":"","first_seen":"2026-06-12T19:29:57.244213Z","last_seen":"2026-07-17T12:51:04.92266Z","times_seen":630,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/theme.config.ef94991b.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"90d279a2980268d2835cec593c23d286","sha1":"4374bf6da5cbdf8f025434137487bda68077cddf","sha256":"1679f19badc24dea0edab376edfb8583714645e18f705fb849037af6cf0b3ff8","sha512":"362ec1b73cebe1ad224a5b745c9ceebf2b86301deab27e35d6517d499499328b34c24d76a72e5b348d623e64a4d17bfa0ab08d2aa012f02af23c6a72df51817f","ssdeep":"1536:D2JREobVmtlIRM4Sb2mcTa2mnzyJog9CcHWHA:qEtlGu1Jnz45HT","tlshash":"c0b3bb7ae20c963a6177a8bfb46ce111d12f9c0c9b1d5fdef03e60a25710669c831de9","size":108079,"data":"","first_seen":"2026-06-12T19:29:57.324936Z","last_seen":"2026-07-17T12:51:04.907194Z","times_seen":635,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/chunk-common.1781011881923.b470d60e.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"08afa88982cffd7b96a2190cdafe1c42","sha1":"abb87563ff4cd658f4436118c54f3f39c08f74a4","sha256":"8673d3fc3524eb9d8b4020b3da3109aa5ab5e569ed8d0074f2b72b8643f813ae","sha512":"70c9df3dd7b3e3d41a607627c6a2750f43673649dbd55c7a56606a7d3e67382cb2991f146f7ad2359cc5ff1615f9db484b54642917150351017d0fa4385c3d2f","ssdeep":"1536:jBY8bgGcdWUa2UTY6eryXHuLmbErF/G7D1dMI59H64likx/vocGAClVbGD3tFk7u:jBYCRTY6wjFetH64liC/vocGAcgD3t","tlshash":"65f3e8c5b3a0f07e9a1ed53779331499b12f758274c87c60f1a1ade6bf1a704a436ca8","size":161286,"data":"","first_seen":"2026-06-12T19:29:57.317434Z","last_seen":"2026-07-17T12:51:04.984372Z","times_seen":627,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/22872.1781011881923.153832d9.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"f9ee602f8eeb24db94a45e276eb229fd","sha1":"add3d7dea3c94842531e4e52db7b334a705c5e6b","sha256":"3d79813c4166473dcbe19eb56d456a226f183993f5aa4108a4fccae156001245","sha512":"8ad5674af4bbf338d1188a8108d0984786a4c94afddefbd592dbc428928dae301e40d4a936d73d0e29ba68989ccd13abee0988a8a6938495736115c80a53eae7","ssdeep":"3072:XHW7tB4Vgj5tNlxyU5YegxYffj7TEOiGzZl+DJVkzEcx1nKs:XHW7tBwgttXxyUtffjAGzT+DJVkzEcxF","tlshash":"21f31bd4f2c071f6475f45f2a22b0075b26f4d92318c98b0e15ba6597f21a48c7abeec","size":157599,"data":"","first_seen":"2026-06-12T19:29:57.267326Z","last_seen":"2026-07-17T12:51:04.996067Z","times_seen":610,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/35142.1781011881923.1d227afa.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"8325235b613820a57b71043f360e5b36","sha1":"925ff977edf9892e868d43915f93d29e6feeb113","sha256":"0c505f39a463b09ece16c213b7ead75186dcdc26d25ee02dcba5a62cc0dff7c6","sha512":"efd16c9b7ff0f806890ae77542e8c0d4e954f8c797ff21b8dcde3f240e4940ca3c6d0fe75ee2fda35bf53ff5d0eb691fa7e38cfdfa82c0f231b0cd57458fbcf2","ssdeep":"6144:N0hEyLkbJDb7w/1FOAmBm7cene7Ancbt8sbyAkKJwoSlt5MMjmlHGwwzHUY9SroE:N0hEyLkFDb7w/1FOAmBm7cenaAncbt84","tlshash":"8a742b94b290b17883af86fb731a91a1d24d0e9460ccace4f27e6e407f15746b8775ec","size":340163,"data":"","first_seen":"2026-06-12T19:29:57.248751Z","last_seen":"2026-07-17T12:51:04.981104Z","times_seen":580,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/31098.1781011881923.4108b3dd.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"3c55e2f7f495cd530603e700dd3bf229","sha1":"fdcabc58e872fde99b7d704711a75bc32cc2b8c8","sha256":"1c38b781ee4a302e955baab7d3306365881227cafc2814e1085f93f4ab0342d8","sha512":"94954c49e71bd95a7543f652e03bf68b5dd26d00b33c91eda9003ef81e37aa5735e846bc9322d52181550f0d010d125479a73d83dec0fe51fa0c4f2489108326","ssdeep":"1536:Z+0YvC9jlTKAUSseG1SY46DCdlBBo3AgXOG9AsqCfCXsvCfCXsLCfCXsyCfCXsfX:sKK5sY4brG7O3SnLJNpL","tlshash":"6174b6f4c248c6fdea04ce0a7e7d6f2d50723783f2ec56c446aaf8865e92857245c4da","size":352738,"data":"","first_seen":"2026-05-19T02:14:56.370466Z","last_seen":"2026-07-17T12:51:05.002036Z","times_seen":606,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/index-399e2569.1781011881923.9d909473.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"a89a32dae8cc80557b581a69e02f0d02","sha1":"00f9cfeca127af0a139c0670ed8d2e2e7ccf673b","sha256":"6f97c8ce9605a8e9e80a699696c70ec26a4b9bce20badaa6947bf4e5ac52e9d2","sha512":"2ca5bc054575932085e6cd6529613a94f145aa9a3b7731fb85b97b27286a882043110ab45b7eb4673228185ce1560b47968d3aa7b77492f17abf82e778076a9b","ssdeep":"384:pZTANHmDGIaVPkrTBTcK8K+Ehn6A3zgJ9Ks/fT5qZsxbt85F3oWf0Af/nwtU8Zci:znDGIYPkPVf8K5hn33UnKofy5FYxAfPY","tlshash":"e2b2b6e63392bdb8c24f9676f23a58ecc43f9141c30fc4f8d265bd947d98644aa92784","size":23775,"data":"","first_seen":"2026-06-12T19:29:57.227313Z","last_seen":"2026-07-17T12:51:05.022198Z","times_seen":612,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/config/gd.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"368318100a3c0f64373230a250953d5a","sha1":"6e0d91639cafd23f1b22aecee332da83c70b93ea","sha256":"dffc9b203a19b9e70363f75f737b7afe2164d6b8c045800d4dd7931d9093aff4","sha512":"91077ca792821795a816a0ee1a9cef242bf2915c02402706c7bd5c027c62f4bc52517b6a5e3db9f4b873e5a3c9d652758cc277c1f5ba07dc12e0d69b4f6e9eeb","ssdeep":"384:bJA61XVpi5LH4NmeJPXwXkQdcAwR0Nw3zzbSGwYg1C:bJA6BZX+oJjzzgY","tlshash":"80721f4d68f7905345a3b03c8bafa114b5388643181cde457e9ce394af6843d97babdc","size":17440,"data":"","first_seen":"2026-05-19T02:14:56.346288Z","last_seen":"2026-07-17T12:51:05.041928Z","times_seen":739,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/config/initGeetest4.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"87855e19802d75b55afa7bcf3af515c1","sha1":"4af373375728a98d623f2299a68a91e150f2672e","sha256":"9ec8a5ef8c8ffe369dd1a5c4730dce6570c0d90955798c0be4ac04ef1c8f4baa","sha512":"3baa6d9e916abfb3d38b7ebb9372c5987e8f10534bb978383751c0094f8f5a3e764f9b8e44a73d9d4871cbaeca7e1939f0ffaf9499af5c4a71f64c3588167d85","ssdeep":"192:23aP8Ha0D+Nu5dq+EvNiqc4K25MB5VYaiQwSL4SScQVy8QRHIsGiz0iX9rES6Myy:2fe61w1iXKb2sMGUI+KQTwwHlB","tlshash":"00621d0d68f764534553b4388b9fb014b5388a53042cde41be9ce354afa843d9bbabdc","size":14975,"data":"","first_seen":"2026-02-16T20:32:40.162764Z","last_seen":"2026-07-17T12:51:04.943165Z","times_seen":1532,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"[Telegram.WebView] \u003e postEventweb_app_set_header_colormap[actor:server1.conn0.watcher17.process8//obj31 class:Object extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[kind:Object ownProperties:map[color_key:map[configurable:true enumerable:true value:bg_color writable:true]] ownPropertiesLength:1] sealed:false type:object]","filename":"https://g25j.top/config/telegram.js?t=1783945689993","line_number":139,"column_number":13},{"level":"log","text":"[Telegram.WebView] \u003e postEventweb_app_set_bottom_bar_colormap[actor:server1.conn0.watcher17.process8//obj32 class:Object extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[kind:Object ownProperties:map[color:map[configurable:true enumerable:true value:#ffffff writable:true]] ownPropertiesLength:1] sealed:false type:object]","filename":"https://g25j.top/config/telegram.js?t=1783945689993","line_number":139,"column_number":13},{"level":"log","text":"[Telegram.WebView] \u003e postEventweb_app_request_theme","filename":"https://g25j.top/config/telegram.js?t=1783945689993","line_number":139,"column_number":13},{"level":"log","text":"[Telegram.WebView] \u003e postEventweb_app_request_viewport","filename":"https://g25j.top/config/telegram.js?t=1783945689993","line_number":139,"column_number":13},{"level":"log","text":"[Telegram.WebView] \u003e postEventweb_app_request_safe_area","filename":"https://g25j.top/config/telegram.js?t=1783945689993","line_number":139,"column_number":13},{"level":"log","text":"[Telegram.WebView] \u003e postEventweb_app_request_content_safe_area","filename":"https://g25j.top/config/telegram.js?t=1783945689993","line_number":139,"column_number":13}]},"http":[{"url":{"schema":"https","addr":"g25j.top/img/zeren.c0aa584f.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.291Z","timestamp":1783945693291,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/zeren.c0aa584f.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-cfa\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nAge: 105652\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b7312da2480\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3322,"size_decoded":4053,"mime_type":"image/png","magic":"PNG image data, 414 x 130, 4-bit colormap, non-interlaced","md5":"217588cbcd6216a09cac17953ae710b1","sha1":"de250755d284bb75dcee38ee45f2fc839987dcba","sha256":"24c2821b322d0c9087bcb0727dc0307311f6cfbb52af9f8a93308e48705f706e","sha512":"da190054ec0862c9927bb3bd928481459d53d4d778e9b2928c2507f2a34df5791d43adda750fcf184b767c1ba3a3f92e45dc57242a80869e253a9b37639abb4a","ssdeep":"","tlshash":"50616c01eb9130b8129c286701bd3fcda4c64d993d203d798d87b29bd6f970d288b123","first_seen":"2025-08-29T11:05:53.326961Z","last_seen":"2026-07-17T12:51:04.975782Z","times_seen":2054,"resource_available":false,"data":null}},"time_used":3775,"timings":{"blocked":2525,"dns":0,"connect":0,"send":0,"wait":1250,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/api/sport/match/list?sportId=1\u0026client=web","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.120Z","timestamp":1783945694120,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nx-request-source: https://g25j.top\r\nXign: Y2MwDOxZ0gL/R+dLzBhJZeYtapRTW9nvV0Yt9kiDcRa0og9pFhgcafxNnq3bYyqwcsX2As4Val7UDkk72vsmSMf/iv9jA76PGC86k6tOm0ORvwscdTW5sYiXwVnH+hy1UCynopXpswX+P9eGbZ7G4IKEcmNIYHGT9kI83sPsNtw=\r\ntimestamp: 1783945694103\r\nsign: 4h3r1v6j6l501d5b\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: HQKEwmeYFSSEaBtwbDNtyDn6TxTXzDaR\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:14 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945694=E8FdoxMIiXaneiIJH8nRsEj9bqanUX/19vOzGBfRqOu7uMm0tthCqIaH5Z9EhkjGEJqO+UtOPdlD7oMK9qcmOqh42CeeqaqvIh3/4bt3zisg25NE+XlC0Mz1MIdp+DjwpVUU4FMunaWp2JkDKT2fS0ptq8rNVF5M2PBBB5EW11HVWyysDG98xECmcpSkiFbC\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b730c3a247c\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7898,"size_decoded":2401,"mime_type":"application/json","magic":"JSON text data","md5":"5152b3f9758d2c8f769c668a11c186b4","sha1":"c32ea27206d117c4399f28fcd1bfb7cd11a3e9b8","sha256":"55564c1affe6974f53ba7210b26f006daeef7e8c515323bede36523f147b8a0f","sha512":"6c2301884368986161156dd4b6be7c6d6dc6c55b22c280526930fb07d8238fe600cdfd00df3072332f31f66ed77d60af87f93ef037042a75e7b65fae1d830c37","ssdeep":"192:ev+jSuA6a6Rw2A1idA4w8KHWGiHeQuXKRfjTK4lx5L/dSi/5S1tDxRkTIrMLUaP8:ecAAwydi8DG7rXKJjm4NL/n/0tDx2kr1","tlshash":"a9f1435681dd58952b8c61d16c1e3f4988befa1b0adef5c5de0ecf0966b43f78204d22","first_seen":"2026-07-13T12:28:15.125434Z","last_seen":"2026-07-13T12:31:42.484415Z","times_seen":7,"resource_available":false,"data":null}},"time_used":311,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":311,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/6ad29b953ade44b7b67069a957e2fdfc?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.647Z","timestamp":1783945694647,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/6ad29b953ade44b7b67069a957e2fdfc?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 12857\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 52079\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"6ad29b953ade44b7b67069a957e2fdfc\"; filename*=utf-8''6ad29b953ade44b7b67069a957e2fdfc\r\nContent-Md5: ddGMpTTWEM7pN/emgz+oIA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fhjt6JhPe_ieOuGyz7380beyq0W8\"\r\nLast-Modified: Fri, 05 Jun 2026 11:26:56 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: A7Dnom1PP\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: jQMAAAAa8iDLqcEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12857,"size_decoded":13613,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"75d18ca534d610cee937f7a6833fa820","sha1":"18ede8984f7bf89e3ae1b2cfbdfcd1b7b2ab45bc","sha256":"02b8f5d1629236be3adc3660d29a4a8248206988bb2e255c784f06fe535d8212","sha512":"c4df318dedc300764e953a65cb98829938b7796a3b8ac4fd40d2a4f29f8bfe1dd242df1fed5d74ed101de52ede9696f3591a1f952079a7668031a75603fa0fa6","ssdeep":"192:QXLceXyT6SRDd3VUHFnPSAQd+zHG/1UfLlq99c5z1SCRjplmv:6Va6uklM+a9UfLg99cjdRL+","tlshash":"a042c07063bfd709455c6c54188faa0ba8fc881a9b602e7b6c162d91640d3bb3c9d979","first_seen":"2023-08-17T12:39:31Z","last_seen":"2026-07-17T12:51:04.95245Z","times_seen":120,"resource_available":false,"data":null}},"time_used":2375,"timings":{"blocked":2106,"dns":0,"connect":0,"send":0,"wait":269,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_13f1f273-ad7d-4854-b9a3-7f3eb8823296.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.997Z","timestamp":1783945694997,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_13f1f273-ad7d-4854-b9a3-7f3eb8823296.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/webp\r\nContent-Length: 78902\r\nConnection: keep-alive\r\nEtag: \"5cae9008e22ccc62c09f38e52e664de6\"\r\nLast-Modified: Wed, 10 Dec 2025 11:49:58 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1IlgQNnKh7e5GRwx6trX3PTskjUvSk5T33fu7vujPb%2FpKqyPkfp5fcN3m%2B3NgE8nX1v%2BX2Ar4FP7rxmgrhBhD1oJf5xx%2B%2FK06KzWpxvZIYhiXDFSE0VMWs5zw%2FgZOeGHjT8TFkKOdZAzvQ16I5fd3JU%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105651\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e35f58fad7155-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027c19f5b730fa72ada\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":78902,"size_decoded":80061,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5cae9008e22ccc62c09f38e52e664de6","sha1":"a1f17e80566874fe9706d17a46a2d46f82bb4334","sha256":"3148a6d8c30b8b20d81c8e0873dc24170d6be114b7e3570870da05e12202d770","sha512":"49b2777a4621bd265be1b02773561be3504f5d1dd0c104f8ddd0781e36791a1f12be3093743baa2a7d21c70766e76f7d5d475efe312d725a1959acf4a1625551","ssdeep":"1536:blYjfVyd06MgAmxW/kYHFfuwKFhzwOxl3juR+GfDIroclZ:bc606u75s1wMGlfTclZ","tlshash":"5673012aa243088ae0f71039184a6be7f90d11a1e7e85fef84e7570bbe0df413d65e50","first_seen":"2026-04-24T23:10:16.877965Z","last_seen":"2026-07-17T12:47:21.572525Z","times_seen":651,"resource_available":false,"data":null}},"time_used":781,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":358,"receive":423,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/kc523-1/download/download_nav.png?1781011825626","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:17.682Z","timestamp":1783945697682,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /kc523-1/download/download_nav.png?1781011825626 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/assets/logo/favicon.ico","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.019Z","timestamp":1783945693019,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /assets/logo/favicon.ico HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:13 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 585615\r\nConnection: keep-alive\r\nLast-Modified: Wed, 01 Apr 2026 05:40:09 GMT\r\nETag: \"69ccafb9-8ef8f\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945693=73ZApDHt8ncnojFO9uRQaPhNZJ5tRe18RjCXPKXkWXxespjhHpCwLtBaszC+J/q8xLlbRcE3PMKSZdsJF5yW7kWOWJBcdABsf5O3MBD+NHHscog80WgEiTB/vuYo3smoMZYOSQoRe0+HHAG7/mIUHYrVbUjzGWa32+eteBkKxvdZO1+4NR+r30WPC+J5bmLn\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b7307ed23b7\r\nX-Cache-Status: BYPASS\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":585615,"size_decoded":586282,"mime_type":"image/x-icon","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"abd1eb812e495d993fb310ca906ea605","sha1":"77a61cd2ad4a89c22f4a979571d3c259870732f5","sha256":"ccd41d39ff7fbed7a9200f685d9b0198736d1a2f737e9d32f83ddaeef39a4180","sha512":"e8221a9acda08a0a0bc5410cd14bc72d30e6fa66cc6e7a4bc07b53f5c94b5ec670f19571246ab2f55ec2924f679543780e9f55e0ecf8a169ce3b91e38da07d25","ssdeep":"12288:zObp4IC0/qFNYge/0z5g2c+UTxVi1+4g+/F5:ibpa2qFNNe8zy+si1+4V/F5","tlshash":"e8c4230df5a39834d5dc996741db54e0c790e4183db25e323ba3448ea3d05b8ea267f7","first_seen":"2026-03-20T12:57:26.707036Z","last_seen":"2026-07-17T12:51:04.935776Z","times_seen":1046,"resource_available":false,"data":null}},"time_used":1168,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":339,"receive":829,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/65246.1781011881923.03480a32.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.263Z","timestamp":1783945693263,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/65246.1781011881923.03480a32.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:13 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-11ec7\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945693=73ZApDHt8ncnojFO9uRQaPhNZJ5tRe18RjCXPKXkWXxespjhHpCwLtBaszC+J/q8xLlbRcE3PMKSZdsJF5yW7kWOWJBcdABsf5O3MBD+NHHscog80WgEiTB/vuYo3smoMZYOSQoRe0+HHAG7/mIUHYrVbUjzGWa32+eteBkKxvdZO1+4NR+r30WPC+J5bmLn\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b730acb0020\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73415,"size_decoded":19758,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (48666)","md5":"b98dafd31fe547add2f96acf9bea9922","sha1":"e63706f4b83ed72ce8a0ffee74c7d606968bd280","sha256":"92014e9ab9f7e62a6651d0a69b63f69a84ed58e15ee5dd8e287d46b28fe610cc","sha512":"a676475f44bd6ec6ab9e7421deb8c29430404be3852f96d012418d03e9135d3ec450ee58b4871a4f8ed2a053656c9a9a6523853d6238d701144d9b72c6df8ab8","ssdeep":"1536:f2+iDvYvNjx4Uyao0L8oDNzAuMMsTAQ0mqt2pXYzA4dANVO:e+iDYvPo0L8oZzAuMMsTA7mqt9zA4dAO","tlshash":"a673a501f78272385fa7e290220f2026e16e191505ac5ed8f179ffb93ef0954aa7d7b4","first_seen":"2026-06-12T19:29:57.345997Z","last_seen":"2026-07-17T12:51:05.052141Z","times_seen":574,"resource_available":true,"data":null}},"time_used":811,"timings":{"blocked":490,"dns":0,"connect":0,"send":0,"wait":309,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/bj.ada43481.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.281Z","timestamp":1783945693281,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/bj.ada43481.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g25j.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-6b4d0\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945696=r+0f956Z+TmDiOUQLZu0a/2eBiXaMlDGDrljKtw3frmnuePdFZCsh67A0toqxlD1o8H78rQNc6uRc/hS0HF+w6J9UlJi5zAC0wqT6u7hceKCl8QKLTzLJRKc8bZ/WHYQAiUrosF3UbS4xzW8QcR5dvmklpwBybIZeaeFU+NUOQdiyP8hIKI4wuI7oa1mhLch\r\nAge: 105953\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b73147923be\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":439504,"size_decoded":440362,"mime_type":"image/png","magic":"PNG image data, 1920 x 927, 8-bit colormap, non-interlaced","md5":"2c55f8fcc8edb773be5014d8deb72c4e","sha1":"e7e55505bf22de833ec6b82a229e70bdba93b58f","sha256":"21c44535cffd825752bf9a535001b4b605147e3434cf2906fc2c8fcdcd992c1a","sha512":"bab93e8eb191df623bd7e238ae8d5cf7feae73e2a768d7b591d4dd8b7aafc199fce7c34066a272fc9137959a78a6bcd9fb388f39d4a0938f5674aaee815a3cf7","ssdeep":"12288:K+TyFzCVXhEu0hvb3kkjOO9FNkh4k6yvwUKA4AuJiT9h+:tTyFGjENkkyOWh87UK/JiT9h+","tlshash":"739423b1df0b89c858a39043dc74f99263e8d0a6bdc40ab80bf14b9176709dbbbf5116","first_seen":"2023-08-17T12:39:32Z","last_seen":"2026-07-17T12:51:05.037513Z","times_seen":2080,"resource_available":false,"data":null}},"time_used":3675,"timings":{"blocked":2937,"dns":0,"connect":0,"send":0,"wait":314,"receive":424,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/pay.8f35ebe1.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.289Z","timestamp":1783945693289,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/pay.8f35ebe1.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-154d\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nAge: 105652\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b7312b6002c\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5453,"size_decoded":6146,"mime_type":"image/png","magic":"PNG image data, 492 x 132, 4-bit colormap, non-interlaced","md5":"05d444b76263f6958a37ac82e45daa67","sha1":"a067d3a654da1ec4c51d8f049aabaa112183e355","sha256":"49166910b376f5487f30174e60fcf13aaaca9620ef1aa58cfb2c94a8c111ea8d","sha512":"7d276d57b068ec4a0125512e0781c501a96bf6c30b30304d247251190c6421a9ed7a03ec208a590d19d9a1183e3837b06d141bddd99abb7b0ee4e2a1ba28b28b","ssdeep":"96:u9g9Yof8+keuD1Kai/MXG5BHMsDiCNPFH/qX4iWXnqvcIzDRHSVyl07TrOKCm0R4:u9g9rJuYai//7FiSXnqvNYGmrOKcPwzp","tlshash":"74b18e749d6efb2a26b315c30d7499c21ea45c9e0d94f1c2244776963c732de3270985","first_seen":"2025-08-29T11:05:53.301829Z","last_seen":"2026-07-17T12:51:04.99375Z","times_seen":2062,"resource_available":false,"data":null}},"time_used":2787,"timings":{"blocked":2489,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/31098.1781011881923.4108b3dd.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.859Z","timestamp":1783945693859,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/31098.1781011881923.4108b3dd.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:14 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-561e2\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945694=E8FdoxMIiXaneiIJH8nRsEj9bqanUX/19vOzGBfRqOu7uMm0tthCqIaH5Z9EhkjGEJqO+UtOPdlD7oMK9qcmOqh42CeeqaqvIh3/4bt3zisg25NE+XlC0Mz1MIdp+DjwpVUU4FMunaWp2JkDKT2fS0ptq8rNVF5M2PBBB5EW11HVWyysDG98xECmcpSkiFbC\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b730b35fcbc\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":352738,"size_decoded":65643,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65338), with no line terminators","md5":"3c55e2f7f495cd530603e700dd3bf229","sha1":"fdcabc58e872fde99b7d704711a75bc32cc2b8c8","sha256":"1c38b781ee4a302e955baab7d3306365881227cafc2814e1085f93f4ab0342d8","sha512":"94954c49e71bd95a7543f652e03bf68b5dd26d00b33c91eda9003ef81e37aa5735e846bc9322d52181550f0d010d125479a73d83dec0fe51fa0c4f2489108326","ssdeep":"1536:Z+0YvC9jlTKAUSseG1SY46DCdlBBo3AgXOG9AsqCfCXsvCfCXsLCfCXsyCfCXsfX:sKK5sY4brG7O3SnLJNpL","tlshash":"6174b6f4c248c6fdea04ce0a7e7d6f2d50723783f2ec56c446aaf8865e92857245c4da","first_seen":"2026-05-19T02:14:56.370466Z","last_seen":"2026-07-17T12:51:05.002036Z","times_seen":606,"resource_available":true,"data":null}},"time_used":430,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":325,"receive":105,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1280x294_3ce652c0-55c8-48f5-a72d-a300accd6573.jpg","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.696Z","timestamp":1783945694696,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1280x294_3ce652c0-55c8-48f5-a72d-a300accd6573.jpg HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_b1b5acd8-3851-4b06-8e10-d549f7f09d1b.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.011Z","timestamp":1783945695011,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_b1b5acd8-3851-4b06-8e10-d549f7f09d1b.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 15438\r\nConnection: keep-alive\r\nEtag: \"a1349a63a048224ad8e87814e87bb73e\"\r\nLast-Modified: Tue, 02 Dec 2025 14:12:01 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JJwPaDYWMgkjAkGtQ%2FfWjppq%2BMeV0kV3A6EJDa2TpQPIT29z5BJCUYv3ZROO4ZBYfcq6R7m7f0Zjrvo9bsA2O%2B4N%2B5rhcgIJUdMca%2BmDNYZFBl1%2Ftmrj%2FzpnxD8ksU6EWSrG2x7T9EBL%2FnCjkqKUQm8%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105586\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e37ab7d15ddc7-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b73254efccd\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15438,"size_decoded":16601,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a1349a63a048224ad8e87814e87bb73e","sha1":"0e04bbeddf14327f501a7d2c6df6e05795879d8e","sha256":"07dea36c21de6e1a3b038a16fee3fe652275f33b1757c12ef30396e4dcabd2e8","sha512":"6e92d8f202db95f03407b4594b217cc15dd52e187fd69f779d45407cd9644095929c9a657b49fc030e7a2f4b1dc1f92cecddbdf72ceddba23cf33b759b782c11","ssdeep":"384:8033ZoVI43DY5WxPnFK9OMJuFUzYc4Ig30k8E2:PobD3xtwn+jc4IgV8E","tlshash":"2d62d0402ecaf0713ba1781ebb7df58804b89937b45a724758b70471b66d4ae13964f3","first_seen":"2026-04-24T23:10:16.871482Z","last_seen":"2026-07-17T12:50:21.094223Z","times_seen":729,"resource_available":false,"data":null}},"time_used":5829,"timings":{"blocked":5522,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/fe4677edee16450cafac7bdc06f2fd4e?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.636Z","timestamp":1783945694636,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/fe4677edee16450cafac7bdc06f2fd4e?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 349732\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 80879\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"fe4677edee16450cafac7bdc06f2fd4e\"; filename*=utf-8''fe4677edee16450cafac7bdc06f2fd4e\r\nContent-Md5: B5arPxi6CQc+Goxl3hvo7Q==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FjxaL4zAb-3xy51QUKpyrrdazQ-u\"\r\nLast-Modified: Mon, 06 Jul 2026 19:44:20 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: aVbwVGdvD\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: SNkAAACQw1eZj8EY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":349732,"size_decoded":350489,"mime_type":"image/png","magic":"PNG image data, 713 x 800, 8-bit/color RGBA, non-interlaced","md5":"0796ab3f18ba09073e1a8c65de1be8ed","sha1":"3c5a2f8cc06fedf1cb9d5050aa72aeb75acd0fae","sha256":"cd644b5c3897f43d8ce46cc348d2f9c0cabd12eaea0772dda0ea46e56be54305","sha512":"62cb1d8c5d48dcbfe847169d95682db31f172a636248b4076371aa481b78f6c4309a279d7ad49843b114b8fb35e7af94b4a602f46b739b085974dc5cc318877d","ssdeep":"6144:Y/IALaeAOC2Tf7cpxhUO8ldKgCB1wP5W5UNvQkOM6ZtZD/4Muw3y4d47oKs:YfLIB27ohr8lYgCJAiMIu05d4Rs","tlshash":"5c7423c076c8a5f66b03a2af42d4f4232eb08b35dee15efc959be05cad150b93991127","first_seen":"2025-08-18T01:05:47.669333Z","last_seen":"2026-07-13T12:46:22.381102Z","times_seen":45,"resource_available":false,"data":null}},"time_used":2185,"timings":{"blocked":1133,"dns":0,"connect":0,"send":0,"wait":313,"receive":739,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_8953c3b5-a3a1-4b97-a677-4b5efb3fb94a.jpg","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.693Z","timestamp":1783945694693,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_8953c3b5-a3a1-4b97-a677-4b5efb3fb94a.jpg HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_fc0e1468-bc71-4d42-9849-b6735b50978a.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.005Z","timestamp":1783945695005,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_fc0e1468-bc71-4d42-9849-b6735b50978a.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 11120\r\nConnection: keep-alive\r\nEtag: \"c2103cd78445d5d98b8a8a38dee95854\"\r\nLast-Modified: Tue, 02 Dec 2025 14:12:18 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UD2ozPasogH%2FL63aqWgD%2BfyJUUoiuW%2FMODmMPZ5EGAKXM7lguTM2T8XMtfi4x6XoWof9D0u5IGQSKZJUajEqW4XWq7dEwgBMmTt8y7CFFEkV%2FgYQix0GfheqkU8I8oVreyGqE52zvS10htJQqlyS3k0%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105588\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e379d99680491-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b732422fccb\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11120,"size_decoded":12275,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c2103cd78445d5d98b8a8a38dee95854","sha1":"77e8b55343bf4092e6a298d564b828b7167d73a7","sha256":"23f7d437c49f455c0bbe3d040982bd6cf8d25411106c3eaa156cc3e4760c3c1b","sha512":"c1f7b1f8f0187dd22795297f21febc867932be6f47b9d033e4df6dbe5f456cf4f7b97d88fff1320945d581b13e4e23cd66330b4432f6f506e504b9dcc01776fa","ssdeep":"192:UFGWMz7rqmua13y84zY36YC0JwSCH2XOc1wK3/RZ/dHGKFdVr5suOWQgcSQBO4mZ:Qmus3ytKC236rKJr53IW4mZ","tlshash":"1f32afcec9dc3b159c35837d36252988ea4909130b3762d2752a64c646eee8a3196bb3","first_seen":"2026-04-24T23:10:16.81812Z","last_seen":"2026-07-17T12:47:21.806089Z","times_seen":703,"resource_available":false,"data":null}},"time_used":5522,"timings":{"blocked":5223,"dns":0,"connect":0,"send":0,"wait":299,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/api/sport/match/list?sportId=1\u0026client=web","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:19.616Z","timestamp":1783945699616,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nx-request-source: https://g25j.top\r\nXign: uS5f5yhBWe/8Gy8x1BW/cljNKEcyl8Y/mF3b55JDnAX+O1x7UUVSV0qbbRSE8g05XfNUKCWh89B9eK/1bcHJOy0xz36HpJ1h1oa96zK03+pZ8/1yNBWKyVwx4AhaTflvf7ZfONOJZX+7tCgURgijKdhjTyLuLk6Eca9OOIP06aE=\r\ntimestamp: 1783945699613\r\nsign: 5t3o4t143f6q1f52\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: HQKEwmeYFSSEaBtwbDNtyDn6TxTXzDaR\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:19 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945699=4MEiqPSe8OxMuqjLKZveDUbGED9Mvo3jTwEG5nI2R2GsBmFsb2Ea2LZ4cSajf5ZjdWZipM4lTTtxcnnFp3YhHrpEd5JqGB5AdfD1pY7l6RLd2tdtdQuP5GUr/lvKBKr79H83O6+4JFoMai8hLvCcHUKJzoh7r7ak9alQAIfeYO95g9NMuvfD8OEH79RBP7Tt\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027c19f5b7321bb2af2\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7898,"size_decoded":2401,"mime_type":"application/json","magic":"JSON text data","md5":"5152b3f9758d2c8f769c668a11c186b4","sha1":"c32ea27206d117c4399f28fcd1bfb7cd11a3e9b8","sha256":"55564c1affe6974f53ba7210b26f006daeef7e8c515323bede36523f147b8a0f","sha512":"6c2301884368986161156dd4b6be7c6d6dc6c55b22c280526930fb07d8238fe600cdfd00df3072332f31f66ed77d60af87f93ef037042a75e7b65fae1d830c37","ssdeep":"192:ev+jSuA6a6Rw2A1idA4w8KHWGiHeQuXKRfjTK4lx5L/dSi/5S1tDxRkTIrMLUaP8:ecAAwydi8DG7rXKJjm4NL/n/0tDx2kr1","tlshash":"a9f1435681dd58952b8c61d16c1e3f4988befa1b0adef5c5de0ecf0966b43f78204d22","first_seen":"2026-07-13T12:28:15.125434Z","last_seen":"2026-07-13T12:31:42.484415Z","times_seen":7,"resource_available":false,"data":null}},"time_used":312,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":309,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/4b62133e38e5475fb15de132ee7fe940?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.641Z","timestamp":1783945694641,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/4b62133e38e5475fb15de132ee7fe940?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 55776\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 71877\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"4b62133e38e5475fb15de132ee7fe940\"; filename*=utf-8''4b62133e38e5475fb15de132ee7fe940\r\nContent-Md5: fztOHXJymqX7XRNEA7hBVg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FrXyDIIGDqUraHz5V7rx_WTzvXfr\"\r\nLast-Modified: Tue, 07 Jul 2026 19:45:46 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: TN786Ump6\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: FRMAAAC5oafJl8EY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55776,"size_decoded":56532,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"7f3b4e1d72729aa5fb5d134403b84156","sha1":"b5f20c82060ea52b687cf957baf1fd64f3bd77eb","sha256":"474283efd98a4aec3bf50a340567bd2eb43c243ca01a675bd4d5ca6e4df89452","sha512":"e6de2b398de56de41aec2685c9e0778db07ebf00d4c4a910e2752816bb8717121cde48ff95c70a438e76e8583521dcadd201550411cc9e0c69833077b5633396","ssdeep":"1536:Dwb+6262xKREoRb3j5zYB9FhVbdLpfMAGaBuRQl4twi0ll:Dwb726203BtGVV6AGtX6","tlshash":"444302dc32674329a1586035fd30a4bbbcb06bfd21f609b4d291c9c6d1e92b3ac899d5","first_seen":"2025-09-10T06:10:00.854926Z","last_seen":"2026-07-13T18:28:51.21329Z","times_seen":54,"resource_available":false,"data":null}},"time_used":2109,"timings":{"blocked":1644,"dns":0,"connect":0,"send":0,"wait":294,"receive":171,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/ef0f94c1a69c4f43bc9934f0376cd987?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.655Z","timestamp":1783945694655,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/ef0f94c1a69c4f43bc9934f0376cd987?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:17 GMT\r\nContent-Type: image/png\r\nContent-Length: 55940\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 3179\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"ef0f94c1a69c4f43bc9934f0376cd987\"; filename*=utf-8''ef0f94c1a69c4f43bc9934f0376cd987\r\nContent-Md5: JFupnreOf0jWMhG/arNcwQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fsnm2goWVD4wQ9v0r_uwqr4kFR5W\"\r\nLast-Modified: Fri, 05 Jun 2026 11:28:33 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: Y3ODXpcq0\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: Qr4AAAC-n-JE1sEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55940,"size_decoded":56695,"mime_type":"image/png","magic":"PNG image data, 145 x 200, 8-bit/color RGBA, non-interlaced","md5":"245ba99eb78e7f48d63211bf6ab35cc1","sha1":"c9e6da0a16543e3043dbf4affbb0aabe24151e56","sha256":"f1b432967ea1c8f8410cc061559cec45db05bcac0db18969a12ae93064bf67a9","sha512":"a3f5b34e37e3d7132e3bce03ad61eae494875e52ee649b981ae63890fee91f808c28051a30ff54c703f830cef938fce6881daba715a6b57647dfed557b3e03b6","ssdeep":"768:jNBeuRrt8yncdBVDtBvVQucC2l83cza3NvWa1mLvX8s9U6aVGgruNXtzMSH3bvOx:p0uRrt8fBxcC2l83B8yBV7rgzRazl","tlshash":"8a4302314638b088e0352750cfd9788a643e25bdc6c2e73d1fef4f52467ab0fa6a5046","first_seen":"2025-08-17T08:15:23.981006Z","last_seen":"2026-07-14T12:59:09.457751Z","times_seen":64,"resource_available":false,"data":null}},"time_used":2695,"timings":{"blocked":2426,"dns":0,"connect":0,"send":0,"wait":250,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_ebfde7c7-fdc6-4b58-9f46-2e709f79d7d7.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.993Z","timestamp":1783945694993,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_ebfde7c7-fdc6-4b58-9f46-2e709f79d7d7.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_79864bfb-d71a-4513-a524-8823b86ee01d.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.002Z","timestamp":1783945695002,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_79864bfb-d71a-4513-a524-8823b86ee01d.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 69284\r\nConnection: keep-alive\r\nEtag: \"1f023b2fde7cad748f40bc1d26f7bcf5\"\r\nLast-Modified: Wed, 10 Dec 2025 11:51:05 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jj7W8RURvd8pqJCjYaiZnfEmUtr1hU48uW4ucvjQMR37A8TSCTwgl6Cfp%2Bm5gxBpcQK5p0cmrIVJP0bVibZLuyT%2BjsNpn%2F8n7oPtp69qduxJPcDAocyJuUqjHDUqtnSmihSuLY5myCA2uJ0ZTIbFI%2F0%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105587\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e37a81ab703d3-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b7322eb0041\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":69284,"size_decoded":70439,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1f023b2fde7cad748f40bc1d26f7bcf5","sha1":"b6f87014c3efd309dd208adbde662efd12ed1630","sha256":"37500d21d34445843f3857ddc61970168d68b86f1f37208f3e0b05b5fe1575ee","sha512":"afc994859a75b3a91939974cdd03b6973f68d7e5be316f8a67ac60412782cb748d7ad3b7b7f62d931496e61c198098e6ff42f280ec5c5ed40164f5351dde15af","ssdeep":"1536:LQyDg35QNQHWhyCUVgapIL88bSxgjfxjgS1xnVluzXj1/7qLE0rOFXrb:8qm5MQvC4gapxxgFjgQn7ax/kE0rSH","tlshash":"d66302cf2367021ed8f7a779922a46dda041f25ed16a73acfc919d45f88221726ec09c","first_seen":"2026-04-24T23:10:16.798872Z","last_seen":"2026-07-17T12:47:21.622884Z","times_seen":674,"resource_available":false,"data":null}},"time_used":5265,"timings":{"blocked":4911,"dns":0,"connect":0,"send":0,"wait":301,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_c0a34e2a-97fa-40dc-8123-594806696886.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.984Z","timestamp":1783945694984,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_c0a34e2a-97fa-40dc-8123-594806696886.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/sports.60212fd6.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.276Z","timestamp":1783945693276,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/sports.60212fd6.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:14 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-1c734\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945694=E8FdoxMIiXaneiIJH8nRsEj9bqanUX/19vOzGBfRqOu7uMm0tthCqIaH5Z9EhkjGEJqO+UtOPdlD7oMK9qcmOqh42CeeqaqvIh3/4bt3zisg25NE+XlC0Mz1MIdp+DjwpVUU4FMunaWp2JkDKT2fS0ptq8rNVF5M2PBBB5EW11HVWyysDG98xECmcpSkiFbC\r\nAge: 105947\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b730c1a0023\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":116532,"size_decoded":117112,"mime_type":"image/png","magic":"PNG image data, 666 x 541, 8-bit colormap, non-interlaced","md5":"fc82aa907334f929011fc2a6ec906f55","sha1":"f76bd75b9d1235807c70c7d763a1865d7c3f8d4e","sha256":"2ae1d61176960d7ddfddcb30a69d22b9da893687370d8cd26f4917d129a1bf3b","sha512":"12ef7a828d7d4228596b0db0ad77b200e8ffcfe2457d12821a4e9778b62668ebeef075c2bc79076e36291e3015afbfe276a2ca230ead018b38e2d3fd803dd31f","ssdeep":"3072:/ZEgiWqpGRwEyiwX0wgOZzbKoSxNiSvrUeO4h:/ZLf/R2iVwgAKoSPiSvVOy","tlshash":"76b3021c79775a2083c6bcb40b583aeae09b3dc19d169808d68b7791993df43c970bed","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-17T12:51:05.059755Z","times_seen":2275,"resource_available":false,"data":null}},"time_used":1403,"timings":{"blocked":803,"dns":0,"connect":0,"send":0,"wait":586,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/c5c58d205be9425bbadb99117523d9ef?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.625Z","timestamp":1783945694625,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/c5c58d205be9425bbadb99117523d9ef?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 17930\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 3928\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"c5c58d205be9425bbadb99117523d9ef\"; filename*=utf-8''c5c58d205be9425bbadb99117523d9ef\r\nContent-Md5: JtWIQUOLZJ2nWMFwh85LGw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fq-pr7wd3RreMM3K0udDhrvkqSxq\"\r\nLast-Modified: Fri, 05 Jun 2026 11:28:51 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: VCsGsofD1\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: iewAAABtBw6W1cEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17930,"size_decoded":18685,"mime_type":"image/png","magic":"PNG image data, 464 x 400, 8-bit/color RGBA, non-interlaced","md5":"26d58841438b649da758c17087ce4b1b","sha1":"afa9afbc1ddd1ade30cdcad2e74386bbe4a92c6a","sha256":"d857d22d284b433541374e657a786b9dbccc073b11eeef6b4718ae8578ca0154","sha512":"3b976daefe4d9dd380ac14bb93bb85f344bc3e32058b5df5c27fd379e27d035ed1ff84e8e66c9004f0beac75335ec1aa27ab681dcf34032fcd1c0c804b045667","ssdeep":"384:ZE46roF2yeq4xEw6DI5MUn+x7rW7Dv4b1ngK5122HIUSt16:ZE46lsDI5zn+lRb1nl5KHt16","tlshash":"9182c06a22a9bf70252dc0dc7a59dbb346505445f0bb9e3397565c032ffac0d6c610bc","first_seen":"2026-05-01T12:09:31.530522Z","last_seen":"2026-07-15T18:03:59.45748Z","times_seen":44,"resource_available":false,"data":null}},"time_used":1009,"timings":{"blocked":-1,"dns":27,"connect":241,"send":0,"wait":481,"receive":8,"ssl":252},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_ad0ed5ff-8fa0-4231-a619-ce0616ad2a8d.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.992Z","timestamp":1783945694992,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_ad0ed5ff-8fa0-4231-a619-ce0616ad2a8d.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/config/initGeetest4.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:09.996Z","timestamp":1783945689996,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /config/initGeetest4.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:10 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-3a7f\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945690=CCac8hDsrbpYykEPFN5/XPYWTARB58kum4tSQMcDgGBqScVkYn3oe/4m0/vmogS5W6NImtdm0ZkgVO8gLQdV+0/+KgBEB3CTNPGw4G1LPRVJF+txskvNjZoFK2gpIoTqf9RZij5Bjuv2eFJmCQUUphXTWUgn4xHrp85cw4fLVzkqnQCxhbRtvjVxEfqhPuy8\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b72fc1f0016\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14975,"size_decoded":5043,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"87855e19802d75b55afa7bcf3af515c1","sha1":"4af373375728a98d623f2299a68a91e150f2672e","sha256":"9ec8a5ef8c8ffe369dd1a5c4730dce6570c0d90955798c0be4ac04ef1c8f4baa","sha512":"3baa6d9e916abfb3d38b7ebb9372c5987e8f10534bb978383751c0094f8f5a3e764f9b8e44a73d9d4871cbaeca7e1939f0ffaf9499af5c4a71f64c3588167d85","ssdeep":"192:23aP8Ha0D+Nu5dq+EvNiqc4K25MB5VYaiQwSL4SScQVy8QRHIsGiz0iX9rES6Myy:2fe61w1iXKb2sMGUI+KQTwwHlB","tlshash":"00621d0d68f764534553b4388b9fb014b5388a53042cde41be9ce354afa843d9bbabdc","first_seen":"2026-02-16T20:32:40.162764Z","last_seen":"2026-07-17T12:51:04.943165Z","times_seen":1532,"resource_available":true,"data":null}},"time_used":302,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":302,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/kc523-1/sponsor/sponsor_nav_web_2.png?1781011825626","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.268Z","timestamp":1783945693268,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_2.png?1781011825626 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:17 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68dbcacf-1922\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945697=Y8wY1Rz8+nsWEzaT171EoSVw1V6QOLKgyV5hl0Psguoywo5vWkE+mvrqS2I5wKeOG8V6UnPoL1rn2EYkSxB1+/Gdi7ZvAW8Snric2mM/0qCL09PEwVFefWSddT9xXemyzWqK+Kc64VDD6kKv2AK5o2rKkDOM+adI4rB4P5cj8BIT5z1Iypy2zynkEKBhyWkH\r\nAge: 105952\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b7317bd2481\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6434,"size_decoded":7129,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"e31cb9f70abcc458288bb53868031352","sha1":"965f7cb9aaf0d166c21b8681b0671d17e019c74e","sha256":"33295ad776e1fde54dace5b0343c9aab9a2d70cfa8848e5cbd09065c340e294f","sha512":"acd328b1f4cb6e1c7267696487f637ea5ae4b724f7ab32516632a3eb2c8b4e374fa472ab77120230258fb49a23f54ba3988b155004b46e69519fe3ef57ee79c9","ssdeep":"192:RYc0QiGWn0WG2WmjNJMjOluoj/xrASMJmoJESULHT:RYc0QiGlHmjOo1j/xPMAG2Lz","tlshash":"c9d18ea6ea2a4a52cf8d0d633efc5b0671508e582f390826809a1d1d57767fa24a13e7","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-17T12:37:28.394834Z","times_seen":1951,"resource_available":false,"data":null}},"time_used":4097,"timings":{"blocked":3797,"dns":0,"connect":0,"send":0,"wait":300,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/api/tenant/domain/list","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.174Z","timestamp":1783945694174,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /api/tenant/domain/list HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nx-request-source: https://g25j.top\r\nXign: M5xUVGYEb6qlhJeJe3y21tVNFFST+MNjuou1N7FdUS57i9PlWpnqiLS058qD8jqx4DnQFQ1f1JIk+JDZb8hHmQrOpgaXYOPTgmgjTg5XZ8nmlwFgTI5bdfxLIsFQqfqtvhl3BvLiZqW+K6Fbfcekxs6IYpAm12ZTz/ZJMk2Axus=\r\ntimestamp: 1783945694172\r\nsign: f723e4q6s171b72v\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: HQKEwmeYFSSEaBtwbDNtyDn6TxTXzDaR\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:14 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Mon, 13 Jul 2026 12:38:14 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: 830b96f1bb414fd0a55ec28fbf1b7a77\r\nPragma: public\r\nVary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nX-Content-Type-Options: nosniff\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945694=E8FdoxMIiXaneiIJH8nRsEj9bqanUX/19vOzGBfRqOu7uMm0tthCqIaH5Z9EhkjGEJqO+UtOPdlD7oMK9qcmOqh42CeeqaqvIh3/4bt3zisg25NE+XlC0Mz1MIdp+DjwpVUU4FMunaWp2JkDKT2fS0ptq8rNVF5M2PBBB5EW11HVWyysDG98xECmcpSkiFbC\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b730df30025\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1108,"size_decoded":1825,"mime_type":"application/json","magic":"JSON text data","md5":"5d9e96bd132a2c24281ae50f2b09efe4","sha1":"503ea18100d0f1573baa195933355a1372e93841","sha256":"7f205b18b5deaae96622989dbc8ad73999a9616e96ef26d909f19525deadb328","sha512":"ab5a589dc81944d2fe05d656777e9e490d42a2fd68c7e577387cfdd47c9b0c5276ca2f91a3868407c373e500d00bb5360a5ae035c7c0cb1addf47f20755a268b","ssdeep":"","tlshash":"fb11c6101c6f12c8d6e8d29263503345388d8b76056db91b69d6b74fae0583a32120a4","first_seen":"2025-08-29T11:05:53.144028Z","last_seen":"2026-07-17T12:51:05.088188Z","times_seen":2207,"resource_available":false,"data":null}},"time_used":678,"timings":{"blocked":386,"dns":0,"connect":0,"send":0,"wait":291,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/999376ef5e9949b788722087e216f7c0?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.642Z","timestamp":1783945694642,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/999376ef5e9949b788722087e216f7c0?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 9163\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 70069\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"999376ef5e9949b788722087e216f7c0\"; filename*=utf-8''999376ef5e9949b788722087e216f7c0\r\nContent-Md5: BQpPdqWtm27e71p/BOrMtA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FnOooirOpw7_U6xAACj83fvHacIS\"\r\nLast-Modified: Fri, 05 Jun 2026 11:28:57 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: m7dLPXVVm\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: _D0AAAA5SYxumcEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":9163,"size_decoded":9918,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"050a4f76a5ad9b6edeef5a7f04eaccb4","sha1":"73a8a22acea70eff53ac400028fcddfbc769c212","sha256":"45799aa8be9962228dbd4531802e0e424c950b381c23f8feb70364822f1d6d5f","sha512":"4bad8f4ea09cb8ac13247c841d7d6acd3be22ae36355bdcb1e064a0ed813ac9a68b1eccbd78154e5d2f65bff1ef04518a4899e70f550342f2da1a39fd18d55c1","ssdeep":"192:to7ffFKPUssDJwa8T5AzL+6MLqNJFKFWnCHxohOFHUaOz:2fcEtWKNML3DxohAHUac","tlshash":"0c12af94d3a749e4c4d48b1e6010894fb7c6f9e2f7e2358f0559d437441912a3fed29e","first_seen":"2023-07-17T19:56:39Z","last_seen":"2026-07-13T18:49:11.229829Z","times_seen":55,"resource_available":false,"data":null}},"time_used":2040,"timings":{"blocked":1790,"dns":0,"connect":0,"send":0,"wait":250,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202505/_webp_size656x844_f676ec47-4b6f-4d37-b476-fd69f2381a1a.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.006Z","timestamp":1783945695006,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202505/_webp_size656x844_f676ec47-4b6f-4d37-b476-fd69f2381a1a.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 31452\r\nConnection: keep-alive\r\nEtag: \"2c3c63fd994d8d3c68a43ab204dc29af\"\r\nLast-Modified: Fri, 24 Oct 2025 10:14:42 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105655\r\nCf-Cache-Status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=l7TWlqBQmz5QMtV07dPLFhCFW8hqPWgAl7Vm5e0npwhDSWPwCgsHqP9Rq3P4yUjqEm7nYT5CrNUO4omk0cfAX9MnZVVS4WQHeVow7ai2RsNXqSLxXVGj49uaPhkAyGrEXEDm8KgebRdxhc5g4s0jarA%3D\"}]}\r\nCF-RAY: a19e35fa0ca5ddc1-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b73244d0044\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31452,"size_decoded":32599,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2c3c63fd994d8d3c68a43ab204dc29af","sha1":"f5da9ac11b57d67e7b0a21bdf3d2d5134eae1e2b","sha256":"b38e08c497bfb9faec2e112ff1a093f8938984e5c098484f7eca99900d1e1c72","sha512":"e83fd01696f5a79d5b2ef7ad13a442455c94977c810bceb5a6a656e08927f8a160a5b6be8e8e04bf10c0b2b721254319cb5fe15982a7ae0f7272a25a61f56127","ssdeep":"768:JXiQbj17p1iaPPQUz4ATG+Qkx5UL1ot3u3QO3xOBiw9urQ8:VdJp1iuPXECXUJ6e3QOBRwYQ8","tlshash":"74e2f1f968c3c9342ca43ed546ff15d58dd8b3d475e60863eb222d049137822e9c9e2d","first_seen":"2026-04-24T23:10:16.870222Z","last_seen":"2026-07-17T12:47:21.577559Z","times_seen":705,"resource_available":false,"data":null}},"time_used":5582,"timings":{"blocked":5265,"dns":0,"connect":0,"send":0,"wait":301,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/0e483a4be3c74196897efc0c2b791369?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.644Z","timestamp":1783945694644,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/0e483a4be3c74196897efc0c2b791369?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 91904\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 52080\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"0e483a4be3c74196897efc0c2b791369\"; filename*=utf-8''0e483a4be3c74196897efc0c2b791369\r\nContent-Md5: xaZL7NmiGfgnBGEKIcRdRg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Flt2EFr8NkbvqGzN6J4KemDUtA2Z\"\r\nLast-Modified: Tue, 07 Jul 2026 19:45:46 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: ux0UTlygc\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: lhoAAACBygLLqcEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91904,"size_decoded":92660,"mime_type":"image/png","magic":"PNG image data, 800 x 800, 8-bit/color RGBA, non-interlaced","md5":"c5a64becd9a219f82704610a21c45d46","sha1":"5b76105afc3646efa86ccde89e0a7a60d4b40d99","sha256":"e3092804326aea9a5fe2aa183312edb62f886fb582e204d376c71cd5ad9e1734","sha512":"6d9a970815b4b5782e5a9811ca6f826b60917836462b27285aa089b8288ee368e54cde10a5c007c158bacc2f4cb4dae3f14881d62acb0bbc0ee9e36fd39f227f","ssdeep":"1536:ewHLhWWAYllgvjntQ49SM80+222DHuGkqLMM2Es1mGlxMsRL8Fe4jbvL6DPS6bKU:eK0Qlg7ntQZ0N5SG97s1mGrMVY4fvmzB","tlshash":"bc930279a4014088994e1b3d2dd46fa5ead765133782e21ad9cef088f93cb6e528830b","first_seen":"2025-02-26T15:38:27.744404Z","last_seen":"2026-07-13T19:00:13.201692Z","times_seen":36,"resource_available":false,"data":null}},"time_used":2144,"timings":{"blocked":1827,"dns":0,"connect":0,"send":0,"wait":263,"receive":54,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/LIVE.88ccbf98.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.895Z","timestamp":1783945694895,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/LIVE.88ccbf98.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-f0e1\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nAge: 105584\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b730f420027\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61665,"size_decoded":62398,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"372d01a2bda7ccdca1e7966af39c2327","sha1":"d438c1947b711d032c5621a6b4b08bbbca2c338d","sha256":"4eac7be4c06fa607ef5e95789e3ead43806bfeff97872ed6567e3810f2f661bc","sha512":"9f04160df8696cf984cd77604dddaea73969479e4f1c5050e53351df7f11e85d8ecccb14ecb87dcd58bea0ba04d9ba5ea3f99c69a179ba88ad38d5416b7a94d3","ssdeep":"1536:jTjrlfQBxhFWiXt2lnJE9mARbSK0k2C8ve1HfarCtt:jH1QjwWUC9mA10jC8WZfaQt","tlshash":"dd53124a2ecc3a1f7bf21e5e06f286814d36a186d0f9ba5bc6e70ef1218521de0e4535","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-17T12:50:20.980033Z","times_seen":2028,"resource_available":false,"data":null}},"time_used":594,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":594,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/configPage.js?v=6/9/2026,%2021:37:10","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:09.995Z","timestamp":1783945689995,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /configPage.js?v=6/9/2026,%2021:37:10 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:10 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 949\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:20 GMT\r\nETag: \"6a281710-3b5\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945690=CCac8hDsrbpYykEPFN5/XPYWTARB58kum4tSQMcDgGBqScVkYn3oe/4m0/vmogS5W6NImtdm0ZkgVO8gLQdV+0/+KgBEB3CTNPGw4G1LPRVJF+txskvNjZoFK2gpIoTqf9RZij5Bjuv2eFJmCQUUphXTWUgn4xHrp85cw4fLVzkqnQCxhbRtvjVxEfqhPuy8\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b72fc1e0015\r\nX-Cache-Status: BYPASS\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":949,"size_decoded":1622,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (917), with no line terminators","md5":"e6aa74bb352ef198ba3e1c9a4b01b014","sha1":"2ea8bd6b5045475a36432f7665a129728e822d9e","sha256":"73828e873c0b6e847b37d78941ca436247471dfc90a12f743964f869f75abd5c","sha512":"2faaf24fdf1e4da637af8e9f82d1778bf061b00752dfca0c8f73432ba236a7b69410a7ad2a73727bc83e6cd631fd6555c3cc0d9d3a5d8a7f81818dd66566011f","ssdeep":"","tlshash":"be117aaf57444dffcf1d7e00a08b0a5ea8bc61d261889d4da8e9cf29e1c99002378978","first_seen":"2025-09-04T00:49:32.949926Z","last_seen":"2026-07-17T12:51:04.9763Z","times_seen":2409,"resource_available":true,"data":null}},"time_used":300,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":300,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/service.68be110a.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.284Z","timestamp":1783945693284,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/service.68be110a.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g25j.top/css/index-399e2569.1781011881923.a7b0b4f4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-2991\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nAge: 105951\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b7310d123bb\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10641,"size_decoded":11373,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"993784a38ddc1156572bfc3308055ead","sha1":"becff431867226bf323b5a6535fa383992f107eb","sha256":"abca3af980888b08c6cbd57366b3ac94344d66ea048484c4f9867e300ee8703a","sha512":"48790c6340f273a58295fc6607306353ab69d5a818569fe36ef1bffc8fff084b23d37b401e10502b830c67a5efedca56c1c9d778d6198e4069018d055f1869f0","ssdeep":"192:NdsarkpjwOOmfStcnaHtzB3l2eKD9RdfXtRqi3ln+ojjjKMGlnyL5H7nx+:nJQpjgOz9Dd0orKMGlnA5Hbs","tlshash":"8822c0c41e1be1b6d2ffa916b28543a04b3421fda1a24c342d828c04ccad56ac91f9e7","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-07-17T12:51:04.942671Z","times_seen":2163,"resource_available":false,"data":null}},"time_used":2309,"timings":{"blocked":2004,"dns":0,"connect":0,"send":0,"wait":305,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/2cc1838fa8f24e82a6039e830ac357b6?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.632Z","timestamp":1783945694632,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/2cc1838fa8f24e82a6039e830ac357b6?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 279934\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 2396\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"2cc1838fa8f24e82a6039e830ac357b6\"; filename*=utf-8''2cc1838fa8f24e82a6039e830ac357b6\r\nContent-Md5: ZXcL+RINXCJ2Z1V9dGzytg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FjhhjMUwRFD-4tYMO4C1aFOk4WIC\"\r\nLast-Modified: Fri, 05 Jun 2026 11:29:00 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: gp63LwvmR\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: CC8AAACV77361sEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":279934,"size_decoded":280690,"mime_type":"image/png","magic":"PNG image data, 445 x 445, 8-bit/color RGBA, non-interlaced","md5":"65770bf9120d5c227667557d746cf2b6","sha1":"38618cc5304450fee2d60c3b80b56853a4e16202","sha256":"4f3fe13c4ec1841c5833a1de948c04499026589bd009fd060b16aacbb4a1c564","sha512":"24f6aec72ab3e8f457af8bfdf6126b58ea8537442d992105914d98bd1e643132ea96e4080b58de6c36b8aa1119beb308973b713ed9db088df2d95d991d8fcb40","ssdeep":"6144:qDTYBlqH22PqKjJSqrVKrJyBmQFX14pS3Uk4bf4AZDd:qvYBdkqKjJSqrVKrJyBbXXX+5","tlshash":"4454230ca4f12f61c5166d2ecb38f1bce6e020d15b9530d675a2b4b3c69cad657a43bc","first_seen":"2026-07-13T12:20:48.202515Z","last_seen":"2026-07-13T12:58:52.755993Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1813,"timings":{"blocked":-1,"dns":20,"connect":244,"send":0,"wait":488,"receive":809,"ssl":251},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/af60ab570c514f448c3eee5024bae655?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.635Z","timestamp":1783945694635,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/af60ab570c514f448c3eee5024bae655?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 18672\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 80879\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"af60ab570c514f448c3eee5024bae655\"; filename*=utf-8''af60ab570c514f448c3eee5024bae655\r\nContent-Md5: EZH1CReTkPMOLFLbuXJCzw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FoAMZatQG_dVbZ7eD1swhAWusY5J\"\r\nLast-Modified: Fri, 10 Jul 2026 01:49:09 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 1hfL9AXwG\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: Ry0AAAC18FaZj8EY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18672,"size_decoded":19428,"mime_type":"image/png","magic":"PNG image data, 180 x 229, 8-bit/color RGBA, non-interlaced","md5":"1191f509179390f30e2c52dbb97242cf","sha1":"800c65ab501bf7556d9ede0f5b308405aeb18e49","sha256":"0e98d62cde63ce5c10e0a78871442edad4f996f54228e244eb33f4e762d7435a","sha512":"bc917c5edbfb449c41dca7b848bb1737b9b4d31f4e840c4104f3f6fe5351080bb54e07988db64b3009a317b3ea32b13317fd360f04bd34191e54040a5175b208","ssdeep":"384:QUYkDcOC94KnwS+l7nmdOLIQ/kIIg3sv9MMmlJ:Q/l5A7mmIQhsQ","tlshash":"8782c089e88ce591e1aada4147130d13f7f9667a9f7b8c2e7c622fed1b4028c995049c","first_seen":"2025-02-24T02:30:01.350727Z","last_seen":"2026-07-13T12:58:52.740638Z","times_seen":75,"resource_available":false,"data":null}},"time_used":1383,"timings":{"blocked":1038,"dns":0,"connect":0,"send":0,"wait":318,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_bdd30f19-a4d8-4eb3-b2d5-d24180d2e353.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.987Z","timestamp":1783945694987,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_bdd30f19-a4d8-4eb3-b2d5-d24180d2e353.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_b219e889-d34b-4c28-b534-674fb2e77fdd.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.004Z","timestamp":1783945695004,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_b219e889-d34b-4c28-b534-674fb2e77fdd.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 105348\r\nConnection: keep-alive\r\nEtag: \"e55c87e5077d7d737d02e9a373cf6a5b\"\r\nLast-Modified: Wed, 10 Dec 2025 11:55:39 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U7DCvdkFSrFpMGk7ZxpU8%2FRv9koJJ9vQHH35NDZ%2B7rualzsB14hlM4ESTyHfCaWHD3lFy5RpSuqP2SXruLdMGpw4hKJrqeMF00%2Fszlc%2FqiBXOgZQipK5wRwav1cPrMPbdvKeTHNu3yaGcqQ964HXU3g%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105586\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e37ab2d342107-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b7323bb0042\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":105348,"size_decoded":106504,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e55c87e5077d7d737d02e9a373cf6a5b","sha1":"21898eb8dc994254eb1a125a5f6310fcf94b08c2","sha256":"e2a9d5843140eddeabf22fd2e092ea761500c7b0cbf432c3de4f0e5fda23d2d5","sha512":"b17785a3c181a357def9c7bdf608f2ceb1df6b17339a0b2756e8fef4930f04fbc2fc70d2a4f22cefec30adafa5d9d1b0d259594b97dfa6a7c1fd650322e27f41","ssdeep":"3072:aJ/fAaUQyCHbeJiOjCkW/cRnU/xMT2Wfw//CVX2W:a1oaRyCPYCJe2WfwoX2W","tlshash":"42a3123992169346e97329aa30f80f4dde9874557e26204d78c8d64e45122f2fe78fca","first_seen":"2026-04-24T23:10:16.778762Z","last_seen":"2026-07-17T12:51:04.973283Z","times_seen":687,"resource_available":false,"data":null}},"time_used":5750,"timings":{"blocked":5119,"dns":0,"connect":0,"send":0,"wait":298,"receive":333,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/chunk-svg.1781011881923.7ca9cdc1.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:10.005Z","timestamp":1783945690005,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/chunk-svg.1781011881923.7ca9cdc1.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:10 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-72eeb\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945690=CCac8hDsrbpYykEPFN5/XPYWTARB58kum4tSQMcDgGBqScVkYn3oe/4m0/vmogS5W6NImtdm0ZkgVO8gLQdV+0/+KgBEB3CTNPGw4G1LPRVJF+txskvNjZoFK2gpIoTqf9RZij5Bjuv2eFJmCQUUphXTWUgn4xHrp85cw4fLVzkqnQCxhbRtvjVxEfqhPuy8\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b72fe9623b3\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":470763,"size_decoded":90048,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65532), with no line terminators","md5":"2e885a50d7dc711be337a96fe33f0c2e","sha1":"8c767dd1bdcbf35f2577bd215ff6fe495cbd0f43","sha256":"603d14d58a247671742688b96c517d62e9c636443b960bc421af5352df4c01f7","sha512":"09289e06b0db84915693f0b78ab40149972b29693d0d6b1e66e4fbe9bddf00380f5f4e8e78961512d91a132226494572994ceade62d3d8a878126fdcdeb8fd95","ssdeep":"3072:/8nz2uaLZSZvx6Q/sIPrekK+mB6Ua94sRZI7gbpF/:/8nz2uasNxpXPrekK+mB6UHsE4pF/","tlshash":"c0a4fcb4c190f4edf704ce196e7c9e1c50321688e0a9e9e52da9fe0d9e85d6b241cdec","first_seen":"2026-06-12T19:29:57.244213Z","last_seen":"2026-07-17T12:51:04.92266Z","times_seen":630,"resource_available":true,"data":null}},"time_used":1699,"timings":{"blocked":596,"dns":0,"connect":0,"send":0,"wait":498,"receive":605,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/bj1.17ef2db8.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.272Z","timestamp":1783945693272,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/bj1.17ef2db8.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g25j.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:14 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-e5eb\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945694=E8FdoxMIiXaneiIJH8nRsEj9bqanUX/19vOzGBfRqOu7uMm0tthCqIaH5Z9EhkjGEJqO+UtOPdlD7oMK9qcmOqh42CeeqaqvIh3/4bt3zisg25NE+XlC0Mz1MIdp+DjwpVUU4FMunaWp2JkDKT2fS0ptq8rNVF5M2PBBB5EW11HVWyysDG98xECmcpSkiFbC\r\nAge: 105951\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 028019f5b730c1afe55\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58859,"size_decoded":59601,"mime_type":"image/png","magic":"PNG image data, 1920 x 1299, 1-bit colormap, non-interlaced","md5":"59f1176bd542d042d8ddecbe4ab2cbdf","sha1":"7251e6f8bc0bf8bf3e62e892b34540f8259dcf9d","sha256":"b3bc2f14721d5f84900af66179eb6ad69a9c8d5a89eae36f877cf09fc9872603","sha512":"c4e7f1491686b72482ba26e34fd94496fc71bec2a35ba1d7cf67391e1f47f859465ad9f0c7d286bd35f9a26132fd80012a2cd2f8133cf1c6013db4f4d27a85d7","ssdeep":"1536:jlJ0Z4kwI3cG0YXIPf/OWcFOtk2bnIlfyMcw68vTbD8:gxbsGvYXd8OtTbIsgTbD8","tlshash":"004302d3b5e9f610dd38c157a3d1c9da504483be3e938d0bebbe402629fd56840a6f16","first_seen":"2023-08-17T12:39:32Z","last_seen":"2026-07-17T12:51:04.956886Z","times_seen":2228,"resource_available":false,"data":null}},"time_used":1211,"timings":{"blocked":815,"dns":0,"connect":0,"send":0,"wait":319,"receive":77,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/fonts/DINPro.9ee75b04.ttf","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.318Z","timestamp":1783945693318,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /fonts/DINPro.9ee75b04.ttf HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g25j.top/css/46431.1781011881923.bc5df1d1.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:14 GMT\r\nContent-Type: application/octet-stream\r\nContent-Length: 119892\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:10 GMT\r\nETag: \"6a281706-1d454\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945694=E8FdoxMIiXaneiIJH8nRsEj9bqanUX/19vOzGBfRqOu7uMm0tthCqIaH5Z9EhkjGEJqO+UtOPdlD7oMK9qcmOqh42CeeqaqvIh3/4bt3zisg25NE+XlC0Mz1MIdp+DjwpVUU4FMunaWp2JkDKT2fS0ptq8rNVF5M2PBBB5EW11HVWyysDG98xECmcpSkiFbC\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b730c1a0022\r\nX-Cache-Status: BYPASS\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":119892,"size_decoded":120571,"mime_type":"application/octet-stream","magic":"TrueType Font data, 10 tables, 1st \"OS/2\", 30 names, Macintosh, 2005 Albert-Jan Pool published by FSI FontShop International GmbHDIN Pro RegularRegularAlbert-Ja","md5":"028cefac160ed3b006f47106fbc68d1c","sha1":"efcecac09684435facd7397e4f6163a5069802c2","sha256":"fb841a09a82787982ad1774bdeb45e8e06ff4909161a9ce33fd42f8822c5ddc3","sha512":"3a5a284d0c4da6593b857ba785a4ba7d5f2e2b73d22a2ef25435b9558063d2486228d76a3cd5d3a59b5abe4c0da696a75373111b3569a94a9dea1516cf16091f","ssdeep":"3072:YhtN/CZnt1tbtKtHtFNgz1QZt0tbt2ktwtNstAtqNaEctWpy8TLtsIb66AUeo:YhtNGnt1tbtKtHt7t0tbtxtwtNstAtqV","tlshash":"5ac308c153e8fa4ad83996388511c7434226ff2de65d4f36ffd94d8c688e8e9064e6e0","first_seen":"2023-05-08T18:58:40Z","last_seen":"2026-07-17T12:51:04.978113Z","times_seen":4973,"resource_available":false,"data":null}},"time_used":1241,"timings":{"blocked":768,"dns":0,"connect":0,"send":0,"wait":290,"receive":183,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/bucketimg/cc0812c4-2802-41c7-8bd9-a4c28c15eb86.gif","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.752Z","timestamp":1783945694752,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/bucketimg/cc0812c4-2802-41c7-8bd9-a4c28c15eb86.gif HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/gif\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nEtag: W/\"b7ad12fe390d68c88df2db78219cab9c\"\r\nLast-Modified: Wed, 28 Aug 2024 20:04:41 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9MQQGKnUJiqyBP%2Bis8oZoZBRc8Ul013elKzmZHMzFzXf97zdFhBWMiueP8UZZBVdMIfbPhZ6vN%2B4ku1Kmsa8lUvIE0xkKhcJVncvUDVK1FFjBv1VIjCDcMczcw4qDcIJCiZJgpJGFy1NyDYSWwuu3L0%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105948\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e2ebbfcf71059-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945696=r+0f956Z+TmDiOUQLZu0a/2eBiXaMlDGDrljKtw3frmnuePdFZCsh67A0toqxlD1o8H78rQNc6uRc/hS0HF+w6J9UlJi5zAC0wqT6u7hceKCl8QKLTzLJRKc8bZ/WHYQAiUrosF3UbS4xzW8QcR5dvmklpwBybIZeaeFU+NUOQdiyP8hIKI4wuI7oa1mhLch\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b7313b7002e\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":302697,"size_decoded":301141,"mime_type":"image/gif","magic":"GIF image data, version 89a, 200 x 200","md5":"b7ad12fe390d68c88df2db78219cab9c","sha1":"078960add6b85bc7199d3cc2de4714ff0e3a24ef","sha256":"a596d3cbec189f8c534cd58299ed7a13e56e515d14be3129984b219461d83612","sha512":"b15aee2efafb21410b7b89c4269f59cb86bafcff8b1f2238ed24c61b0f13959a15355005ff7eb645d8d182f02afe48c8867bf6e22d5d5a401a36dfbf86f7e162","ssdeep":"6144:fBOLj+QpSwjHvIJFo5AWMAUoGwhw2gWcXFyZNDyfIJmFvF:fQLj1pPjHv1nlwIhcXw/8IJ+","tlshash":"66542397426ccc571c4da579e80e3f1ea706556cfd119e3b50c5c4c23928a6dbcb0aeb","first_seen":"2025-07-30T05:00:30.953127Z","last_seen":"2026-07-17T12:51:05.01731Z","times_seen":473,"resource_available":false,"data":null}},"time_used":2197,"timings":{"blocked":1284,"dns":0,"connect":0,"send":0,"wait":305,"receive":608,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_bbac9ff6-d09b-48f7-9e60-77639d6ba1ec.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.985Z","timestamp":1783945694985,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_bbac9ff6-d09b-48f7-9e60-77639d6ba1ec.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/webp\r\nContent-Length: 10174\r\nConnection: keep-alive\r\nEtag: \"786d2731ac4145dbdb474c2ef236dbe0\"\r\nLast-Modified: Tue, 02 Dec 2025 14:07:48 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105939\r\nCf-Cache-Status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yPxLgKRzysEStbWCeJQc3KhpTz0d2q70cF1yf6cTh3Sh1wm9OWs7mTORawnUo%2BqLoD3RxAYGvbHqqFPOGokjG0W8DHs735ylqnDZ9XBZYGtbKdHYcHkKSOqFXX%2FBawyLOMmFAerwbg4hpolyJhO3rjE%3D\"}]}\r\nCF-RAY: a19e2eecca3fe2f2-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 028019f5b730f9bfe5a\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10174,"size_decoded":11325,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"786d2731ac4145dbdb474c2ef236dbe0","sha1":"e25bf96d16a7d8c9ba8cb8977c5223823b576354","sha256":"a5582288a05ad90cab5e153a954cc868cbf69672d5811c24564ed2292638b772","sha512":"aab8876381867a1eca57b4f3b8c18c5244840ce1283a71b3387e80ea096b2c956dd8cd3461861cf6be2d063f980a1c59495aa8d3c47f1579017239ac07ecd1c3","ssdeep":"192:Oz8jXYXj6SZFy5siAvpSdg/2OwNHKThGZ0G9g1/5gqWLbG0X6YqIsyT:nXbMFy5siMSdNQh3oSe6Ye","tlshash":"1c22afa5b4ff3f61484df1f1f78ad342559a697432be475d79b5467218082988c303f2","first_seen":"2026-04-24T23:10:16.833619Z","last_seen":"2026-07-17T12:47:21.76961Z","times_seen":655,"resource_available":false,"data":null}},"time_used":310,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_de72e240-4300-48d6-8f6e-b9cb363e7924.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.003Z","timestamp":1783945695003,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_de72e240-4300-48d6-8f6e-b9cb363e7924.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 81300\r\nConnection: keep-alive\r\nEtag: \"4a30c16256a637de0e38e326aa6cdf0c\"\r\nLast-Modified: Wed, 10 Dec 2025 11:51:47 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z%2F6PYkaV1NOrjEZvXb4WMunjqDZ%2BFRF4J41A795mb2jUGTQ4CsmDOhRjmDE0RjP5195rJauGqkOM%2Bv0k0cu9aeJCD99pcbWlVF4YZfCciPDSZwHXs3AAnufviyeZUTC1dOMLgWC64tJe4k8DErHFzqU%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105587\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e37a82a578623-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b7323a723c8\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":81300,"size_decoded":82453,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4a30c16256a637de0e38e326aa6cdf0c","sha1":"083a8e24d12a329c41bc5271ff2ee57570a6ff1d","sha256":"2e9e6d8b511c612cae6e20caa233846b723fe3f3c899d19eb8389073f0ca8047","sha512":"2cc3551a276966a3615edbf590ce22d06779e40c371e54737fdd0033faf900483fe32a33fcc86327fc2e3098e5ee02a88d6e7c60552a4ebdeac5ed66a47f007f","ssdeep":"1536:rHYJZl7vtdLMbrX1zS7hmZHerpnyjI79AYRU6kzu0MRsIelVbd:rkf1dLMvl6MZ+9nyjIinjuxcbd","tlshash":"7b83f1603172ed83bd9eb46081883156f984d84473298ff72a779fbd93128e9973970e","first_seen":"2026-04-24T23:10:16.828064Z","last_seen":"2026-07-17T12:47:21.771765Z","times_seen":679,"resource_available":false,"data":null}},"time_used":5428,"timings":{"blocked":5100,"dns":0,"connect":0,"send":0,"wait":307,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_2cf32c0e-cd2d-4274-8e00-d67d14e5086e.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.005Z","timestamp":1783945695005,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_2cf32c0e-cd2d-4274-8e00-d67d14e5086e.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 7390\r\nConnection: keep-alive\r\nEtag: \"f111a1ab6243183e54c8c152a111da67\"\r\nLast-Modified: Sun, 09 Nov 2025 14:10:40 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=04OK6gJDXgDopKtwscXdwKmOsh0xdBljS%2B2jqSMccv4wB8yaDZgsNXMpHcVlWpmKaBVIERwUwTWqUmC1MaIs7P%2FA0T9QN0P6I2MU1FMvwhwFJr4fRaeRlOjWzBKppHg01eiIt4GSaBzHZCcO2iRxXhY%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105656\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e35f70db620ef-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 028019f5b7323c2fe77\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7390,"size_decoded":8540,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f111a1ab6243183e54c8c152a111da67","sha1":"64384e28a720752201bdef5fb2d779e3b9c85f09","sha256":"5cc2cf8571b6a9483514b5a6a4624cf867c12addfcffa3ed0ca5b24a2354dda1","sha512":"38c484611e089f275c9cad39c3978fde5cc040959db3de91ae8744ce33f66b4ecf40b01f464e2081395aa408bbbc6a6c7bd845799ae892a8611b04c24c2198f6","ssdeep":"96:0UX6jHvysggvfrPtYvuy3/9Ic5G1SB2P80d2QWAqhs0ufLIbqvfgJ965FkBYUU:vmqsggvf5Uuy3lQ1Yues0uDlngJY","tlshash":"4ae1bf2cec9e39805c1c3cb8a451111c6f08688cadcc8cd55915be29f277beab5d6e41","first_seen":"2026-04-24T23:10:16.706864Z","last_seen":"2026-07-17T12:47:21.606811Z","times_seen":698,"resource_available":false,"data":null}},"time_used":5427,"timings":{"blocked":5127,"dns":0,"connect":0,"send":0,"wait":300,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/api/sport/match/list?sportId=1\u0026client=web","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:24.939Z","timestamp":1783945704939,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nx-request-source: https://g25j.top\r\nXign: wPE4ae61LruS+wXKfhROnVMzeScbZe0Y2M0pSHVH7sXKyYZlCSkDwG6CgCUCyYoABxEitr+azZCUjHC4dkjGYVvhdVEqP4aWnyS9usN1Wka9Yy7AlPiTryJmRV9F1XfQEogG2Z8h/SkmdQW2lpwPePZ3lQsIe077bnhz2eo79Ls=\r\ntimestamp: 1783945704934\r\nsign: 38525o5206b50n68\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: HQKEwmeYFSSEaBtwbDNtyDn6TxTXzDaR\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:25 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945705=HDMi7HnEKbsj9I+Gd+AGfvY16LwM7x7kxMT7FPctcJky95OtOmWfA8ZlzbjwJi36DK4hc6/JJKUdAD3k+b/H0D2zKpKucVfWJcy0bq4aLRgBEQCd9H1ybCJkyiko37059kaNWHnWELG4x5je6lAfFvXsZ9l3xLlhC8z7RwLqfr1GgnyjYVJYWsCaIffjNcZc\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b73367e23d0\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7898,"size_decoded":2360,"mime_type":"application/json","magic":"JSON text data","md5":"5152b3f9758d2c8f769c668a11c186b4","sha1":"c32ea27206d117c4399f28fcd1bfb7cd11a3e9b8","sha256":"55564c1affe6974f53ba7210b26f006daeef7e8c515323bede36523f147b8a0f","sha512":"6c2301884368986161156dd4b6be7c6d6dc6c55b22c280526930fb07d8238fe600cdfd00df3072332f31f66ed77d60af87f93ef037042a75e7b65fae1d830c37","ssdeep":"192:ev+jSuA6a6Rw2A1idA4w8KHWGiHeQuXKRfjTK4lx5L/dSi/5S1tDxRkTIrMLUaP8:ecAAwydi8DG7rXKJjm4NL/n/0tDx2kr1","tlshash":"a9f1435681dd58952b8c61d16c1e3f4988befa1b0adef5c5de0ecf0966b43f78204d22","first_seen":"2026-07-13T12:28:15.125434Z","last_seen":"2026-07-13T12:31:42.484415Z","times_seen":7,"resource_available":false,"data":null}},"time_used":333,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":333,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g12b.top/","fqdn":"g12b.top","domain":"g12b.top","tld":"top"},"ip":{"addr":"103.27.177.163","port":443,"asn":135357,"as":"HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-13T12:28:04.594Z","timestamp":1783945684594,"http_version":"HTTP/1.1","security_state":"secure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: g12b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:07 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: close\r\nCache-Control: max-age=259200\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g12b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g12b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g12b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g12b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/css/chunk-common.1781011881923.90261a1c.css","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:09.999Z","timestamp":1783945689999,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /css/chunk-common.1781011881923.90261a1c.css HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:10 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-34c8\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945690=CCac8hDsrbpYykEPFN5/XPYWTARB58kum4tSQMcDgGBqScVkYn3oe/4m0/vmogS5W6NImtdm0ZkgVO8gLQdV+0/+KgBEB3CTNPGw4G1LPRVJF+txskvNjZoFK2gpIoTqf9RZij5Bjuv2eFJmCQUUphXTWUgn4xHrp85cw4fLVzkqnQCxhbRtvjVxEfqhPuy8\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b72fe962472\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13512,"size_decoded":4720,"mime_type":"text/css","magic":"ASCII text, with very long lines (13512), with no line terminators","md5":"18db28ed82e6a8aa84b4ca311e8effc9","sha1":"19d1c3f13ce483b564653631f2bd6a340017a84b","sha256":"8d0fd3816e0960390ac6c9757e98a97c96597871468e74a8dcb81f170ad98303","sha512":"dbee6bb335fe964df137f44bbd9752844d5baeeec889ffb5c21c9979a8ce51018f81dadd4a66b2016a30874962c6e4fd2243325fa60958d45d06f34bdee72b87","ssdeep":"192:4dQK/X4cBY4mZGX1lsUTLA7gYER7/i//LN4hHSQZA2VxM2XwKjv0:M8oTGER7/i//LihHBrxP0","tlshash":"c952a631d634b53ce57be226f9d09adc6024d417e2730baeea643b3ac5ca4d215332c8","first_seen":"2026-06-12T19:29:57.231975Z","last_seen":"2026-07-17T12:51:05.08482Z","times_seen":630,"resource_available":false,"data":null}},"time_used":958,"timings":{"blocked":-1,"dns":0,"connect":298,"send":0,"wait":319,"receive":26,"ssl":314},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/css/46431.1781011881923.bc5df1d1.css","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:10.000Z","timestamp":1783945690000,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /css/46431.1781011881923.bc5df1d1.css HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:10 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-552d2\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945690=CCac8hDsrbpYykEPFN5/XPYWTARB58kum4tSQMcDgGBqScVkYn3oe/4m0/vmogS5W6NImtdm0ZkgVO8gLQdV+0/+KgBEB3CTNPGw4G1LPRVJF+txskvNjZoFK2gpIoTqf9RZij5Bjuv2eFJmCQUUphXTWUgn4xHrp85cw4fLVzkqnQCxhbRtvjVxEfqhPuy8\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b72fe67fcb7\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":348882,"size_decoded":87418,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"93f90e3733fc4af32a4ef4b34416c531","sha1":"bbe0b8f50268073f57565c76a1ac45b46f6c668e","sha256":"ce07d563179018eb4ccfcaf005a871d6baee3ad2ac4400e6e4768a2d35c5aa1e","sha512":"664e0ea56bcf02d80d7e148c8c999493c6501c5b8b6138fb0c5a05c0c0a9c3b5facac9d711aa2ce216eb335328be867456dbbbb2864f99531faffa5fb74eaade","ssdeep":"6144:z4+4r0H8Tu4+4r5cRlGuEQUQ929srbnpTP4T:z4+4ZTu4+4yaT","tlshash":"b774fa6caf1030ae15a7cb27b660f5199c36a443f9bfde9af3e53d580789a510623c13","first_seen":"2026-05-09T01:34:22.507922Z","last_seen":"2026-07-17T12:51:04.943847Z","times_seen":699,"resource_available":false,"data":null}},"time_used":1599,"timings":{"blocked":-1,"dns":0,"connect":285,"send":0,"wait":305,"receive":713,"ssl":296},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/index-399e2569.1781011881923.9d909473.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:10.016Z","timestamp":1783945690016,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/index-399e2569.1781011881923.9d909473.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:11 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-5cdf\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945691=GzNdgISsvsovXzYSHcN5Rhee8puQLKTEAva6npTyyVjGZIQFsC97lDzy7xZh8aHHWCZG5DNdAoU/YOhaMRs0XZXnWKT8yLMbiQlToexwVVB3nYw4P7RRfOdU2V1iUK9Ck3wY3AAUnsJ4SxQm58SYWz3DLpsNlJIdwsPZ5PGlvuprVHoBSSXB9TXDmJ2OBdYM\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b7302d823b4\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23775,"size_decoded":11338,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (23775), with no line terminators","md5":"a89a32dae8cc80557b581a69e02f0d02","sha1":"00f9cfeca127af0a139c0670ed8d2e2e7ccf673b","sha256":"6f97c8ce9605a8e9e80a699696c70ec26a4b9bce20badaa6947bf4e5ac52e9d2","sha512":"2ca5bc054575932085e6cd6529613a94f145aa9a3b7731fb85b97b27286a882043110ab45b7eb4673228185ce1560b47968d3aa7b77492f17abf82e778076a9b","ssdeep":"384:pZTANHmDGIaVPkrTBTcK8K+Ehn6A3zgJ9Ks/fT5qZsxbt85F3oWf0Af/nwtU8Zci:znDGIYPkPVf8K5hn33UnKofy5FYxAfPY","tlshash":"e2b2b6e63392bdb8c24f9676f23a58ecc43f9141c30fc4f8d265bd947d98644aa92784","first_seen":"2026-06-12T19:29:57.227313Z","last_seen":"2026-07-17T12:51:05.022198Z","times_seen":612,"resource_available":true,"data":null}},"time_used":2023,"timings":{"blocked":1699,"dns":0,"connect":0,"send":0,"wait":324,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/kc523-1/sponsor/sponsor_nav_web_3.png?1781011825626","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.270Z","timestamp":1783945693270,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_3.png?1781011825626 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:17 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68dbcacf-1cf4\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945697=Y8wY1Rz8+nsWEzaT171EoSVw1V6QOLKgyV5hl0Psguoywo5vWkE+mvrqS2I5wKeOG8V6UnPoL1rn2EYkSxB1+/Gdi7ZvAW8Snric2mM/0qCL09PEwVFefWSddT9xXemyzWqK+Kc64VDD6kKv2AK5o2rKkDOM+adI4rB4P5cj8BIT5z1Iypy2zynkEKBhyWkH\r\nAge: 105952\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027c19f5b7318772ae6\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7412,"size_decoded":8117,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"eb94a297c215863d5d2232eaa67f4779","sha1":"d006f382f63ada4e4ef65d124a75eac2e4e72dd0","sha256":"6bd46b617bf27cb28fb798d50b2d6daa2aaed1a278ed50e9aa549b6e4fac48c3","sha512":"dc7759393acb5e7d1a635b4d91d73e84abc41fe6afde99a85a8e4ed6f4f8b1b5819bbcaa80b1c213c00c89df8b81db512a7bff142b24c50565ff1e6289f1a30c","ssdeep":"192:Sfq39wgHGYB1fcUWobKUUR6IHaDmzDxfbTow:uQ9gCEUWoWUe6DeJQw","tlshash":"94e1ad76a7f6d695a6b7908cfece94050fbba2722c6352762b7b8c02170c339525b411","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-17T12:37:28.415663Z","times_seen":1957,"resource_available":false,"data":null}},"time_used":4292,"timings":{"blocked":3982,"dns":0,"connect":0,"send":0,"wait":310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/5941b74186e848e886fb128e342564b8?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.640Z","timestamp":1783945694640,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/5941b74186e848e886fb128e342564b8?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 24843\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 71877\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"5941b74186e848e886fb128e342564b8\"; filename*=utf-8''5941b74186e848e886fb128e342564b8\r\nContent-Md5: RWwXJ36yGxNwU0d8/J0Cgw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Foygtd4YT03PV05Up8AHj3Qm1BWf\"\r\nLast-Modified: Tue, 07 Jul 2026 19:45:45 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: eXRzSVDhF\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: XpEAAADqrKTJl8EY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":24843,"size_decoded":25599,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit colormap, non-interlaced","md5":"456c17277eb21b137053477cfc9d0283","sha1":"8ca0b5de184f4dcf574e54a7c0078f7426d4159f","sha256":"9c82644d55015ef77fba2a8cd824a2b0886b2bf4bd28cc4d132f3bdffd213847","sha512":"7c3e58f41e9ded5aef7bce4f50e2599c6285906eb764bd86c66584cadd78e512fcb1b718942fea9820e52dea520f7cbdb965610593a7ae8d7be87be45c6de379","ssdeep":"384:jfAZBx+O53rlnRRblmod2W6JMua/N9YWdeIxdpgE61NmGmPm4Txw4OF8o:jAzx+OttTsW6mwWdeIPpimGmVTximo","tlshash":"e1b2f195fe0640a97642c27c726fe62a03f81e6eb175a0d481c77d0c0b74e9359fb62a","first_seen":"2025-09-08T14:39:29.290957Z","last_seen":"2026-07-13T18:28:51.200573Z","times_seen":73,"resource_available":false,"data":null}},"time_used":1821,"timings":{"blocked":1467,"dns":0,"connect":0,"send":0,"wait":304,"receive":50,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_ce6f5a12-ce60-4931-b7a7-3cfa94c956bf.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.989Z","timestamp":1783945694989,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_ce6f5a12-ce60-4931-b7a7-3cfa94c956bf.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_f26e0b0b-19a9-470f-90cf-ab38984671ab.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.999Z","timestamp":1783945694999,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_f26e0b0b-19a9-470f-90cf-ab38984671ab.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:19 GMT\r\nContent-Type: image/webp\r\nContent-Length: 96286\r\nConnection: keep-alive\r\nEtag: \"a7ec31389e5a634d92383c733b498506\"\r\nLast-Modified: Wed, 10 Dec 2025 11:50:21 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=u4sRIBEl%2FmBY56vKOP3s9LuzrNyfYePswlqKhknlNTuuaK5gGCFOuIQvLBPwKqcRY3%2Fcsd0RYAr46wCu3G5z6DiNLa6PhsFOpSTDxIMuwatd8DWLxio8We9YRS2eYsakANMgasFsbugrNPpUpd2x85Q%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105654\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e35fa2e53a13e-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945699=4MEiqPSe8OxMuqjLKZveDUbGED9Mvo3jTwEG5nI2R2GsBmFsb2Ea2LZ4cSajf5ZjdWZipM4lTTtxcnnFp3YhHrpEd5JqGB5AdfD1pY7l6RLd2tdtdQuP5GUr/lvKBKr79H83O6+4JFoMai8hLvCcHUKJzoh7r7ak9alQAIfeYO95g9NMuvfD8OEH79RBP7Tt\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b7321ed248b\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96286,"size_decoded":97437,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a7ec31389e5a634d92383c733b498506","sha1":"4386adc654865c1594ba0ac604ac3a4177a84b7e","sha256":"978643b0ac1ecb3edf679a74610a1a0fdaebb02505e0dc607a15e56b1bd5212c","sha512":"222ad2805e8bd8957e696920a81cdb86bbf7a0bd6720b2cb67ae89758558331b6842fcdf208560ba355a522bcf0b177a7b124ff3d2c4db25c1fd8b4eebe5c74f","ssdeep":"1536:s9n08pg3G3xErU4qzJYMDLc0OzGR5AGsSrbY4V9SrXLDoJgG4oaUHG0S/F:knptxviMDCzGRyXSrs4VQDocoxHNS/F","tlshash":"079312e74a42ba67f808b1319ea01b6ef3d7b43f09ac1a6d47599a7c4831bc4458137f","first_seen":"2026-04-24T23:10:16.718761Z","last_seen":"2026-07-17T12:47:21.749152Z","times_seen":664,"resource_available":false,"data":null}},"time_used":5358,"timings":{"blocked":4658,"dns":0,"connect":0,"send":0,"wait":357,"receive":343,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/chunk-init-c0d76f48.1781011881923.0f397bb1.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:10.007Z","timestamp":1783945690007,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/chunk-init-c0d76f48.1781011881923.0f397bb1.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:11 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-275ca\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945691=GzNdgISsvsovXzYSHcN5Rhee8puQLKTEAva6npTyyVjGZIQFsC97lDzy7xZh8aHHWCZG5DNdAoU/YOhaMRs0XZXnWKT8yLMbiQlToexwVVB3nYw4P7RRfOdU2V1iUK9Ck3wY3AAUnsJ4SxQm58SYWz3DLpsNlJIdwsPZ5PGlvuprVHoBSSXB9TXDmJ2OBdYM\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b72ff8f0019\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":161226,"size_decoded":53264,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"815f2acbd0918250f25d4f71409219b0","sha1":"d5778078df7eada22b3175f9182b8b22e828c433","sha256":"12a61f287da39190db34dff1de7188c3d8b76ffbd1c11290962db88fd5e2ab46","sha512":"5ba4adaf4b36b4a402c30c3aaa5be5f02e292391d79400d353a5ca6c61405cb40e5179858abddb1af6dad243899e420111e49004d01d339ce9de23d8f522c379","ssdeep":"1536:zG5qxPvO2lSV822bv0bcbpM/igw/aIwC23QOoKILbjxo4wc0tvB6xVS/J+pKY3Ns:iQz/Dp5/92xoKa/x5wc0dB5/J+UU0","tlshash":"5ef31b987392b1b847dba6e152371075b57e1dd73088e8f0c169a6803f31a9cd52afec","first_seen":"2026-05-11T06:12:53.502908Z","last_seen":"2026-07-17T12:51:05.055539Z","times_seen":631,"resource_available":true,"data":null}},"time_used":1561,"timings":{"blocked":859,"dns":0,"connect":0,"send":0,"wait":355,"receive":347,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/29100d9d27a8448688db3e2f32ff131d?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.654Z","timestamp":1783945694654,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/29100d9d27a8448688db3e2f32ff131d?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:17 GMT\r\nContent-Type: image/png\r\nContent-Length: 11548\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 3179\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"29100d9d27a8448688db3e2f32ff131d\"; filename*=utf-8''29100d9d27a8448688db3e2f32ff131d\r\nContent-Md5: bqXysKaSfQPXsEeb87Sf8A==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FjwUrAA8fIwsob0OPxKLW0YkQu_j\"\r\nLast-Modified: Fri, 05 Jun 2026 11:28:32 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: DPowqSpO4\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: IdkAAADuP8pE1sEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11548,"size_decoded":12303,"mime_type":"image/png","magic":"PNG image data, 76 x 76, 8-bit/color RGBA, non-interlaced","md5":"6ea5f2b0a6927d03d7b0479bf3b49ff0","sha1":"3c14ac003c7c8c2ca1bd0e3f128b5b462442efe3","sha256":"3fde92cdf7e090efbf7f7560d6146e92e32ee4210b026c662c8ebb862cddfb52","sha512":"c3f42ed52f26d0f6dcacf90b8f08bb357e573124b55bae82b8c0c5185dcdc10a4362e074082c4df2b0f7ca0d939d12d57394bb53b45b11999801ab9238f05197","ssdeep":"192:DiOVcq2X7XGIfJA7h2I88c/itfUSdjcjQT7mF84/lnH2n8sysZzpYcxVe:e8Qz1BAQI883tfUSdjcjK7mLS8f8zpZ2","tlshash":"ad32c09656e85b6198227675db61214c1039f3e3b44ac66c016fa22ac384f9318fd1fa","first_seen":"2025-08-17T08:15:23.979846Z","last_seen":"2026-07-14T12:59:09.308432Z","times_seen":57,"resource_available":false,"data":null}},"time_used":2662,"timings":{"blocked":2401,"dns":0,"connect":0,"send":0,"wait":261,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/35142.1781011881923.1d227afa.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.063Z","timestamp":1783945693063,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/35142.1781011881923.1d227afa.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:13 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-530c3\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945693=73ZApDHt8ncnojFO9uRQaPhNZJ5tRe18RjCXPKXkWXxespjhHpCwLtBaszC+J/q8xLlbRcE3PMKSZdsJF5yW7kWOWJBcdABsf5O3MBD+NHHscog80WgEiTB/vuYo3smoMZYOSQoRe0+HHAG7/mIUHYrVbUjzGWa32+eteBkKxvdZO1+4NR+r30WPC+J5bmLn\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b73087efcbb\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":340163,"size_decoded":94183,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64894), with no line terminators","md5":"8325235b613820a57b71043f360e5b36","sha1":"925ff977edf9892e868d43915f93d29e6feeb113","sha256":"0c505f39a463b09ece16c213b7ead75186dcdc26d25ee02dcba5a62cc0dff7c6","sha512":"efd16c9b7ff0f806890ae77542e8c0d4e954f8c797ff21b8dcde3f240e4940ca3c6d0fe75ee2fda35bf53ff5d0eb691fa7e38cfdfa82c0f231b0cd57458fbcf2","ssdeep":"6144:N0hEyLkbJDb7w/1FOAmBm7cene7Ancbt8sbyAkKJwoSlt5MMjmlHGwwzHUY9SroE:N0hEyLkFDb7w/1FOAmBm7cenaAncbt84","tlshash":"8a742b94b290b17883af86fb731a91a1d24d0e9460ccace4f27e6e407f15746b8775ec","first_seen":"2026-06-12T19:29:57.248751Z","last_seen":"2026-07-17T12:51:04.981104Z","times_seen":580,"resource_available":true,"data":null}},"time_used":726,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":491,"receive":235,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/bj3.a7dbd558.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.280Z","timestamp":1783945693280,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/bj3.a7dbd558.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g25j.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-16cb\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945696=r+0f956Z+TmDiOUQLZu0a/2eBiXaMlDGDrljKtw3frmnuePdFZCsh67A0toqxlD1o8H78rQNc6uRc/hS0HF+w6J9UlJi5zAC0wqT6u7hceKCl8QKLTzLJRKc8bZ/WHYQAiUrosF3UbS4xzW8QcR5dvmklpwBybIZeaeFU+NUOQdiyP8hIKI4wuI7oa1mhLch\r\nAge: 105948\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b731428002f\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5835,"size_decoded":6417,"mime_type":"image/png","magic":"PNG image data, 1003 x 171, 8-bit/color RGBA, non-interlaced","md5":"b79234bcd23ce7e063481b3605bcdd45","sha1":"eace4c48cc352cfb10fb6fcffed50748f18aa78d","sha256":"2dbca2ee9a515b178cb6a5ce670a5dafa30941ad8c753fa3e94642f8dacca13d","sha512":"40fa685181391f1ca805440f53683045d1fbd5c0f36cf471f53641c6f289481f42fefc4d1f2b2fdfe8a20d7488ef0537f10352492e46af76770b49fe8876def7","ssdeep":"96:brOIaX7VK+RUSrZ3rnZ1L++y+hsVoK4CBVVikox3n0muoE7Nqh7zwGto:K7VK+RBZ3l1i+y+3peikr3oEJqh7MCo","tlshash":"91c18f03f313ed339b875f190abe4dc3498b2f9a4725a7d6285b5aa89654819c062e82","first_seen":"2025-08-29T11:05:53.328141Z","last_seen":"2026-07-17T12:51:05.044548Z","times_seen":2174,"resource_available":false,"data":null}},"time_used":3156,"timings":{"blocked":2791,"dns":0,"connect":0,"send":0,"wait":365,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/help.4e3cf897.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.283Z","timestamp":1783945693283,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/help.4e3cf897.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g25j.top/css/index-399e2569.1781011881923.a7b0b4f4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-2852\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945696=r+0f956Z+TmDiOUQLZu0a/2eBiXaMlDGDrljKtw3frmnuePdFZCsh67A0toqxlD1o8H78rQNc6uRc/hS0HF+w6J9UlJi5zAC0wqT6u7hceKCl8QKLTzLJRKc8bZ/WHYQAiUrosF3UbS4xzW8QcR5dvmklpwBybIZeaeFU+NUOQdiyP8hIKI4wuI7oa1mhLch\r\nAge: 105952\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027c19f5b73147f2ade\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10322,"size_decoded":11054,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"6dd52a6a4d07f2786b1926fac1b4b06a","sha1":"9c9908204401fbe65d33cf7df8881639d6aea37d","sha256":"e02471f47b506ab510d0e0dc4224cffc03c34f950b649ce347ccd71af0bcf0ab","sha512":"fdd52f532e5c2e2c182db20e2053eee0ca8c26cec51ff75e1bc341b01911461ac72fa75887fa3114188ba32aa6341c0974d81d071fc42b605e72f73dfb87ab9c","ssdeep":"192:x0C+pMwjX2XZ456BAJu+1KzdjCfDrRq6wUPlJyh2h4PAmWP5yQSkHxfYX32H5TRm:EjGXZau+1MjCrrRLlqGOnWcQSkRQX3IG","tlshash":"3822c054370836084f737a4362ac4e837a06040ffdf9b7919a6372659a5b94e44cfb66","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-07-17T12:51:05.048765Z","times_seen":2174,"resource_available":false,"data":null}},"time_used":3265,"timings":{"blocked":2934,"dns":0,"connect":0,"send":0,"wait":331,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/appdown.6e7c9177.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.285Z","timestamp":1783945693285,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/appdown.6e7c9177.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g25j.top/css/index-399e2569.1781011881923.a7b0b4f4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-277f\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nAge: 105951\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b731070247e\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10111,"size_decoded":10843,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"716d097b193628397635cfac41b561fa","sha1":"545d1876219bed15fe850a499a08322de6a26866","sha256":"50276d87fae9c1e30a32c32b4e90dcc2e227cabb4e3bb1d60ecb22fb50c5f2ff","sha512":"47ea5928e921bec4ce4d9c807ee921f6115a6dd27af6fa7325e6d988058d22cf36c03693ebc56665203809cfd6d008cd410380e688e90b36d7eeec18ce6aa92f","ssdeep":"192:cALsiDRih/bWKl4Hq2BHZE6+3paMeCsuTvB6hi6tswYmd:lBEv2Hq2BHS1ZaMJtB+tsud","tlshash":"4622d047a584327b826ec79c8fe98c112470ad1ce6f04d5ac44e711128e8df3503baf2","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-07-17T12:51:05.060568Z","times_seen":2149,"resource_available":false,"data":null}},"time_used":2209,"timings":{"blocked":1907,"dns":0,"connect":0,"send":0,"wait":302,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/8016df390f8e40c9acbc04080c286e25?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.621Z","timestamp":1783945694621,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/8016df390f8e40c9acbc04080c286e25?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 42140\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 91691\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"8016df390f8e40c9acbc04080c286e25\"; filename*=utf-8''8016df390f8e40c9acbc04080c286e25\r\nContent-Md5: V9rulUO8vUL/FEPmGQC1pQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fk05vo4OdBzVzXhTMuWvN5lnQcKB\"\r\nLast-Modified: Fri, 05 Jun 2026 11:28:46 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: OGyuQW5IX\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: AuQAAADtiiXEhcEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":42140,"size_decoded":42896,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"57daee9543bcbd42ff1443e61900b5a5","sha1":"4d39be8e0e741cd5cd785332e5af37996741c281","sha256":"7ccd31cf1e23302c53c5fe308a47e1e225dd85002a8db95e008f3df333d62997","sha512":"735ef458b36619986daf89066b5e792c1f25c1c3ebc256da8fa3f766b39a27005569c114441458c621e9b901aee231b737ea0b89ce19c2e5de9f905cb61e4320","ssdeep":"768:Jc6vZDtG4yeJkI4eYQ1TjbNOLifJm1x6T+8nvgLHmDAdRzIYoIzFolMUF:9RDg4yeT4eYaTlOMJo6T3vgHmDAYB+Sh","tlshash":"d013f2c93ced3e27250b9b72e18232ee4b681420e8355a470c7fda02354d7fd116b78a","first_seen":"2023-10-28T07:36:04Z","last_seen":"2026-07-17T12:51:05.105042Z","times_seen":124,"resource_available":false,"data":null}},"time_used":1165,"timings":{"blocked":-1,"dns":30,"connect":243,"send":0,"wait":486,"receive":156,"ssl":250},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/fcf3705e101b4fbfa5b93a47517b97b4?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.643Z","timestamp":1783945694643,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/fcf3705e101b4fbfa5b93a47517b97b4?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 14672\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 70069\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"fcf3705e101b4fbfa5b93a47517b97b4\"; filename*=utf-8''fcf3705e101b4fbfa5b93a47517b97b4\r\nContent-Md5: duGhXT1I8aVQB5A00WPBHw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FriMs8u13Dv8ZOCk8AaEZDvOx65G\"\r\nLast-Modified: Fri, 05 Jun 2026 11:28:57 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: sFrWrKzAP\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 3s0AAADew51umcEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14672,"size_decoded":15428,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"76e1a15d3d48f1a550079034d163c11f","sha1":"b88cb3cbb5dc3bfc64e0a4f00684643bcec7ae46","sha256":"c9f60df4fd02ec5ce74982045977b1adc48fd05b9eac6d18b5a397c19245561d","sha512":"81106f26ed40c6385a3344b46ff3fe82c2674b7228cd9e41353cd8bad0a213b3e40d1a6c842e24080831d7a57c5a9f51b802435f55baaf4d60b0203baa4f1c82","ssdeep":"384:UUjCG33QbeqpQrvCGWkUijH4w+4mRYuLaVWvuwnDgqCqhmE:RjCryqwvPUE1+LRYuLaV3wnUZE","tlshash":"f562d0da8bb03358cc6264488dd0db3a7dab3ffa1d1cc15018961d3e0e9424b4bd4aad","first_seen":"2025-09-22T05:32:42.498183Z","last_seen":"2026-07-13T18:49:11.165466Z","times_seen":61,"resource_available":false,"data":null}},"time_used":2124,"timings":{"blocked":1820,"dns":0,"connect":0,"send":0,"wait":304,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_0b2c7f25-c17b-4d07-adb1-68f1823633a2.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.008Z","timestamp":1783945695008,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_0b2c7f25-c17b-4d07-adb1-68f1823633a2.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 10536\r\nConnection: keep-alive\r\nEtag: \"83c227836fb01b2cef7c240c8d45f098\"\r\nLast-Modified: Tue, 02 Dec 2025 14:12:09 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105656\r\nCf-Cache-Status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dLNpOW%2FLopjWYZ%2F46riQpBE8duocjhazG6iK1pSlhaNsfO7N78VHSoloKo61OdAFql%2FUSqs%2Bfi9X4kNvp%2FbgYkzkb31e53Ca5i4KdCMil7XrDJln0%2Buv852T%2FwiX8ei%2FbACkmst5IkBpUgbD1t%2BG%2BP8%3D\"}]}\r\nCF-RAY: a19e35f7097e9cf5-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 028019f5b732511fe7a\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10536,"size_decoded":11703,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"83c227836fb01b2cef7c240c8d45f098","sha1":"fb1e1f8ef0fa166415a743fe004d926e7b040aba","sha256":"54544e3d3311ced9fef367585eb60a15e3bf7d8490ccb2098d7e76d59fbc1fea","sha512":"d41d274ecb2373e9f9eaafe28710226a6bdf54d4c0c8a24c9b04fdd18a6d7fb71611dc0111f54fdd6750929bf002dfbe4a2822fd77f455f850d3406671b6d499","ssdeep":"192:6Xrxa2Dv2+2JgMsTWhgDPkmw0OwIK1AmEIDvWrxaiXFr0NN2uCd16Abhu:aa2Dv2vJmTcgD8mw0ODBmilaiR0P2xJ4","tlshash":"d922b0aad71a5b23ca0056163f7f3476c1567c371b2eeca529eebd0112309e469f9313","first_seen":"2026-04-24T23:10:16.72265Z","last_seen":"2026-07-17T12:50:20.973021Z","times_seen":718,"resource_available":false,"data":null}},"time_used":5764,"timings":{"blocked":5427,"dns":0,"connect":0,"send":0,"wait":337,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/partner.dca3fc6e.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.288Z","timestamp":1783945693288,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/partner.dca3fc6e.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-7129\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nAge: 105652\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b7310ff0029\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28969,"size_decoded":29329,"mime_type":"image/png","magic":"PNG image data, 480 x 151, 8-bit/color RGBA, non-interlaced","md5":"7374b72d05130af2d77119eb0eb4ba10","sha1":"5b3e5e621329685de250121b2fd9c798f46f7d65","sha256":"059a622a7f1f0f1f239d624f19b0f5531c0f0aedadb8ccd40d2570a76dd56752","sha512":"c2d0f744838a882c8ac15de6bb0bfbeb3dd2f31550cc7a259b9890ea38eddf835902171c1346ed7e1d2005ba18b929d598002d60b7355df72073d955521b18b0","ssdeep":"768:tAAoY1X4ITISUWhiqmMiuCaUENwHoacq8zqWx6:abaX4SIYIdMMow8zqi6","tlshash":"a2d2e0ecdc3058f1f533894dc979813a6f3886ba05e359817a36f92bddc3e8506491e6","first_seen":"2025-08-29T11:05:53.287538Z","last_seen":"2026-07-17T12:51:05.057184Z","times_seen":2062,"resource_available":false,"data":null}},"time_used":2372,"timings":{"blocked":2050,"dns":0,"connect":0,"send":0,"wait":304,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.150Z","timestamp":1783945694150,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://g25j.top\r\nXign: YWbvXzBA++otJ94unf6TMC/ixj7FLExMPJIWZTxtxsCYGEMJzSZGtD2JgOIG3fijMQqV0Q3ZrWSrT8A96YhQ/F8GP/apfdhJDoxdHCzJLU4M92kCShiamQfZOI5Ly9yn2mJPWkmYF0DA8QXvkiBcuZ6qcN8wWyGRtoHxEJiqJYg=\r\ntimestamp: 1783945694143\r\nsign: 5a2h1u3k6c1j5g6i\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: HQKEwmeYFSSEaBtwbDNtyDn6TxTXzDaR\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:14 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Mon, 13 Jul 2026 12:38:14 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: 77a4825fe012453dadc654148b2eb343\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945694=E8FdoxMIiXaneiIJH8nRsEj9bqanUX/19vOzGBfRqOu7uMm0tthCqIaH5Z9EhkjGEJqO+UtOPdlD7oMK9qcmOqh42CeeqaqvIh3/4bt3zisg25NE+XlC0Mz1MIdp+DjwpVUU4FMunaWp2JkDKT2fS0ptq8rNVF5M2PBBB5EW11HVWyysDG98xECmcpSkiFbC\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b730da7fcbd\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6691,"size_decoded":7724,"mime_type":"application/json","magic":"data","md5":"833db5dc9f0f2520648866bc3323dacc","sha1":"c8bc4a2153ea167e0b32c2965c59bebcd2e2aca9","sha256":"b7d9df345ab018a9b39583c5687b176bacc4749af66571247cf2d049de4b805b","sha512":"3f0dfbe5a0afbb349d9121a148a4d634f9e845e9ed4a8c90cb41f0ca00790b0ccb0ce194744c97f989a76269177792efa9fb60f9ae2017af6d152ea91f63fe7d","ssdeep":"192:VNXaHYhsBPWN/D3xL4jiSSGv3/Y5roc/rLI4irw9bdWagTgAGa+:HqHYOPk/D3rSSGv3/Y5rTjw4dWa6Ma+","tlshash":"3822bf970b52e7a036ddd5fca1221cc12aafa2cc40bc9bd5d37480a42eae750b5cc4b5","first_seen":"2026-07-10T23:44:19.35116Z","last_seen":"2026-07-13T18:49:11.193215Z","times_seen":9,"resource_available":false,"data":null}},"time_used":636,"timings":{"blocked":335,"dns":0,"connect":0,"send":0,"wait":297,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/dea0c810686d4551a8e5a41982c742ce?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.623Z","timestamp":1783945694623,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/dea0c810686d4551a8e5a41982c742ce?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 39299\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 91690\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"dea0c810686d4551a8e5a41982c742ce\"; filename*=utf-8''dea0c810686d4551a8e5a41982c742ce\r\nContent-Md5: jadFkcUvM/VSWXFmrTijxQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FowlOi5THZQsX--4XhP4B4I_i2Zj\"\r\nLast-Modified: Fri, 05 Jun 2026 11:28:46 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 7Am4blsc1\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: G6MAAABwcT3EhcEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":39299,"size_decoded":40055,"mime_type":"image/png","magic":"PNG image data, 139 x 181, 8-bit/color RGBA, non-interlaced","md5":"8da74591c52f33f552597166ad38a3c5","sha1":"8c253a2e531d942c5fefb85e13f807823f8b6663","sha256":"82692d339327fc56c671ebd9a2b77dc9a9b69935d784cb1fc12e1dcbb1654a9a","sha512":"e1808283966d6994fcbd1fbfa24575d8092588d78ea1aef1f2b8ecebf0ed4aec226e48f51233c74614651bb4b38a19adb9f3ede70dc2a57510a947a9c62d9646","ssdeep":"768:19F7ez6JaN0jmusYy8ajO+Br+2onGh/iRw+PS+p+8NTJfqpLj5wB4B:vozNN0jC7T9oGh/cfMqJmLuaB","tlshash":"a10302b9c5f5f095c451308fa234590ddc272e9e9c7fb9d5ec628f88aee081c1639ad4","first_seen":"2025-09-21T04:12:34.083895Z","last_seen":"2026-07-17T12:51:05.10676Z","times_seen":216,"resource_available":false,"data":null}},"time_used":1165,"timings":{"blocked":-1,"dns":28,"connect":247,"send":0,"wait":494,"receive":142,"ssl":253},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/ecf355a70f7f45e280033fd4fb0f469f?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.637Z","timestamp":1783945694637,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/ecf355a70f7f45e280033fd4fb0f469f?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 18430\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 80879\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"ecf355a70f7f45e280033fd4fb0f469f\"; filename*=utf-8''ecf355a70f7f45e280033fd4fb0f469f\r\nContent-Md5: LVheRy1r0G0vM3tg8Lo5RQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fgv9oNDDewtkVsEMqE9dPriEMLfH\"\r\nLast-Modified: Mon, 06 Jul 2026 19:44:20 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: maySAPwc4\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: Oi4AAAAkzGqZj8EY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18430,"size_decoded":19186,"mime_type":"image/png","magic":"PNG image data, 130 x 124, 8-bit/color RGBA, non-interlaced","md5":"2d585e472d6bd06d2f337b60f0ba3945","sha1":"0bfda0d0c37b0b6456c10ca84f5d3eb88430b7c7","sha256":"60628792c35f8aee76c6d9328c1c61a8db7d86656dedb19d46f066c1cb8f4cc4","sha512":"5ff4d35a6134e30ec5b82907e66ed1caee693e74f5e4f752eed28b1fa7d36d57e9bce1a07f6420846a53630c60566e988dfc48e96d7d1cda6d0dc64db4c6f448","ssdeep":"384:WElShFDlRi8vVosrbmpIGk8gsZAGinBbJsQE8UBSQyTecAZ15zytu:WyYMuzrCpGaMiQEXBryaHetu","tlshash":"c682e1e58a549017bd56f47db27151eb28b44324cc01a4fefe5c4eb216b933e1c891be","first_seen":"2025-09-24T16:55:44.271752Z","last_seen":"2026-07-13T12:46:22.314879Z","times_seen":45,"resource_available":false,"data":null}},"time_used":1467,"timings":{"blocked":1134,"dns":0,"connect":0,"send":0,"wait":316,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/EGAME.d289cd48.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.902Z","timestamp":1783945694902,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/EGAME.d289cd48.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-e89a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nAge: 105584\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027c19f5b7312b32adc\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59546,"size_decoded":60288,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"eb8991eb9e0db175522c914343f0a10a","sha1":"ce2d41b154df64421d46bceaeb9878da455592dd","sha256":"b837b4e9fc693e5c65eb049c56547caefe1cf73ea31ae59f95ae46d052fd36b2","sha512":"7d2a886e3ac412f6ea1b1ba290064373e1d07a0751bdd7f546af3116ad057d1f17bbe4847179cdf87297a967c0290280ec0c51ab9bfdeb1da0b881e366eb19a8","ssdeep":"1536:hvA9R/SReJczzaRBd6s3DhCDnQcvyFVWGDnmhKYNa67:hIPVczevUIhCDnQc21C7Na67","tlshash":"dd430276882a8fcd499304944bf9afe164eaf19097b3cf91f24c5fe0423d184d881b6b","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-17T12:51:05.001257Z","times_seen":2010,"resource_available":false,"data":null}},"time_used":1320,"timings":{"blocked":874,"dns":0,"connect":0,"send":0,"wait":336,"receive":110,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_465faf5d-2f6d-44ba-896b-8d6bffead8bd.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.985Z","timestamp":1783945694985,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_465faf5d-2f6d-44ba-896b-8d6bffead8bd.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_91f2d885-8341-4928-bace-352c8c691bef.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.988Z","timestamp":1783945694988,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_91f2d885-8341-4928-bace-352c8c691bef.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_1d28b817-0c00-4339-b666-213943a7b1d3.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.998Z","timestamp":1783945694998,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_1d28b817-0c00-4339-b666-213943a7b1d3.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:19 GMT\r\nContent-Type: image/webp\r\nContent-Length: 91938\r\nConnection: keep-alive\r\nEtag: \"d4f654e067ee701e55c386cad6b53574\"\r\nLast-Modified: Wed, 10 Dec 2025 11:50:44 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105655\r\nCf-Cache-Status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VKBrxQPUUA6feulG2FuhBArMBJjKoyDM%2BLM9bSU3wFoHOzEHId7mjCawNBR6ZOcqaVgghv56tK9diIEhXJNx%2BBXio7q3rFWeez0smTz6gx3LE1XYcUbHhUKsZlBgG2cKafNb2lo5kBKw1TfZv%2F1Awis%3D\"}]}\r\nCF-RAY: a19e35f8c8c08527-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945699=4MEiqPSe8OxMuqjLKZveDUbGED9Mvo3jTwEG5nI2R2GsBmFsb2Ea2LZ4cSajf5ZjdWZipM4lTTtxcnnFp3YhHrpEd5JqGB5AdfD1pY7l6RLd2tdtdQuP5GUr/lvKBKr79H83O6+4JFoMai8hLvCcHUKJzoh7r7ak9alQAIfeYO95g9NMuvfD8OEH79RBP7Tt\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 028019f5b732141fe74\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91938,"size_decoded":93091,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d4f654e067ee701e55c386cad6b53574","sha1":"a0f6315ed37b1a5d5da601adfbcb44cad2d9f5cb","sha256":"cd9f33e85a633a73214e9e94255ec27a3d272cadf2389345b6d240d4e36c53ab","sha512":"701a8be639fbb3dbc5670d9789cf01c3175d632a7902e3cfbb769e80fff9f420c10befecfa030adcced409dd26c2ae2afa1fcf617c7371bc6984b378685d184a","ssdeep":"1536:XsUxLKKnLpw8UtfepacmJUm70Cweits6VTpJz39R9s8dBmdEbi/pS4l8KjVIVAMo:PBLpw8UtfqyJUeueitTVbFs8dpbQSvK5","tlshash":"df930205f84d4f1dd86a31e6e142309c9472e0a83213cefb25b3f53997935d52ea6f48","first_seen":"2026-04-24T23:10:16.740253Z","last_seen":"2026-07-17T12:47:21.925022Z","times_seen":661,"resource_available":false,"data":null}},"time_used":5127,"timings":{"blocked":4486,"dns":0,"connect":0,"send":0,"wait":309,"receive":332,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/ecb/8f8306425fb46e096ba9db3ab31b67b681fbb31575ff397b0117","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.115Z","timestamp":1783945694115,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /ecb/8f8306425fb46e096ba9db3ab31b67b681fbb31575ff397b0117 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://g25j.top\r\nXign: t5QqQF+L0VkJptpjd149DSSl4aVhhpBebRwcsmghh++PVFO/GqzmkZies+BZAUEPqdP1pEkU2YADjrL4LBsTgKjm0XLfWYS//nMgYUDkYpc7s87gTvAGvBxZi6XLtofX6vKKtRRnrsPwPuv7rT7XgxmeeIhqZHP3b2xs0l1xuiQ=\r\ntimestamp: 1783945694105\r\nsign: 66r1a721e222bm79\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: HQKEwmeYFSSEaBtwbDNtyDn6TxTXzDaR\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:14 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Mon, 13 Jul 2026 12:38:14 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: d591191caaa943c99635d2ce4bbb4118\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945694=E8FdoxMIiXaneiIJH8nRsEj9bqanUX/19vOzGBfRqOu7uMm0tthCqIaH5Z9EhkjGEJqO+UtOPdlD7oMK9qcmOqh42CeeqaqvIh3/4bt3zisg25NE+XlC0Mz1MIdp+DjwpVUU4FMunaWp2JkDKT2fS0ptq8rNVF5M2PBBB5EW11HVWyysDG98xECmcpSkiFbC\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b730c37247b\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2132,"size_decoded":3165,"mime_type":"application/json","magic":"data","md5":"de8031db8a3dcca07c68fb55628b38d7","sha1":"4f2c385d807386db914398f5321e80a500a716ac","sha256":"669f8d982f40029794c05c04de0a4af4ec54140b3ac219106b6ee5a99f0015c7","sha512":"7bfae2ca008441b57d7cb90c6e5bb43498802184e126443643e9e1d75929458c83a9005c80fcd6996cad8af6635195d298c63dbbf7fa5be60c4d0b9e1ffdc4f8","ssdeep":"","tlshash":"b7616d172a9de309da2a8db1c4738ce95d5cc32d779df8e3c5908f2082ea303306d140","first_seen":"2026-07-10T23:44:19.380788Z","last_seen":"2026-07-13T18:49:11.150623Z","times_seen":9,"resource_available":false,"data":null}},"time_used":320,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":320,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/76cb69896e8a486fa68f4d5239c8059f?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.650Z","timestamp":1783945694650,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/76cb69896e8a486fa68f4d5239c8059f?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 6906\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 44887\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"76cb69896e8a486fa68f4d5239c8059f\"; filename*=utf-8''76cb69896e8a486fa68f4d5239c8059f\r\nContent-Md5: D6o+DeJHkVPjDZew9Zy2tA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fr76iPKIofv7a4gj522BlckhjAK7\"\r\nLast-Modified: Tue, 19 May 2026 13:58:06 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: Mp5ewNT87\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: l8YAAADt7L9VsMEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6906,"size_decoded":7662,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0faa3e0de2479153e30d97b0f59cb6b4","sha1":"befa88f288a1fbfb6b8823e76d8195c9218c02bb","sha256":"ad65840c51b1b3a616238e4682c0798ad5174db5ba5329503ad3c3016f7db7cb","sha512":"5519eba0d3e6b01084ab17cd2add48ed4dea86e8b8c3b3b37fa87f6eb50fe2f583d662ca67e3f3d91b4ad20af56a21313248fda06d1630f92b1e1375de4add9f","ssdeep":"192:8e4gpFvER6fNcr9DP6Ci76nif/Gt7G2x6so87U:83gphcFr5ieiae","tlshash":"72e19e60181a2470ac477669fe6e0e663f0bc4d4997d28a273de0a84056efd6067e2de","first_seen":"2025-03-16T19:56:39.386012Z","last_seen":"2026-07-14T00:00:26.360002Z","times_seen":52,"resource_available":false,"data":null}},"time_used":2427,"timings":{"blocked":2181,"dns":0,"connect":0,"send":0,"wait":246,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/b21abd56c0254fc994acdd1c3e0ef582?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.651Z","timestamp":1783945694651,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/b21abd56c0254fc994acdd1c3e0ef582?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:17 GMT\r\nContent-Type: image/png\r\nContent-Length: 29337\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 3179\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"b21abd56c0254fc994acdd1c3e0ef582\"; filename*=utf-8''b21abd56c0254fc994acdd1c3e0ef582\r\nContent-Md5: D/wANCoG1wKzFAdOFuCK3g==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FslXbnML7fwNq5Gy3AuHxrRJjUUl\"\r\nLast-Modified: Fri, 05 Jun 2026 11:28:29 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: GIROr67p6\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: p7sAAACJW9JE1sEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29337,"size_decoded":30092,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"0ffc00342a06d702b314074e16e08ade","sha1":"c9576e730bedfc0dab91b2dc0b87c6b4498d4525","sha256":"1483118410516ced1d15d789cb8073fa0c6e581f539178b6fa164a777bda97ae","sha512":"159545b72a943feefe51080e029a9032e01c553efefda3d45b26c4aa638bc433504b671b846810ac0dc236a0b166a12b5ac251f35ce282b1504c178a9e515371","ssdeep":"768:9Wfbd3pSz+TVTSTAEXrjwKRl0nmneDwEYjuE:9WTzVTSTAEqnme6uE","tlshash":"ead2e017f3482668e4b8857f04cef284e1eb05515410ac477da4ef4f89fa92e9875b3e","first_seen":"2023-06-08T21:23:36Z","last_seen":"2026-07-17T12:51:04.962098Z","times_seen":169,"resource_available":false,"data":null}},"time_used":2554,"timings":{"blocked":2289,"dns":0,"connect":0,"send":0,"wait":255,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_392325e1-efd7-4953-83f1-410dea55a03c.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.981Z","timestamp":1783945694981,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_392325e1-efd7-4953-83f1-410dea55a03c.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/undefined","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.260Z","timestamp":1783945693260,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /undefined HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:13 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: public, s-maxage=600, max-age=0\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945693=73ZApDHt8ncnojFO9uRQaPhNZJ5tRe18RjCXPKXkWXxespjhHpCwLtBaszC+J/q8xLlbRcE3PMKSZdsJF5yW7kWOWJBcdABsf5O3MBD+NHHscog80WgEiTB/vuYo3smoMZYOSQoRe0+HHAG7/mIUHYrVbUjzGWa32+eteBkKxvdZO1+4NR+r30WPC+J5bmLn\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b730914001f\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24594,"size_decoded":11457,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5777)","md5":"e79ba8d5268f3090203c26b2ec87119f","sha1":"67ec737a939ce7eb32f6c9ab0f6cb36a5d0c5045","sha256":"f03b70608a46781f56d44226537411cfd4da69014f8c6540319977c45398149b","sha512":"378079455a3539b8fa003afc4351f6acd844d704e0f41250b71dda29b445cb99821596e562eed3afea6a7d0b6de1ff61e22754a4c3d9384952d09b90f4dc3e55","ssdeep":"384:21ERlxqNBPJu2VwiYwJvSoVXsp+pa/iZcVk97g6nMusplIiz:1RXqrJuiNYiKop/E6wkpcu2llz","tlshash":"05b2195a9df3497a2423303a1f7fb20869b0d0134309ed803e4de7594f95aaa56f3bd6","first_seen":"2026-06-12T19:29:57.247756Z","last_seen":"2026-07-17T12:51:04.941743Z","times_seen":643,"resource_available":true,"data":null}},"time_used":494,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":420,"receive":74,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/961e7c253ea8409195080d4733f34815?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.647Z","timestamp":1783945694647,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/961e7c253ea8409195080d4733f34815?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 22198\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 46691\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"961e7c253ea8409195080d4733f34815\"; filename*=utf-8''961e7c253ea8409195080d4733f34815\r\nContent-Md5: wjdG3PpMPT+ZjDYRVJ8Klg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FqjJqrPjiRnpCGX_vPBUY1RTEjr5\"\r\nLast-Modified: Fri, 05 Jun 2026 11:26:57 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: EJA7CliSt\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: kU4AAABSyJGxrsEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":22198,"size_decoded":22954,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"c23746dcfa4c3d3f998c3611549f0a96","sha1":"a8c9aab3e38919e90865ffbcf054635453123af9","sha256":"b96be1be4cf0e5339618471d63fc2aa132f715f41245ae32f14466900c3e37e5","sha512":"402c4e66d724590ef009bec876bb0c7ddcc26d5f6c8868fb22688991e34738a3f76a8e93cd46034ec613221895e008ff34ccaa7a80c71b4f7b20376d98b889f9","ssdeep":"384:Gi905+UZBLfJEqzUa3E3RTxUSwO/dLaLgrFSjan/vOFpn+caGYTH5:nTUTxEE3nS3/dessmn/vOFpn+l7D5","tlshash":"f2a2f1f7000943c55fe27f7eb8024f8b295cf4e96452656ebc9e4ea802291e157fd480","first_seen":"2024-08-20T01:52:57.905354Z","last_seen":"2026-07-17T12:50:21.003503Z","times_seen":219,"resource_available":false,"data":null}},"time_used":2462,"timings":{"blocked":2121,"dns":0,"connect":0,"send":0,"wait":304,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202606/_webp_size1298x1156_317f68a9-d367-4c78-837b-bba9a02cccbd.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.973Z","timestamp":1783945694973,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202606/_webp_size1298x1156_317f68a9-d367-4c78-837b-bba9a02cccbd.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_b82399e1-d771-428f-9811-f7e15cda0f21.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.014Z","timestamp":1783945695014,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_b82399e1-d771-428f-9811-f7e15cda0f21.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 103194\r\nConnection: keep-alive\r\nEtag: \"f704aac32ea52a31d6fc3ed2cf265934\"\r\nLast-Modified: Sat, 06 Dec 2025 06:26:28 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KdMK5UIeSy%2BzAyNpuXrEIx6mBJ86Vp%2Bjks82aUxWvH2LDzsM%2BbzeC%2FgQjsh5I9BMC3YC%2FtV5f%2BHtsNDZcV4a4Q3kp7ruveFgSWfUHqYVB6m5flhqKpRZip0z8TaVsn7RavTRm6AZGBoNYXqaEGAn6cM%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105656\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e35f3cd161114-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 028019f5b732644fe7c\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":103194,"size_decoded":104354,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f704aac32ea52a31d6fc3ed2cf265934","sha1":"45282832d890a7ff431a3e080bf45820996e1377","sha256":"0177775ecd75f420bfdca35ff7886a7e7c2be56137652084986057b7e1566a09","sha512":"6f0b988c4ffe01ea848e549c9856a39d00f127a59b0bee21b29601f055eb98ef5fd349d6b7290257bb3845ecc7ea55a6d103173ba7e689c1d4303fe1c0e8ff9e","ssdeep":"3072:CgsNR4fWsUvdSDU+qlX2KtmzD/CbIGM1:Cg8R4fWSVKYibIG","tlshash":"1ea312850993c5f1bb7598259f7acb20a51a7d70f392ef21cfa94f3ec0b50799a14242","first_seen":"2026-04-24T23:10:16.761671Z","last_seen":"2026-07-17T12:51:05.025431Z","times_seen":726,"resource_available":false,"data":null}},"time_used":6178,"timings":{"blocked":5764,"dns":0,"connect":0,"send":0,"wait":313,"receive":101,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-13T12:28:08.958Z","timestamp":1783945688958,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:09 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: public, s-maxage=600, max-age=0\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945689=P39WZ+rj1+J3zebcXDkx1gDwD+h3cmzDKP0Z8P0s2KwYTs2ScG7K6yqhBZmJrYAexR6z20w/lYSOziEatRX/lXNCTjNTQMl/9uc5BS8y7Ire97KvIutV7mS9joLRY7gIST7+DVqq4XWc9reJvaY3w2As09aTynh6ajYdi0UTBDBkMtpBpWxdp7Ft2vp8PIgx\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b72fa7c0013\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24594,"size_decoded":11457,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5777)","md5":"e79ba8d5268f3090203c26b2ec87119f","sha1":"67ec737a939ce7eb32f6c9ab0f6cb36a5d0c5045","sha256":"f03b70608a46781f56d44226537411cfd4da69014f8c6540319977c45398149b","sha512":"378079455a3539b8fa003afc4351f6acd844d704e0f41250b71dda29b445cb99821596e562eed3afea6a7d0b6de1ff61e22754a4c3d9384952d09b90f4dc3e55","ssdeep":"384:21ERlxqNBPJu2VwiYwJvSoVXsp+pa/iZcVk97g6nMusplIiz:1RXqrJuiNYiKop/E6wkpcu2llz","tlshash":"05b2195a9df3497a2423303a1f7fb20869b0d0134309ed803e4de7594f95aaa56f3bd6","first_seen":"2026-06-12T19:29:57.247756Z","last_seen":"2026-07-17T12:51:04.941743Z","times_seen":643,"resource_available":true,"data":null}},"time_used":976,"timings":{"blocked":0,"dns":26,"connect":288,"send":0,"wait":325,"receive":30,"ssl":306},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/69844ffb0beb489b8684b96cb7d24cf6?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.649Z","timestamp":1783945694649,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/69844ffb0beb489b8684b96cb7d24cf6?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 21408\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 44887\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"69844ffb0beb489b8684b96cb7d24cf6\"; filename*=utf-8''69844ffb0beb489b8684b96cb7d24cf6\r\nContent-Md5: B2LS/Dwo7EhcsdI+Kq3Afg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FlOdcmGwo-_KfxaA1C_Jit8_ac75\"\r\nLast-Modified: Tue, 19 May 2026 13:58:06 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: waKFmoHdn\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: e98AAAAXM75VsMEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21408,"size_decoded":22164,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"0762d2fc3c28ec485cb1d23e2aadc07e","sha1":"539d7261b0a3efca7f1680d42fc98adf3f69cef9","sha256":"fb388827d25d346edf2e9e3a53cc5c63dacb0a88635c7469aeb7e28c114795ba","sha512":"fddaf1aea76659088619afed03e27b36e2b2528a009bb4ade2382a66ebe55f0ea46b3d2b3c7dd112ef2c03b59e6561537ecbdca075d14a5f95b12a69616cb505","ssdeep":"384:oonRJsqw7akmIVE97yljT7BMeBUWq6HF2VF8Pdm/S289ICULVtuI9dRhTAH8:FjwmkmIVQE/Tzq6QOdB28ELrfHTz","tlshash":"19a2f1018f1c3c03d6e4481dc3dd919f7a0958a4e6ea82aa0d7dfddb6e817be65c3026","first_seen":"2025-03-31T13:06:08.089205Z","last_seen":"2026-07-14T00:00:26.342453Z","times_seen":80,"resource_available":false,"data":null}},"time_used":2506,"timings":{"blocked":2175,"dns":0,"connect":0,"send":0,"wait":301,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/LOTTERY.4e81790a.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.901Z","timestamp":1783945694901,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/LOTTERY.4e81790a.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-e929\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nAge: 105584\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b731269fcbf\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59689,"size_decoded":60431,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"f86c9671c7aed55212fe0eb5219a664d","sha1":"6e765dfb0ce3c646d8c808940071554e78e7d409","sha256":"4ba3fff550a17eff9585d6acbc4a96bd515149510f6a8bb7638985fb4b41a181","sha512":"706aa66f138a3459eaf34f5b7a8ffed3dfacecec6adf14a2e83f1149143cfbb059f97aaaac2032587a80c0e30c62e5b46b07b4dc6f3cf5925e6e1db2a8ed45d6","ssdeep":"1536:Cyp1EBaRnsFt9ZXZj0wEYsRvqm1waPbZsY:CLB+sFtzXN0w2ym1fFsY","tlshash":"914302f36beb0bc5b07adbcf4ed354f0067a71496b42dcd44f4120e61ea6199bac420a","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-17T12:50:20.974822Z","times_seen":2016,"resource_available":false,"data":null}},"time_used":1200,"timings":{"blocked":800,"dns":0,"connect":0,"send":0,"wait":310,"receive":90,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_ca5ef219-cb88-4c5a-b68c-c85984b21465.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.957Z","timestamp":1783945694957,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_ca5ef219-cb88-4c5a-b68c-c85984b21465.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_d991353f-39ff-4552-be18-848fc3fabfb2.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.972Z","timestamp":1783945694972,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_d991353f-39ff-4552-be18-848fc3fabfb2.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/webp\r\nContent-Length: 47886\r\nConnection: keep-alive\r\nEtag: \"ba0be3142a5adac8fdffb8c21b319dbb\"\r\nLast-Modified: Sat, 06 Dec 2025 06:30:09 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UcghT6RNqxyvsHUleJDGaepcWOsSTXXyu8ZixUhH4n%2BcmkFnWz9UPuqsZuAq%2BHl8gc7KSZHXBiOpa6%2B%2Bz9H2UUq0fLW5EjMdvNlz%2FsLNUAnT7LWHtucxg%2FSChsS9s2xQnseUwPz6fob2GWf4RhKBwfo%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105940\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e2ee5ad93044d-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b730f8ffcbe\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47886,"size_decoded":49045,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ba0be3142a5adac8fdffb8c21b319dbb","sha1":"86a3734ad3716c5ecf67412f804a881fc9eaf4ca","sha256":"c3d9e9184bc542699b269037e068dd63803352fc1feaf06695ec888185f77bd0","sha512":"da43e90eef8c8f0aa5daf006910fe64bb579b9a0083df3c06b0f21c8f175d5dacc0b31009365ec391f0482e62f0b8449b98407b5a2423c20fc021aeead097296","ssdeep":"768:zpFTQF6ySs7gk0G8b/lE4qxGPlMt63JKVB/JmKjmz+0N2pqQg6yQV:fpyt7y/y4qoet63UbJRa+Fqwy4","tlshash":"ec2301147718d91012a1a6dbebcc1b6d6cae4947a4457a338d8770ccc7bdc9ee53ce82","first_seen":"2026-04-24T23:10:16.87696Z","last_seen":"2026-07-17T12:47:21.707245Z","times_seen":676,"resource_available":false,"data":null}},"time_used":368,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":311,"receive":57,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_6ba5f6e7-0a03-42b1-aae6-3de33d838c71.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.995Z","timestamp":1783945694995,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_6ba5f6e7-0a03-42b1-aae6-3de33d838c71.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":72698,"size_decoded":73855,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8173a97e42cbe83253f569868015813a","sha1":"42ea560648d24b5b2f7a2707de2db0bdebc8f41e","sha256":"b6bf9777cb024d6afd79cdfab403bf54676a54ea6065abf0e8d02344a42bf8fd","sha512":"619c7b0a75af0e07e0929b087fda0183eae617910500da47727ff8b6d29e6dc98846c2e19a1fbe6d042c648c32aa24db9e0cd047a55f7256ca565e66376edaa8","ssdeep":"1536:ZYxIgPfY+3lbLKrfSQK0ds+ePjygtx4Ifql:Z0vfY+3lKrq4ds+QJtx2l","tlshash":"3663020b5a1dc95a0ae20441673a5bdeecc72324e27535c5a075fcbffad3f75414281a","first_seen":"2026-04-24T23:10:16.700652Z","last_seen":"2026-07-17T12:47:21.62675Z","times_seen":648,"resource_available":false,"data":null}},"time_used":4635,"timings":{"blocked":4278,"dns":0,"connect":0,"send":0,"wait":301,"receive":56,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_d4d2b521-861c-48d3-89a5-438931453851.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.013Z","timestamp":1783945695013,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_d4d2b521-861c-48d3-89a5-438931453851.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 52456\r\nConnection: keep-alive\r\nEtag: \"c545c93beaefd4bd61fc5c1b18fc1cae\"\r\nLast-Modified: Sat, 06 Dec 2025 06:30:18 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Wf%2F%2ByEAdn3v2ZC8LC4b%2Bjc0zCWIussKL%2BZu00JVI6ow%2F0OkWy1TTLFoRcTMK062rqyfNnXNLwxvI9BVXHYWj4TJGLaNa1Gi%2BP7cdjrQ4ZbaULAWTkFJEEjeSD0DNg0KoDEwuHeJHHl6CqrFfEEy%2FKPg%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105656\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e35f6497085ce-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b7326320046\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52456,"size_decoded":53617,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c545c93beaefd4bd61fc5c1b18fc1cae","sha1":"19a7126947210454bd434f5642d579bf87bb0e99","sha256":"c3a29377aa06329a7068664cec9166fbcf02f0724f8938eac5106b1c3a6b4644","sha512":"bff91a20b5bcb7b7eab35453005dffaa98033341f7eeaaec88a0c4b414d0d06511b4c05ebb0c3723aaaf654bc9f0c372ad3b5b288030b1d899736b27b84f0208","ssdeep":"768:n4M8fxEbpGtvfqj0Bs8GkjOhpAh9bzillpUed5V/7hz9WJVI7X1BPFLN7CLrJneU:nifKNsXI0ex7lgVMPZN7ErJnnZ","tlshash":"333302a0d69cc510dbf8d6bf0a5130fc5e88fa501ea53bab4b804cdd889e5e4e51f60b","first_seen":"2026-04-24T23:10:16.825501Z","last_seen":"2026-07-17T12:50:21.000338Z","times_seen":746,"resource_available":false,"data":null}},"time_used":6076,"timings":{"blocked":5748,"dns":0,"connect":0,"send":0,"wait":299,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/kc523-1/logo/logoWhite.png?1781011825626","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.320Z","timestamp":1783945693320,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /kc523-1/logo/logoWhite.png?1781011825626 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:17 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 01 Apr 2026 05:40:09 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"69ccafb9-547d\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945697=Y8wY1Rz8+nsWEzaT171EoSVw1V6QOLKgyV5hl0Psguoywo5vWkE+mvrqS2I5wKeOG8V6UnPoL1rn2EYkSxB1+/Gdi7ZvAW8Snric2mM/0qCL09PEwVFefWSddT9xXemyzWqK+Kc64VDD6kKv2AK5o2rKkDOM+adI4rB4P5cj8BIT5z1Iypy2zynkEKBhyWkH\r\nAge: 105952\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b7318860034\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21629,"size_decoded":22177,"mime_type":"image/png","magic":"PNG image data, 318 x 144, 8-bit/color RGBA, non-interlaced","md5":"0fe99b7761db545277ab76a5eac225b7","sha1":"c0ae9d5f9473be88b84d7d46d1efc51283a57a76","sha256":"e74b087729f820069fc590a73411d4b19d3da8a22ad1d127d4e4109be832cd97","sha512":"848f1da518a00ef98cf0e70429260b91720d3f139ed89714536d0a267aaacb8acb9779dfb1c0b42b134f81cb1ec0f5af97a160f1fc327750b111e88d7c6cc239","ssdeep":"384:Ok3FHRYfLVQEST+Yh9YDQiIkXnq3H+PxYi5JLL5PI4v2Kee/0Aytd:nFHRYfL+r9AQiIk0H+ZRGQHee/yr","tlshash":"aaa2d0d63930414ec49128de0fc1b9285cb6858847fd1e944f9f5eb2b4a3df62b4b368","first_seen":"2026-03-22T09:12:55.770605Z","last_seen":"2026-07-17T12:37:28.55344Z","times_seen":783,"resource_available":false,"data":null}},"time_used":4244,"timings":{"blocked":3941,"dns":0,"connect":0,"send":0,"wait":297,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/ecb/8f8306425ab46d0221b2c56ef50f72e487d5bb0255ee7333091abb7c08c465094a574c3c12d0e1812241fe43c0d5f0ea88d857f698a4fd081b","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.114Z","timestamp":1783945694114,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /ecb/8f8306425ab46d0221b2c56ef50f72e487d5bb0255ee7333091abb7c08c465094a574c3c12d0e1812241fe43c0d5f0ea88d857f698a4fd081b HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://g25j.top\r\nXign: vQEEXtayuXZTrcM7QqdcXZy17pUsp5r97Jm7vABasPwOoqBs4a0RN2e3c9/tbtqFe7AVO6awEJByhGAap15Gd2KkrNHFXXeuNH2ey+wXy3v2tRhgB3TPNUU4Qn+ub63TZ86cJSJjic0RIgOfQwPuD/tCKJya+kK1RtbaK18uAbk=\r\ntimestamp: 1783945694105\r\nsign: 1m7f1i3638a51g12\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: HQKEwmeYFSSEaBtwbDNtyDn6TxTXzDaR\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:14 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Mon, 13 Jul 2026 12:33:14 GMT\r\nCache-Control: public, max-age=300, s-maxage=300, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: 83373c887bb845f1ae7ebb41d3e54cd4\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945694=E8FdoxMIiXaneiIJH8nRsEj9bqanUX/19vOzGBfRqOu7uMm0tthCqIaH5Z9EhkjGEJqO+UtOPdlD7oMK9qcmOqh42CeeqaqvIh3/4bt3zisg25NE+XlC0Mz1MIdp+DjwpVUU4FMunaWp2JkDKT2fS0ptq8rNVF5M2PBBB5EW11HVWyysDG98xECmcpSkiFbC\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027c19f5b730c372ad5\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35371,"size_decoded":36414,"mime_type":"application/json","magic":"data","md5":"1cc0c3632cbf293442b1953f90c5ee40","sha1":"92d9de18a53a5a0c0f2fe0f7686b169037e4fcdb","sha256":"41ebbe97e46aaa001aba1fb9740e0055afb98358ace76dd5c7a870de50ffa08f","sha512":"1fb958ca2f816f272819f58ee31830b43b4379ce5836a36d8baa4691abc3c551bf35de09886a7ad5a5e87f8b264273253c0074c3156a0cc9dec9bd3e56f30f47","ssdeep":"1536:OcGXXzz9GnmquRGE2/4/ZMzJh0pJg+3acgWs:BGXXzMnAeQ/GJhIJ3TgWs","tlshash":"2833d0314346f3e0e06ad8f3662545d047504ae1a7b7fd60ea74d6711dab22ea3cfd82","first_seen":"2026-07-13T12:20:48.170391Z","last_seen":"2026-07-13T18:49:11.160509Z","times_seen":6,"resource_available":false,"data":null}},"time_used":716,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":320,"receive":396,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/4c1a53c19e0e49c5a429bfec82fda6c1?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.648Z","timestamp":1783945694648,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/4c1a53c19e0e49c5a429bfec82fda6c1?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 7843\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 46692\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"4c1a53c19e0e49c5a429bfec82fda6c1\"; filename*=utf-8''4c1a53c19e0e49c5a429bfec82fda6c1\r\nContent-Md5: SZ00abqHZsiFk1r3XaEAnA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FszoHz8Cvri8EP7Jov6EcyMJnvwp\"\r\nLast-Modified: Fri, 05 Jun 2026 11:26:58 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: AyCCbQz7e\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: HugAAAB9d4mxrsEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":7843,"size_decoded":8598,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"499d3469ba8766c885935af75da1009c","sha1":"cce81f3f02beb8bc10fec9a2fe847323099efc29","sha256":"f759934be71de3f9eb811b748d01bc431276540c6c5d8067adc05fbd28c9042b","sha512":"e85d784f8cc7794fe6648d3d8f382f06bcbb3af51dfaf53d6741d8d731d86cf2bde01b8fb63b944257fa10f08f91eb1a819a13ad185908f3dd9d49e392aa1dcc","ssdeep":"192:KLKpYoWXYCMgds1qbuhsERGv1oDMlwaE6S6FrRZ:KLKpYfoCMyTbuqoM2MlDptRZ","tlshash":"89f1bfb370bb154e1e865a7cc83858ce7431a1a313b73a2c99c0d8d464bf711c1eb634","first_seen":"2024-08-19T15:21:19.591125Z","last_seen":"2026-07-14T00:00:26.436441Z","times_seen":99,"resource_available":false,"data":null}},"time_used":2401,"timings":{"blocked":2142,"dns":0,"connect":0,"send":0,"wait":259,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/CHESS.80cb714e.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.899Z","timestamp":1783945694899,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/CHESS.80cb714e.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-e587\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nAge: 105584\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b73120323bc\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58759,"size_decoded":59477,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"727b4dc207a4141335b27fa73f76fb10","sha1":"bb63b02e635f5503d76c4fc3532c2c652a06cac8","sha256":"5d840214ae46c94540df7d0a94963cc398b32c7b868edddb6a4f2a2faf113e42","sha512":"c1512f9d9a191ea10e806fe3a8f812f78dec9832568373b7b5362fafe9aef6783947d248deb2fc8d30ba1c61fd3b94f308298e69c1de32686110fa35f7bd4ed4","ssdeep":"1536:gtPCh483gu6aLw9AJeteTzkprgTWEHbP4BzrJ:344U9Xte3kprgKE7gZJ","tlshash":"0543025a13c1159f422f37b8148758a6d8154f9f38f32ea11a9e2afda58cb0af431c3d","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-17T12:50:21.064602Z","times_seen":2025,"resource_available":false,"data":null}},"time_used":1022,"timings":{"blocked":701,"dns":0,"connect":0,"send":0,"wait":307,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/config/telegram.js?t=1783945689993","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:10.021Z","timestamp":1783945690021,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /config/telegram.js?t=1783945689993 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:12 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-1c896\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945692=qznV/A5DkUWRxrF/GJAyyFGufA0w5Vs4TDBQUs7FGM0/2jWWcHaN/Qf3Ohf7yhgdW3iZGlOD/fyAXe/zPXkRor82XFC/wYSnF3xx0Ep8xe4qLaK7dmOsrBRoTP9JRV8qG/w12/FtPGFK5+EySGIDP/+fSLyhdRl7BuGl3ldmXJRMfEYoQsB/tKnOUbd5M/O9\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 028019f5b7303d4fe45\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":116886,"size_decoded":18895,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (483)","md5":"4ef2154bcfb8399f256c2da15a4cb409","sha1":"e0f8f5578b2e0773ec1d79bb1cec54e1f5d6373d","sha256":"73fa4926373755b52fecfdf3145a0c9953c08af374ea69dda46fe2b3b9ddb022","sha512":"8b64643161386bdefbb7eab04416e78e5e183c50acba7b25b146aa6e733744a326566a01eb7eabb1a0a3f5b87ac8461a7ab3b9ad1c44de37ecea25af09e3eb41","ssdeep":"1536:WK4KZK+Klt3LbbdS4V+vO14KtA9phXTQ+fcZl8LDh7j8d3K+V4WMrnf/NunqxF00:Wj+dgdLbbdSA+1XTQRZ1jSBl","tlshash":"14b31c4c5cf3216285a7b1be8b9f925072759893304def203c4d9ba45f98d3c53eaad8","first_seen":"2025-05-31T08:16:48.368096Z","last_seen":"2026-07-17T12:51:04.927009Z","times_seen":1967,"resource_available":true,"data":null}},"time_used":2282,"timings":{"blocked":1948,"dns":0,"connect":0,"send":0,"wait":329,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/api/sport/match/player/match","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.663Z","timestamp":1783945694663,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /api/sport/match/player/match HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nx-request-source: https://g25j.top\r\nXign: nUfRg0zacQ2S+9yecDh10fS7LSiJ+yt0N42aHO6XFSolNamzG6cFBpJJLlfuPdujCOL+Xws8IQUdeI78rbicIGn0Rw7GFi77MbA2y3XmM/kYuUTr32mCqLoNofnnslamPKj1HLk2wexcJTqd5kRq7VAuefCOl5d7vtqC9vIU6ls=\r\ntimestamp: 1783945694639\r\nsign: 7n5r2d7v41b6321j\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: HQKEwmeYFSSEaBtwbDNtyDn6TxTXzDaR\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:14 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945694=E8FdoxMIiXaneiIJH8nRsEj9bqanUX/19vOzGBfRqOu7uMm0tthCqIaH5Z9EhkjGEJqO+UtOPdlD7oMK9qcmOqh42CeeqaqvIh3/4bt3zisg25NE+XlC0Mz1MIdp+DjwpVUU4FMunaWp2JkDKT2fS0ptq8rNVF5M2PBBB5EW11HVWyysDG98xECmcpSkiFbC\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027f19f5b730e5914b4\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60,"size_decoded":688,"mime_type":"application/json","magic":"JSON text data","md5":"ad1b5cbc37e087c212a41eca07a863ae","sha1":"f990fb40077ca4c90bbde8ffb87c73e1c06fd931","sha256":"0fca88eefe8bb5f59242b88e2b8b179148a088b4cde3499e1c56fef8c84c309a","sha512":"fe056eef22791a958cc37f63c1cc4b3f35bd990c34d1d321f34504b7b99769b571fe46cf18ede31f7ca0e564baf63aaca9d4f3601395bd7a3ce424e50a2aaf87","ssdeep":"","tlshash":"56a002473a282ea49bc31066b50e7a5500a421749a55f469cc8e623dc755453b546531","first_seen":"2024-05-26T00:49:06Z","last_seen":"2026-07-17T12:51:05.09627Z","times_seen":2249,"resource_available":false,"data":null}},"time_used":302,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":300,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202506/_webp_size1164x872_0e80d399-2c93-4f64-89db-61a96d3b05e4.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.966Z","timestamp":1783945694966,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202506/_webp_size1164x872_0e80d399-2c93-4f64-89db-61a96d3b05e4.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_0fa85f10-2205-44f2-82c2-66bd141c7d57.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.009Z","timestamp":1783945695009,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_0fa85f10-2205-44f2-82c2-66bd141c7d57.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/webp\r\nContent-Length: 10174\r\nConnection: keep-alive\r\nEtag: \"7ac42d17bfd5a06e8fc6a329b7018939\"\r\nLast-Modified: Tue, 02 Dec 2025 15:07:04 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2YOBgmb%2BbmQ%2FZ1klEE93Q%2BF4aJO2hCw%2F3pU7JBFDgj7LOEhZpWw4b5UYksXLSDdpRk7jGfzeFDC%2FUC3CC4OMwukyHoC1Qa04SJeSmm9rIQYQ2Vp4l5ARCpRxumxhAb4Aoep1qGM8dKNsOJv79BshCMw%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105650\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e35fa0d26096f-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027f19f5b730fb314b5\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10174,"size_decoded":11331,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7ac42d17bfd5a06e8fc6a329b7018939","sha1":"37f26ed9d40765d2f0a2436038a6c772d654e316","sha256":"23d5a3a14c318b6982e98a0e9f7ae7eb6f3658fe842beef7f26850121f84279c","sha512":"8c49c05d03fb49bc2980047e98e2d1759192aedc89ff040050b1c8e007b16007f71bff0f17eaa3584bef6c0b0db5a52b68009463bd3dd2aa43cacd757ad7367b","ssdeep":"192:O5IkarrboesyPUh4c/gp+sIR6RxWiH21vZgiClgKV16Lq1eM9h0K+B5pZrgVWPWb:5k8rboesiUec4p+sIAYkgK7eQ09B5pZz","tlshash":"3c22bfd259d648a4e1d3d63229678a89d3bf3d0f0309b6d4acec74cf9846dbdd4d0a41","first_seen":"2026-04-24T23:10:16.755505Z","last_seen":"2026-07-17T12:50:21.182091Z","times_seen":713,"resource_available":false,"data":null}},"time_used":693,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":693,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size750x590_1103f977-5f3c-414d-8305-ab6884e8769c.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.015Z","timestamp":1783945695015,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size750x590_1103f977-5f3c-414d-8305-ab6884e8769c.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 43614\r\nConnection: keep-alive\r\nEtag: \"f0558545ac271256cf9e2e089c4b5d7b\"\r\nLast-Modified: Sun, 09 Nov 2025 14:30:08 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105588\r\nCf-Cache-Status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5SO%2B4VAUh69fL39RjhpyhBJXqeATYAdXJiEhmxwuTDd0ZMHuo%2Bg0Mhs3C0lKfXJoaZOTzFozrfeAxlVHrccWXo%2BPkQRyXmOxAF8WG1Qk95S%2BnynL4u%2Fs82YSuI695TCZ3vg3B3gJ1kxR0J8%2BJto3qvA%3D\"}]}\r\nCF-RAY: a19e37a11ddb8e07-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b732645248d\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43614,"size_decoded":44773,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f0558545ac271256cf9e2e089c4b5d7b","sha1":"9594bc20fca63f0cfc8d31eeda8158bab7c54139","sha256":"cdd8fa33c321da25e96a0fff96453673d60d6c59c309aa7a2048e32b78f29e75","sha512":"e9a34139f7f091d9269ef1b87c11fa7900523ac4d286fddb7843e64afb1ea084064441c836ca8460185a800378cfe5153141613f0807d84e0687a1ef41f027b6","ssdeep":"768:c8urDr4gpwG3TMvUToCKvqwP9bDPCqO45+V0D63GQu54vlb:c8urDr4VGj9KPPh3+y2Dvvlb","tlshash":"b41302a684b210b1cc6db573dda010661bb07cb8ad6d5d1e0690e60fadbcdf12ca3e90","first_seen":"2026-04-24T23:10:16.765262Z","last_seen":"2026-07-17T12:51:05.086447Z","times_seen":746,"resource_available":false,"data":null}},"time_used":6239,"timings":{"blocked":5768,"dns":0,"connect":0,"send":0,"wait":357,"receive":114,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/kc523-1/sponsor/sponsor.json?1781011825626","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.255Z","timestamp":1783945693255,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor.json?1781011825626 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:13 GMT\r\nContent-Type: application/json\r\nContent-Length: 646\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nETag: \"68dbcacf-286\"\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945693=73ZApDHt8ncnojFO9uRQaPhNZJ5tRe18RjCXPKXkWXxespjhHpCwLtBaszC+J/q8xLlbRcE3PMKSZdsJF5yW7kWOWJBcdABsf5O3MBD+NHHscog80WgEiTB/vuYo3smoMZYOSQoRe0+HHAG7/mIUHYrVbUjzGWa32+eteBkKxvdZO1+4NR+r30WPC+J5bmLn\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027c19f5b73090d2ad1\r\nX-Cache-Status: BYPASS\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":646,"size_decoded":1261,"mime_type":"application/json","magic":"JSON text data","md5":"10d2161de8cf99c474812f4c43645a26","sha1":"71884ef7281cdcb5084088f16d4550ce8790e634","sha256":"bb02fd7438bb49dd4decb6f76a71f11e93355332fd9f965d6f9f13bb8175aeca","sha512":"bf0fd1232309fcc5582d5c42644e1c7b4b8d235b1066e988ff55e0dd94a956f89742401f00c2d904359041c8e0c2bac8e9316252fab60db5eb0a3b4c935172f0","ssdeep":"","tlshash":"d8f0f44ad8b25b93211fb57c58cd050470294a8f0eccaac4baac987c4f598ddd1e839e","first_seen":"2023-06-16T04:51:50Z","last_seen":"2026-07-17T12:51:05.093019Z","times_seen":2387,"resource_available":false,"data":null}},"time_used":402,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":402,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/kc523-1/sponsor/sponsor.json?1781011825626","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.258Z","timestamp":1783945693258,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor.json?1781011825626 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:13 GMT\r\nContent-Type: application/json\r\nContent-Length: 646\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nETag: \"68dbcacf-286\"\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945693=73ZApDHt8ncnojFO9uRQaPhNZJ5tRe18RjCXPKXkWXxespjhHpCwLtBaszC+J/q8xLlbRcE3PMKSZdsJF5yW7kWOWJBcdABsf5O3MBD+NHHscog80WgEiTB/vuYo3smoMZYOSQoRe0+HHAG7/mIUHYrVbUjzGWa32+eteBkKxvdZO1+4NR+r30WPC+J5bmLn\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b73090e2479\r\nX-Cache-Status: BYPASS\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":646,"size_decoded":1261,"mime_type":"application/json","magic":"JSON text data","md5":"10d2161de8cf99c474812f4c43645a26","sha1":"71884ef7281cdcb5084088f16d4550ce8790e634","sha256":"bb02fd7438bb49dd4decb6f76a71f11e93355332fd9f965d6f9f13bb8175aeca","sha512":"bf0fd1232309fcc5582d5c42644e1c7b4b8d235b1066e988ff55e0dd94a956f89742401f00c2d904359041c8e0c2bac8e9316252fab60db5eb0a3b4c935172f0","ssdeep":"","tlshash":"d8f0f44ad8b25b93211fb57c58cd050470294a8f0eccaac4baac987c4f598ddd1e839e","first_seen":"2023-06-16T04:51:50Z","last_seen":"2026-07-17T12:51:05.093019Z","times_seen":2387,"resource_available":false,"data":null}},"time_used":418,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":418,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/away-bg.00d4ba2a.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.659Z","timestamp":1783945694659,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/away-bg.00d4ba2a.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g25j.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:14 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:10 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281706-f2b\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945694=E8FdoxMIiXaneiIJH8nRsEj9bqanUX/19vOzGBfRqOu7uMm0tthCqIaH5Z9EhkjGEJqO+UtOPdlD7oMK9qcmOqh42CeeqaqvIh3/4bt3zisg25NE+XlC0Mz1MIdp+DjwpVUU4FMunaWp2JkDKT2fS0ptq8rNVF5M2PBBB5EW11HVWyysDG98xECmcpSkiFbC\r\nAge: 105946\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 028019f5b730e55fe58\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3883,"size_decoded":4609,"mime_type":"image/png","magic":"PNG image data, 277 x 80, 8-bit colormap, non-interlaced","md5":"ce3e5a71ef5dcf15c030882243e12315","sha1":"d4fdd1329ecac30941a67bd5108bad525c791c12","sha256":"3c2aad01ce2fce6463d6ed3bde348515922dd019d8a670b07b53d66b39c68d3d","sha512":"f6a55d8c079529988760a1c22541c097af159a3653f5ffe89c5c31ee20371f2c879c64797319f4176be77c821294f0f72d83ad77f2a0141203c857c8f987966c","ssdeep":"","tlshash":"6f815cf693e66bd0d5675106a3a14c89624d69d925a325530923f45ec3bb1ac02fe381","first_seen":"2025-08-29T11:05:53.10673Z","last_seen":"2026-07-17T12:32:49.867791Z","times_seen":2013,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":297,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_188684fd-5a0b-43f3-8a6e-b9c558e44ec4.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.963Z","timestamp":1783945694963,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_188684fd-5a0b-43f3-8a6e-b9c558e44ec4.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_07a2d840-d1e1-4217-9d3b-badf80b88abd.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.967Z","timestamp":1783945694967,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_07a2d840-d1e1-4217-9d3b-badf80b88abd.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_df036cfa-66a5-49f7-b863-3c22d1a3d180.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.000Z","timestamp":1783945695000,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_df036cfa-66a5-49f7-b863-3c22d1a3d180.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:19 GMT\r\nContent-Type: image/webp\r\nContent-Length: 120978\r\nConnection: keep-alive\r\nEtag: \"1af718e662844a31716cc9bf3248f8e4\"\r\nLast-Modified: Wed, 10 Dec 2025 11:52:31 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105655\r\nCf-Cache-Status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fvoC3gCa13OkIT8pCvjksMLB8t3sA%2FTKfnS0GJ66N73QPQJXJb8E8dGW68UAlDFO%2FVxHscuxdlEeAYT2ESbY%2BfUMk1O%2BYeP0xTDQiQe5wD%2F8r803LIPQr4OqfSs6ruWEIzlUc2VpQgF7fgTd6Y1760U%3D\"}]}\r\nCF-RAY: a19e35f7edcdae24-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945699=4MEiqPSe8OxMuqjLKZveDUbGED9Mvo3jTwEG5nI2R2GsBmFsb2Ea2LZ4cSajf5ZjdWZipM4lTTtxcnnFp3YhHrpEd5JqGB5AdfD1pY7l6RLd2tdtdQuP5GUr/lvKBKr79H83O6+4JFoMai8hLvCcHUKJzoh7r7ak9alQAIfeYO95g9NMuvfD8OEH79RBP7Tt\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b73224dfcca\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":120978,"size_decoded":122136,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1af718e662844a31716cc9bf3248f8e4","sha1":"e54b87093f05f4d0c5d96fbc689f0ed37ffcbcaa","sha256":"670ccce96c9f21fc7364791b4870e1915788e14fb105a16cae131cae271279b4","sha512":"93a7b9e3a5b4438343a8f1abe967cf1b3d21a347b42526dd8604da5f9c953c14ad2dc83bcd7e3f340a9b3b90b9a4c98f90ec88c689875b8e2b0536f0b9ca7975","ssdeep":"3072:nO0/MDrjGP/ngyzlMkxT730AhwPBv78vHWJ8AxCsDozmmeYj:JgrA/nnKBrpvovHWLxCqImE","tlshash":"a0c312ee7ec309b8e112676d12dd07968e16e06f482b0d959e2f40392b02716ef7dc5d","first_seen":"2026-04-24T23:10:16.785822Z","last_seen":"2026-07-17T12:47:21.573127Z","times_seen":659,"resource_available":false,"data":null}},"time_used":5223,"timings":{"blocked":4754,"dns":0,"connect":0,"send":0,"wait":307,"receive":162,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_9986c108-3fd7-4f35-9443-f78ce32e1660.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.010Z","timestamp":1783945695010,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_9986c108-3fd7-4f35-9443-f78ce32e1660.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 15914\r\nConnection: keep-alive\r\nEtag: \"d455ee7db25284552aeaae58bb713429\"\r\nLast-Modified: Tue, 02 Dec 2025 14:11:43 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105586\r\nCf-Cache-Status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sO%2FuYO66S%2BgWemuYZvq10fyOG4YLfgVQsvDdvOgOMaXoRigqId7QXZBed720RPmJaBhpIUikmBxuMlBiaR8%2FTfqPETpoZD8qxPYID9LrQyuu4czFdeq1crG7FzJhC16qjv8UD8OhqewZLXTkMUlVlx4%3D\"}]}\r\nCF-RAY: a19e37ab7dc985e6-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b73251123c9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15914,"size_decoded":17067,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d455ee7db25284552aeaae58bb713429","sha1":"22ea59f69e3ce33cb693d6ab7cde1f4f64bbe6b6","sha256":"20c558fe862164c2d2636a0b3aa259515f5175835dd461e5c16689338ba39413","sha512":"bc5147cbcf7ebb167eb2a75a56c140a33d81616f014f44c4976eff4525f665957e33e6d46f946d873016140af260808658915299a2004c2964be1543126a00b2","ssdeep":"384:POdbE1lYVo0UOKUjQgxN5voCgMMZUN3GcHHZUX3650gyyY44oDMWQ:P4+6+0URmQ+OMMZUNnnZUX6jyJPoD","tlshash":"8b62b051fa2b34398ea119feefcd1d195804ce608a3e6d6a6f3cd20d96b450ec46ed05","first_seen":"2026-04-24T23:10:16.815124Z","last_seen":"2026-07-17T12:50:20.95108Z","times_seen":724,"resource_available":false,"data":null}},"time_used":5769,"timings":{"blocked":5428,"dns":0,"connect":0,"send":0,"wait":341,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size704x442_73525908-fb7b-43df-ab6b-ee9a1274a74c.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.015Z","timestamp":1783945695015,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size704x442_73525908-fb7b-43df-ab6b-ee9a1274a74c.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 26068\r\nConnection: keep-alive\r\nEtag: \"da33ad9a009a89e0bc0c508e6f690949\"\r\nLast-Modified: Sun, 09 Nov 2025 14:20:32 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nBYlqHBL3Xp%2Fs%2BIdAw6C8GqETuKtM6UuqhFQrMWgGhgEAxMZHBntKqaFaKviLg%2FuqQyvUqJJp2zLf1hzL5oraMu7%2BaufcurTTck2wLItyQM4PZ1AwK1FfrofBZ%2FspFphClAAjg%2FdJ6hecVC%2B3LfpPow%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105589\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e379a99790973-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b73264523ca\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26068,"size_decoded":27229,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"da33ad9a009a89e0bc0c508e6f690949","sha1":"52521f6667f933538fd61fac097ba79db283c0cf","sha256":"12889485842cb12ca8c77f0a9c71ac3098cf3c9898b3cdc299145280170962d6","sha512":"a254ca97846b0d3216994f8db6adfee226b9b2c6120a33c1ec1f0a635f658f99e6b2c2407dffcbe79d5dc65aca0869aff746d751347eaf9780083b0e25103fe0","ssdeep":"384:+w9CBmVKxqlIavZBdogyHrWz/1ope325wQBJKn5QahMi7HjOMdOdjawQJoYh:+yYmV5Vv7WZLWhop42525Q0M+HujawQ","tlshash":"e9c2e1c2bd2de50a9b37c27e24a6c30f01c497808faa2c677736129d4d365abb56900e","first_seen":"2026-04-24T23:10:16.863494Z","last_seen":"2026-07-17T12:50:20.992647Z","times_seen":744,"resource_available":false,"data":null}},"time_used":6078,"timings":{"blocked":5768,"dns":0,"connect":0,"send":0,"wait":307,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/13575.1781011881923.cda1d494.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:10.011Z","timestamp":1783945690011,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/13575.1781011881923.cda1d494.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:11 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-2f964\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945691=GzNdgISsvsovXzYSHcN5Rhee8puQLKTEAva6npTyyVjGZIQFsC97lDzy7xZh8aHHWCZG5DNdAoU/YOhaMRs0XZXnWKT8yLMbiQlToexwVVB3nYw4P7RRfOdU2V1iUK9Ck3wY3AAUnsJ4SxQm58SYWz3DLpsNlJIdwsPZ5PGlvuprVHoBSSXB9TXDmJ2OBdYM\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b7301da001b\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":194916,"size_decoded":60169,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"65e5fffbcacf52710ad963a4aeede3be","sha1":"f9c16a3c86649aeacf18e736faacff0cf78192e7","sha256":"36f42498ee253b0d1d5e7ec8bdf406f05c4c91e72f64169b1ff67435d2069099","sha512":"96e8263c115ca75ff63f6ce70ba8ad5af370662f86c2f95a8960a5aa5a30ce4134fa01d7fbd1694ce37f111b69e3e418f0542a7ab1bae4cec570c8c3d8d08986","ssdeep":"1536:917BBHFeKRKp+3ELSPtj6x2DgJoG7PIDmj9VA+s69JAFdE6WIzl+Ik1+eXMa7a4H:7jHoKRKphCnDgJoec+IDWIzls+7Xr0X7","tlshash":"23141a84764170b8c396a165322f601ae22f789650dd9c24f3789ba47f7470df26fabc","first_seen":"2026-06-12T19:29:57.266361Z","last_seen":"2026-07-17T12:51:05.016487Z","times_seen":624,"resource_available":true,"data":null}},"time_used":2045,"timings":{"blocked":1445,"dns":0,"connect":0,"send":0,"wait":364,"receive":236,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/assets/logo/favicon.ico","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.017Z","timestamp":1783945693017,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /assets/logo/favicon.ico HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:13 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 585615\r\nConnection: keep-alive\r\nLast-Modified: Wed, 01 Apr 2026 05:40:09 GMT\r\nETag: \"69ccafb9-8ef8f\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945693=73ZApDHt8ncnojFO9uRQaPhNZJ5tRe18RjCXPKXkWXxespjhHpCwLtBaszC+J/q8xLlbRcE3PMKSZdsJF5yW7kWOWJBcdABsf5O3MBD+NHHscog80WgEiTB/vuYo3smoMZYOSQoRe0+HHAG7/mIUHYrVbUjzGWa32+eteBkKxvdZO1+4NR+r30WPC+J5bmLn\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b7307eb2478\r\nX-Cache-Status: BYPASS\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":585615,"size_decoded":586282,"mime_type":"image/x-icon","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"abd1eb812e495d993fb310ca906ea605","sha1":"77a61cd2ad4a89c22f4a979571d3c259870732f5","sha256":"ccd41d39ff7fbed7a9200f685d9b0198736d1a2f737e9d32f83ddaeef39a4180","sha512":"e8221a9acda08a0a0bc5410cd14bc72d30e6fa66cc6e7a4bc07b53f5c94b5ec670f19571246ab2f55ec2924f679543780e9f55e0ecf8a169ce3b91e38da07d25","ssdeep":"12288:zObp4IC0/qFNYge/0z5g2c+UTxVi1+4g+/F5:ibpa2qFNNe8zy+si1+4V/F5","tlshash":"e8c4230df5a39834d5dc996741db54e0c790e4183db25e323ba3448ea3d05b8ea267f7","first_seen":"2026-03-20T12:57:26.707036Z","last_seen":"2026-07-17T12:51:04.935776Z","times_seen":1046,"resource_available":false,"data":null}},"time_used":1102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":301,"receive":801,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/css/83749.1781011881923.2e202a68.css","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.175Z","timestamp":1783945693175,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /css/83749.1781011881923.2e202a68.css HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:13 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-6f2f\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945693=73ZApDHt8ncnojFO9uRQaPhNZJ5tRe18RjCXPKXkWXxespjhHpCwLtBaszC+J/q8xLlbRcE3PMKSZdsJF5yW7kWOWJBcdABsf5O3MBD+NHHscog80WgEiTB/vuYo3smoMZYOSQoRe0+HHAG7/mIUHYrVbUjzGWa32+eteBkKxvdZO1+4NR+r30WPC+J5bmLn\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b730aee0021\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28463,"size_decoded":6305,"mime_type":"text/css","magic":"ASCII text, with very long lines (28463), with no line terminators","md5":"1ead8072763d5fe20963f033dc63d94e","sha1":"36eeb0853a1b5681ab464dc1ef3682160e420e60","sha256":"8f014d5d9b2798ecfc473bac7c23f80295b94af3cbeff054fcaf973b286f8240","sha512":"92670a870b9db4259e71072ab72699e3431fa9eb53027f4b90c954b51eaf1869f5f50987808e5c625e9101ea4ea3aca655b81ba73f3ba2ced4cd480eb9a915cc","ssdeep":"384:DYCKpsUIc1F8l1TANI34yQyqPPQwmfzIfRbHx6+OhCcbakzeYaTONdqdK:DYCKpcPE64yDqbodqdK","tlshash":"07d2739ae5d4b13e6c1fbb35ebc5a1ecb1399450df620e7af202762547c3af1012216d","first_seen":"2026-04-29T03:41:13.425526Z","last_seen":"2026-07-17T12:51:04.927566Z","times_seen":984,"resource_available":false,"data":null}},"time_used":913,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":913,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/ecb/8f8306425eba6e0167bcdb25a31b67ec8f","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.110Z","timestamp":1783945694110,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /ecb/8f8306425eba6e0167bcdb25a31b67ec8f HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://g25j.top\r\nXign: wUjpegwgbEfUIbXp7DmbKbX7xCnafdLgkBpPJTDugCknoBUL2cU7Ohn4AUu3IDZNuATkW0B6m5FFdcDZGiQpB2K5SafFYkuEVcJzWfBlodsja1yFqUQAAoNLwcKPop8tO9U2nVL4+9pFRZXLQGKZ45R7HXPAICvkLxkBDbDAcK8=\r\ntimestamp: 1783945694105\r\nsign: 1q6m2v1k554n294h\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: HQKEwmeYFSSEaBtwbDNtyDn6TxTXzDaR\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:14 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Mon, 13 Jul 2026 12:31:14 GMT\r\nCache-Control: public, max-age=180, s-maxage=180, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: 5e8f66d03d9b468cbad1198c1c3408f9\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945694=E8FdoxMIiXaneiIJH8nRsEj9bqanUX/19vOzGBfRqOu7uMm0tthCqIaH5Z9EhkjGEJqO+UtOPdlD7oMK9qcmOqh42CeeqaqvIh3/4bt3zisg25NE+XlC0Mz1MIdp+DjwpVUU4FMunaWp2JkDKT2fS0ptq8rNVF5M2PBBB5EW11HVWyysDG98xECmcpSkiFbC\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027f19f5b730c3714b3\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4093,"size_decoded":5126,"mime_type":"application/json","magic":"data","md5":"ae454214aa86e145e703b680f29f098e","sha1":"0e4d88ef527f4cfe765518ce2b68d2c8492a96b7","sha256":"0c3688f50f557be754a955f07f57008ed62395e0677151394b3969e6f7f5c65a","sha512":"0af90ea4ec652be81d85e6274fecf954c6adbf4cfb7240930469768d6d221b0c3239a8f19dd09c1ce22c52007e35572cfa6d24f3a6d90f7029b678279795e56f","ssdeep":"192:VP7SaQVZZbf7C54Iw/MDeQHG3K3UuJQgySfF:1fOZbfe5s+tm63Uv4F","tlshash":"96d16e473639bb009626bef5ac359db03a0807d8d6c56d83e350f3781af128b676d645","first_seen":"2026-07-09T15:45:52.256235Z","last_seen":"2026-07-14T13:33:03.547081Z","times_seen":83,"resource_available":false,"data":null}},"time_used":320,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":320,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/ecb/8f83064249b06e0660afdb30b60772fdcdfbb3036fb467600d10b16d76dc640e","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.121Z","timestamp":1783945694121,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /ecb/8f83064249b06e0660afdb30b60772fdcdfbb3036fb467600d10b16d76dc640e HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://g25j.top\r\nXign: ntPAe+qCXZA1ZcByPEbmiVv80T0ZWVe6IQ20Yo/jkKYIZT1uwOzB65l2AdDgmwMuoEeqUMmwxI4fT3/0y9MXopo2WXwGigAJaq7fXx9BNi2nkpRsEaGtMHFDXk3p49dL8HtZJwn10fNP7pZ0q/8VA7Rxe+0BITFrGwsy+SekiQE=\r\ntimestamp: 1783945694106\r\nsign: 2h6i2m2529653m7f\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: HQKEwmeYFSSEaBtwbDNtyDn6TxTXzDaR\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:14 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Mon, 13 Jul 2026 12:38:14 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: a50066e1496e4352aa662b443277fb75\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945694=E8FdoxMIiXaneiIJH8nRsEj9bqanUX/19vOzGBfRqOu7uMm0tthCqIaH5Z9EhkjGEJqO+UtOPdlD7oMK9qcmOqh42CeeqaqvIh3/4bt3zisg25NE+XlC0Mz1MIdp+DjwpVUU4FMunaWp2JkDKT2fS0ptq8rNVF5M2PBBB5EW11HVWyysDG98xECmcpSkiFbC\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b730d7523b9\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4985,"size_decoded":6018,"mime_type":"application/json","magic":"data","md5":"747bae889a2920f97b62b944542444aa","sha1":"310f8ba3ca63424a4409f0ce9f9e09a4a1f18633","sha256":"131794c929737eb693fcbdcb4b78c27c36084c43a36a83c9313e0263059257d8","sha512":"4912977fac38a09441347aaa91a71de7de5b8aca43b37b075cd8458f9ab1d5d09253a5a35a9375c65a41854f456a353ec0151914a937ba58e6585c9f44cb4aa1","ssdeep":"192:VeAeciOmSkzgWYjeI/IWl2BOqDLC7iHLUpzQwTkYbynhY7:xNVFN/IwiOuLkiHLYvTkYuhY7","tlshash":"02f1af0197d8a368c5e7d1e3384273458252098a710f5f4cca6c62f66d5f42522ff9b3","first_seen":"2026-07-10T23:44:19.384179Z","last_seen":"2026-07-13T18:49:11.25782Z","times_seen":9,"resource_available":false,"data":null}},"time_used":621,"timings":{"blocked":313,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/api/sport/match/list?sportId=1\u0026client=web","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:30.286Z","timestamp":1783945710286,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nx-request-source: https://g25j.top\r\nXign: RZq0kYTlIsJM55ih6KouIrxOQ7Y3wmxw1wDFWkjU+fYKtuAdvNn3AMXCd/k/gXv36sls1gG+SswkuIlkd1tGBdBordzjbNe79qyj/05bZu5+SWfd42O2R4isl4gq8KhzfxW7VlWjHiTTnqTNkJrNpQvdJiPHGk4tokpv745EbEE=\r\ntimestamp: 1783945710281\r\nsign: a451s5f4u3f14c58\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: HQKEwmeYFSSEaBtwbDNtyDn6TxTXzDaR\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:30 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945710=w6xdNO3RcCGu4Mub731ehOBpIfUmCm7914xKqb8/pO5PZYNlzEyrkJU9YaanMKeqD90zdAz/hJRMGNsT5bmWfhrc3jIkyy8rf/KGTGlo+Bjblu/sKgh415qLgMBMm3jqhgDXDGfZ1IUmA+x04lj4qIa/97W129k+VoXVVXWBp7CSxcoOzhSQKYOf/mZqjTbs\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b734b612494\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7898,"size_decoded":2360,"mime_type":"application/json","magic":"JSON text data","md5":"5152b3f9758d2c8f769c668a11c186b4","sha1":"c32ea27206d117c4399f28fcd1bfb7cd11a3e9b8","sha256":"55564c1affe6974f53ba7210b26f006daeef7e8c515323bede36523f147b8a0f","sha512":"6c2301884368986161156dd4b6be7c6d6dc6c55b22c280526930fb07d8238fe600cdfd00df3072332f31f66ed77d60af87f93ef037042a75e7b65fae1d830c37","ssdeep":"192:ev+jSuA6a6Rw2A1idA4w8KHWGiHeQuXKRfjTK4lx5L/dSi/5S1tDxRkTIrMLUaP8:ecAAwydi8DG7rXKJjm4NL/n/0tDx2kr1","tlshash":"a9f1435681dd58952b8c61d16c1e3f4988befa1b0adef5c5de0ecf0966b43f78204d22","first_seen":"2026-07-13T12:28:15.125434Z","last_seen":"2026-07-13T12:31:42.484415Z","times_seen":7,"resource_available":false,"data":null}},"time_used":311,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":306,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ssl.hw301.xyz:8900/?u=https://g12b.top/\u0026p=/","fqdn":"ssl.hw301.xyz","domain":"hw301.xyz","tld":"xyz"},"ip":{"addr":"23.224.132.157","port":8900,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-13T12:28:08.269Z","timestamp":1783945688269,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"cloud.hw301.top","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 08 Jun 2026 00:00:00 GMT","end":"Wed, 23 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"67:F4:44:A8:2A:80:5A:70:54:A1:CF:76:81:D8:73:BE:07:8A:03:BF","sha256":"6D:29:23:0E:AA:5C:2D:C5:FB:64:FA:CA:EE:F0:40:A5:66:21:88:96:78:F4:E6:C3:EA:8D:6F:71:1A:2E:8A:B0"}}},"request":{"raw":"GET /?u=https://g12b.top/\u0026p=/ HTTP/1.1\r\nHost: ssl.hw301.xyz:8900\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g12b.top/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx\r\nDate: Mon, 13 Jul 2026 12:28:08 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: keep-alive\r\nLocation: https://g25j.top\r\nX-Frame-Options: DENY\r\nVary: Origin\r\nReferrer-Policy: same-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":684,"timings":{"blocked":-1,"dns":3,"connect":154,"send":0,"wait":213,"receive":0,"ssl":313},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"ssl.hw301.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/83876.1781011881923.7ce40e6b.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:10.013Z","timestamp":1783945690013,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/83876.1781011881923.7ce40e6b.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:11 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-4007d\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945691=GzNdgISsvsovXzYSHcN5Rhee8puQLKTEAva6npTyyVjGZIQFsC97lDzy7xZh8aHHWCZG5DNdAoU/YOhaMRs0XZXnWKT8yLMbiQlToexwVVB3nYw4P7RRfOdU2V1iUK9Ck3wY3AAUnsJ4SxQm58SYWz3DLpsNlJIdwsPZ5PGlvuprVHoBSSXB9TXDmJ2OBdYM\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b73024e001c\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":262269,"size_decoded":77907,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"abf84df30621edc23a82d05ff0b8a83a","sha1":"e727ad94ce5d5f5b8fabec0e0b5a966fb6e6594f","sha256":"c3b02d056ac034939c3ff75a10a2da23f5f05f96a36ca1e5cea2157ce0fe12be","sha512":"db2a2a00f51cc6f75cfcbb6d988df74403fae93255982a054710e5f87a2d8407f4f8f02fef8ef1a0e5edb289736296b2d11a3b77cad6c6d9089bb831cda45be5","ssdeep":"6144:0/rOTU2/xB0Jjytg7DiQPkcsz1aL3p2YO+WidjHrrL:0iUjytgPJPT3p2YpHrrL","tlshash":"2f442c44b291f0b8879b42f7922b4056a17f48a1308cacb4f265f990be7555c927fbfc","first_seen":"2026-06-12T19:29:57.272405Z","last_seen":"2026-07-17T12:51:05.034087Z","times_seen":617,"resource_available":true,"data":null}},"time_used":2148,"timings":{"blocked":1560,"dns":0,"connect":0,"send":0,"wait":334,"receive":254,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/05e17726b7704d539137433e80c09a7f?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.639Z","timestamp":1783945694639,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/05e17726b7704d539137433e80c09a7f?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 42078\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 80880\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"05e17726b7704d539137433e80c09a7f\"; filename*=utf-8''05e17726b7704d539137433e80c09a7f\r\nContent-Md5: rS1ybhJgx6O3R9y16y33tg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FvcvbAhyet_Q_jjZYcBzg4Ib-FP6\"\r\nLast-Modified: Mon, 06 Jul 2026 19:44:19 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: lWkF5MwM3\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: CQYAAADn-nGZj8EY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42078,"size_decoded":42834,"mime_type":"image/png","magic":"PNG image data, 242 x 242, 8-bit/color RGBA, non-interlaced","md5":"ad2d726e1260c7a3b747dcb5eb2df7b6","sha1":"f72f6c08727adfd0fe38d961c07383821bf853fa","sha256":"5e23e4dd4a30095e6a714f075982669332849af3f0f28560f7f2c49c0ddb434d","sha512":"84203b73a2b532da58f9a829d37ed1ad66449c88614afaad86d104e78a113937f20ca32b6649212deb906a546b1aeea2d4365a20e3cc104f39087e7dc6a5eae6","ssdeep":"768:jhZrKqpATN+a97y8SjpvbC+yOwe6d9JhGVySMcFy8VUjyQhz7/VcF:jhkTN+a6bCNt79PcxMcFy8VUOQ7cF","tlshash":"0513f13a4466fe29da29f0653b1f7550dda81f8b28f9364db9c88a6ca3350d7fc50c48","first_seen":"2023-10-28T07:36:03Z","last_seen":"2026-07-13T12:46:22.327576Z","times_seen":47,"resource_available":false,"data":null}},"time_used":1838,"timings":{"blocked":1382,"dns":0,"connect":0,"send":0,"wait":318,"receive":138,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_3340babe-d86d-4379-84e5-92efe2221568.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.960Z","timestamp":1783945694960,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_3340babe-d86d-4379-84e5-92efe2221568.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/22872.1781011881923.153832d9.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:10.014Z","timestamp":1783945690014,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/22872.1781011881923.153832d9.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:11 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-2679f\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945691=GzNdgISsvsovXzYSHcN5Rhee8puQLKTEAva6npTyyVjGZIQFsC97lDzy7xZh8aHHWCZG5DNdAoU/YOhaMRs0XZXnWKT8yLMbiQlToexwVVB3nYw4P7RRfOdU2V1iUK9Ck3wY3AAUnsJ4SxQm58SYWz3DLpsNlJIdwsPZ5PGlvuprVHoBSSXB9TXDmJ2OBdYM\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b730268fcb9\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":157599,"size_decoded":50860,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f9ee602f8eeb24db94a45e276eb229fd","sha1":"add3d7dea3c94842531e4e52db7b334a705c5e6b","sha256":"3d79813c4166473dcbe19eb56d456a226f183993f5aa4108a4fccae156001245","sha512":"8ad5674af4bbf338d1188a8108d0984786a4c94afddefbd592dbc428928dae301e40d4a936d73d0e29ba68989ccd13abee0988a8a6938495736115c80a53eae7","ssdeep":"3072:XHW7tB4Vgj5tNlxyU5YegxYffj7TEOiGzZl+DJVkzEcx1nKs:XHW7tBwgttXxyUtffjAGzT+DJVkzEcxF","tlshash":"21f31bd4f2c071f6475f45f2a22b0075b26f4d92318c98b0e15ba6597f21a48c7abeec","first_seen":"2026-06-12T19:29:57.267326Z","last_seen":"2026-07-17T12:51:04.996067Z","times_seen":610,"resource_available":true,"data":null}},"time_used":1985,"timings":{"blocked":1581,"dns":0,"connect":0,"send":0,"wait":321,"receive":83,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/css/home.1781011881923.38488e2a.css","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:12.589Z","timestamp":1783945692589,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /css/home.1781011881923.38488e2a.css HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:12 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-163b3\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945692=qznV/A5DkUWRxrF/GJAyyFGufA0w5Vs4TDBQUs7FGM0/2jWWcHaN/Qf3Ohf7yhgdW3iZGlOD/fyAXe/zPXkRor82XFC/wYSnF3xx0Ep8xe4qLaK7dmOsrBRoTP9JRV8qG/w12/FtPGFK5+EySGIDP/+fSLyhdRl7BuGl3ldmXJRMfEYoQsB/tKnOUbd5M/O9\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b73064023b5\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91059,"size_decoded":33286,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65528), with no line terminators","md5":"e74f15d7fec8fd844f3f07595fad8d36","sha1":"6b072e1cd8db98eabc09e33e5aaecec0fa1f385a","sha256":"e0a518c123b57bf6db4c12b779cb9414056760733b9d1d59ccd160d4ce0f08d2","sha512":"74d96ef5f45097c02d494946f446bb8a1d5fb7b89389543f9c278b5b93678e4b50e75ae534fa8ded5c2b377381acd47403d8baadcf01676bed44d997eae44d1b","ssdeep":"1536:fwRzO3RM7jufawS2d3a8WiLKbzGhbG9jpXdNdp9khN+sJ/:fBiuSJwLUK09j7p9khN+C/","tlshash":"20933b76a610253db427ca72baf05bd8b524c846d7634a3df2537e25cbc72f21236394","first_seen":"2026-06-12T19:29:57.241174Z","last_seen":"2026-07-17T12:51:05.069473Z","times_seen":580,"resource_available":false,"data":null}},"time_used":372,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":315,"receive":57,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/843e24d076864e7197f12cdd308bb349?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.638Z","timestamp":1783945694638,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/843e24d076864e7197f12cdd308bb349?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 30115\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 80880\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"843e24d076864e7197f12cdd308bb349\"; filename*=utf-8''843e24d076864e7197f12cdd308bb349\r\nContent-Md5: shkOw7/qM+NktaJ2OQsczQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FlWRoTNhjU4P164HNQqoUyAk-mqT\"\r\nLast-Modified: Mon, 06 Jul 2026 19:44:19 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: DGbgo0IQ2\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 9_MAAAB_lHCZj8EY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":30115,"size_decoded":30871,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"b2190ec3bfea33e364b5a276390b1ccd","sha1":"5591a133618d4e0fd7ae07350aa8532024fa6a93","sha256":"02fa8e553dcdc0f1f410bdc4c96dbc2da5fe1870d1f977dce49700e7a50892b0","sha512":"552388dc1cc91b16e20c83aeb55b9c578a5a3b63e1f653f53a17f0bede606ed89884343f5a2df7bad2cd8c729ba587a6d8eaba6d76341571aed254fd00a3e844","ssdeep":"768:0UYdfYjanUDiOTTNNmHLdUQPDZVvAdhlpfLtdN0XYyTw+wy:TYdfYjoUDiWmaQbmlpdI3Cy","tlshash":"4ad2f1ac94497735a43c8ab3818d7d2462ee405ceff71ebd7202dd69b930d3240c9a5e","first_seen":"2025-02-04T17:13:01.234116Z","last_seen":"2026-07-13T12:46:22.346052Z","times_seen":55,"resource_available":false,"data":null}},"time_used":1645,"timings":{"blocked":1267,"dns":0,"connect":0,"send":0,"wait":300,"receive":78,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202607/_webp_size656x884_9dd88971-fbe2-4c59-b6ed-834b4a01d4ac.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.990Z","timestamp":1783945694990,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202607/_webp_size656x884_9dd88971-fbe2-4c59-b6ed-834b4a01d4ac.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:19 GMT\r\nContent-Type: image/webp\r\nContent-Length: 43480\r\nConnection: keep-alive\r\nEtag: \"d4c1684204e7688eb1e597c220210eab\"\r\nLast-Modified: Mon, 06 Jul 2026 12:02:36 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105586\r\nCf-Cache-Status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xbgGEKsAsuiVkrn8z3oTpXnl8%2F5ccz3pBojP0sMjbN%2F76Ay4FF9hjKO9i%2F4JQLyGclpTGkavzfrmstNXlSmKGuYe%2Bb9r%2Fbsq8vPSz8s%2B9nvQ1BNdTGCbut3zKIkfyyeFUUrMMnm1rYvR5GBepXX1Ink%3D\"}]}\r\nCF-RAY: a19e37a7fae8097e-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945699=4MEiqPSe8OxMuqjLKZveDUbGED9Mvo3jTwEG5nI2R2GsBmFsb2Ea2LZ4cSajf5ZjdWZipM4lTTtxcnnFp3YhHrpEd5JqGB5AdfD1pY7l6RLd2tdtdQuP5GUr/lvKBKr79H83O6+4JFoMai8hLvCcHUKJzoh7r7ak9alQAIfeYO95g9NMuvfD8OEH79RBP7Tt\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b7320f1fcc7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43480,"size_decoded":44639,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d4c1684204e7688eb1e597c220210eab","sha1":"740bdfd6b8755abb7e48a0e1ad00cb564b6166bc","sha256":"a7adbec5ee5a7cecca8489c103edddd0ab12a5dd4fe44a55c1d3c7727e6c50af","sha512":"c430a7c8147db2a2232bb2b1fc1488c172c7fad20802427d0e99cc983f3e45c625dec5c1b9996a672cfca13bc146f1de99adb5ff2cb4b03ff142ae26923ec465","ssdeep":"768:WDe9O0nm9HMggyXN0devNsUd8uWfvlDIXojlYRSHM2btoc06i:1I0n8LN08vNsJ1fv+ElfHMU06i","tlshash":"cf1302674c8731b1f24667fc6a82333ce88159877c97a41c721c8922174af576f1f675","first_seen":"2026-07-06T14:57:55.472099Z","last_seen":"2026-07-17T12:47:21.620865Z","times_seen":147,"resource_available":false,"data":null}},"time_used":4757,"timings":{"blocked":3891,"dns":0,"connect":0,"send":0,"wait":824,"receive":42,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/11d65357eb8043f9835518d99ce1762c?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.645Z","timestamp":1783945694645,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/11d65357eb8043f9835518d99ce1762c?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 24732\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 52080\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"11d65357eb8043f9835518d99ce1762c\"; filename*=utf-8''11d65357eb8043f9835518d99ce1762c\r\nContent-Md5: MWSxGQ+sT+Jpltspc2aisg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FidDgHluJRbklDwiUZpskT5MX0SS\"\r\nLast-Modified: Tue, 07 Jul 2026 19:45:47 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: 6uLVnULxL\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: XTcAAAC5oQzLqcEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24732,"size_decoded":25488,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"3164b1190fac4fe26996db297366a2b2","sha1":"274380796e2516e4943c22519a6c913e4c5f4492","sha256":"148192df9536ed741efff2cb155c6b2ebe7be1257b5038ea1d4b516ddd233e14","sha512":"9c1ce0682ea5dfc409950c3b7946aec91d18dfb733bf789748c0d3d9a39e6fee1634ac3d6f66cff2dc4251169c911d2834906f8aadd210fc9889f2150c5c8d51","ssdeep":"384:r4mMe15WbxjECAzbBzeDOME+BwU9eyMK+DMVK8pXG5Eq72QsMajbv4sQvEd/JL92:r4Fa2jECczFyHDoJ8pWCqpIDwQ/mr","tlshash":"4db2e1e07108d3560d3934824cb9913fda39e1037da577a143bb0edf53d499faaa8e86","first_seen":"2025-02-04T17:13:01.013654Z","last_seen":"2026-07-13T19:00:13.221507Z","times_seen":41,"resource_available":false,"data":null}},"time_used":2177,"timings":{"blocked":1836,"dns":0,"connect":0,"send":0,"wait":301,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/8b939d749c6848c1bc3666f9d78afa93?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.646Z","timestamp":1783945694646,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/8b939d749c6848c1bc3666f9d78afa93?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 11610\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 52079\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"8b939d749c6848c1bc3666f9d78afa93\"; filename*=utf-8''8b939d749c6848c1bc3666f9d78afa93\r\nContent-Md5: FZtPSfBS4H3L94aQHwxsbA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Ftqn3JBBnOBMfMVLZuwhhRdcuaJe\"\r\nLast-Modified: Fri, 05 Jun 2026 11:26:56 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: PfWd3Hf0J\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: _GMAAABxUQ_LqcEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":11610,"size_decoded":12366,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"159b4f49f052e07dcbf786901f0c6c6c","sha1":"daa7dc90419ce04c7cc54b66ec2185175cb9a25e","sha256":"7faf71b67b4c67258382f4ceab697845a2adbe8416f70505d123f4ecb4002e96","sha512":"f64fa9ca528ae6fe95ade062ad87d66213da2fdf618aaddd1559a364f7206b9f7ac9f948ec3bfa8aafad62513373d6d7cc46f6803175ba9126647e7af0b83bd8","ssdeep":"192:2tCBzjd92u0WMiIpvhCRTzOP4RmDFGF4N8knhx4Eb+n0/pucwm:UCBtfMi+pCRTaP4iG/aan0/gcT","tlshash":"c932af44833531f90c465bf98e9b6524f175dcb703b3c637c63e46e99e04652ea4894f","first_seen":"2025-02-26T15:38:27.730424Z","last_seen":"2026-07-17T12:47:21.575669Z","times_seen":113,"resource_available":false,"data":null}},"time_used":2289,"timings":{"blocked":2037,"dns":0,"connect":0,"send":0,"wait":252,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/config/gd.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:09.997Z","timestamp":1783945689997,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /config/gd.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:10 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-4420\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945690=CCac8hDsrbpYykEPFN5/XPYWTARB58kum4tSQMcDgGBqScVkYn3oe/4m0/vmogS5W6NImtdm0ZkgVO8gLQdV+0/+KgBEB3CTNPGw4G1LPRVJF+txskvNjZoFK2gpIoTqf9RZij5Bjuv2eFJmCQUUphXTWUgn4xHrp85cw4fLVzkqnQCxhbRtvjVxEfqhPuy8\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b72fd4b0017\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17440,"size_decoded":5524,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"368318100a3c0f64373230a250953d5a","sha1":"6e0d91639cafd23f1b22aecee332da83c70b93ea","sha256":"dffc9b203a19b9e70363f75f737b7afe2164d6b8c045800d4dd7931d9093aff4","sha512":"91077ca792821795a816a0ee1a9cef242bf2915c02402706c7bd5c027c62f4bc52517b6a5e3db9f4b873e5a3c9d652758cc277c1f5ba07dc12e0d69b4f6e9eeb","ssdeep":"384:bJA61XVpi5LH4NmeJPXwXkQdcAwR0Nw3zzbSGwYg1C:bJA6BZX+oJjzzgY","tlshash":"80721f4d68f7905345a3b03c8bafa114b5388643181cde457e9ce394af6843d97babdc","first_seen":"2026-05-19T02:14:56.346288Z","last_seen":"2026-07-17T12:51:05.041928Z","times_seen":739,"resource_available":true,"data":null}},"time_used":627,"timings":{"blocked":-1,"dns":0,"connect":302,"send":0,"wait":330,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/chunk-common.1781011881923.b470d60e.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:10.009Z","timestamp":1783945690009,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/chunk-common.1781011881923.b470d60e.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:11 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-27606\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945691=GzNdgISsvsovXzYSHcN5Rhee8puQLKTEAva6npTyyVjGZIQFsC97lDzy7xZh8aHHWCZG5DNdAoU/YOhaMRs0XZXnWKT8yLMbiQlToexwVVB3nYw4P7RRfOdU2V1iUK9Ck3wY3AAUnsJ4SxQm58SYWz3DLpsNlJIdwsPZ5PGlvuprVHoBSSXB9TXDmJ2OBdYM\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b72ffdf2473\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":161286,"size_decoded":36940,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"08afa88982cffd7b96a2190cdafe1c42","sha1":"abb87563ff4cd658f4436118c54f3f39c08f74a4","sha256":"8673d3fc3524eb9d8b4020b3da3109aa5ab5e569ed8d0074f2b72b8643f813ae","sha512":"70c9df3dd7b3e3d41a607627c6a2750f43673649dbd55c7a56606a7d3e67382cb2991f146f7ad2359cc5ff1615f9db484b54642917150351017d0fa4385c3d2f","ssdeep":"1536:jBY8bgGcdWUa2UTY6eryXHuLmbErF/G7D1dMI59H64likx/vocGAClVbGD3tFk7u:jBYCRTY6wjFetH64liC/vocGAcgD3t","tlshash":"65f3e8c5b3a0f07e9a1ed53779331499b12f758274c87c60f1a1ade6bf1a704a436ca8","first_seen":"2026-06-12T19:29:57.317434Z","last_seen":"2026-07-17T12:51:04.984372Z","times_seen":627,"resource_available":true,"data":null}},"time_used":1629,"timings":{"blocked":938,"dns":0,"connect":0,"send":0,"wait":345,"receive":346,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/21954.1781011881923.57c97863.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:12.575Z","timestamp":1783945692575,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/21954.1781011881923.57c97863.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:12 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-a3da\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945692=qznV/A5DkUWRxrF/GJAyyFGufA0w5Vs4TDBQUs7FGM0/2jWWcHaN/Qf3Ohf7yhgdW3iZGlOD/fyAXe/zPXkRor82XFC/wYSnF3xx0Ep8xe4qLaK7dmOsrBRoTP9JRV8qG/w12/FtPGFK5+EySGIDP/+fSLyhdRl7BuGl3ldmXJRMfEYoQsB/tKnOUbd5M/O9\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b7306322477\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41946,"size_decoded":9458,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (41946), with no line terminators","md5":"35aef3c03c45b75cc6c2851265c30f23","sha1":"54874afc1d2d6391142418c6c17d7639247b6c9b","sha256":"c7a0283f3d2fde40ce97fe3bb5e79621f9939000c50c3c781a4597c3242ebae2","sha512":"f74356629d65ff26f6928ad3183ba8e6e01848921202f9c14c5aef758ef72acdcabf523209e892df42d230d9c87cb47cda7bd106105ed8447718fc502b2d71db","ssdeep":"768:U/aSfmzKrMdvf0eMQ/96loumY1PI1yBK9LudEz+yUy51y9y0yk6Dio+ILqpTeY:z81R6Ipyk6o","tlshash":"33132088fac2b06dd3eb7330857f505ae66a1dc0668c5434e260d6917e7198dc1fb9f8","first_seen":"2026-05-29T16:01:53.086335Z","last_seen":"2026-07-17T12:51:05.11082Z","times_seen":604,"resource_available":true,"data":null}},"time_used":316,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":316,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/kc523-1/sponsor/sponsor_web_3.png?1781011825626","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.326Z","timestamp":1783945693326,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_3.png?1781011825626 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:17 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68dbcacf-9faf\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945697=Y8wY1Rz8+nsWEzaT171EoSVw1V6QOLKgyV5hl0Psguoywo5vWkE+mvrqS2I5wKeOG8V6UnPoL1rn2EYkSxB1+/Gdi7ZvAW8Snric2mM/0qCL09PEwVFefWSddT9xXemyzWqK+Kc64VDD6kKv2AK5o2rKkDOM+adI4rB4P5cj8BIT5z1Iypy2zynkEKBhyWkH\r\nAge: 105953\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b7317470032\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40879,"size_decoded":41252,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"c26161f438986f6e2d677c34d653285e","sha1":"faf6c47a013a9944bb8cac197688908422992039","sha256":"58d11e173550b3420b35c4e4be3eeb76b59ac790d9fb59b535ffe55d3b470fa9","sha512":"97649de556447ef6aa6cdd7d0bec46837cfb328335daa3b862cbaa5e23ca5a8f2af296703c9e961cbad02bb797ebf1f99ced2d1d245fbbb3a428e39d26428c76","ssdeep":"768:ub+4OMIuYE3McXMuDR64Q7sRFKJdsCA1Hunj5tyKxGGTVtkDGlT2oTO:uS4OMXYODNDR6XsRFisCAk39t6oi","tlshash":"db03f108254f2d4466ec90bbc7a1e0f7ee1d103dddb7e30c35a685163e46ca559fa0e6","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-17T12:51:05.013068Z","times_seen":2040,"resource_available":false,"data":null}},"time_used":3941,"timings":{"blocked":3622,"dns":0,"connect":0,"send":0,"wait":298,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.111Z","timestamp":1783945694111,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://g25j.top\r\nXign: hTGMrepMbDb+HavZEPqBuaLP5cW2qbmZU6R8pJElNmTKlpCH+scW+9NLtFxXK98TlbuwSZk/RBHNgdv/d72GYGdEsnu7dgVclm7uMohR0aKlfB6inBSaHelBr9HDU+E44VORkmLKK3SexLAPJstGG2oJz1Dfv+tOPgiIR/kkeWU=\r\ntimestamp: 1783945694105\r\nsign: 3983h6a7j7qn2k1p\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: HQKEwmeYFSSEaBtwbDNtyDn6TxTXzDaR\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:14 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Mon, 13 Jul 2026 12:38:14 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: 224032a4e27f4dc88d0655623839165c\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945694=E8FdoxMIiXaneiIJH8nRsEj9bqanUX/19vOzGBfRqOu7uMm0tthCqIaH5Z9EhkjGEJqO+UtOPdlD7oMK9qcmOqh42CeeqaqvIh3/4bt3zisg25NE+XlC0Mz1MIdp+DjwpVUU4FMunaWp2JkDKT2fS0ptq8rNVF5M2PBBB5EW11HVWyysDG98xECmcpSkiFbC\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b730c370024\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6691,"size_decoded":7724,"mime_type":"application/json","magic":"data","md5":"833db5dc9f0f2520648866bc3323dacc","sha1":"c8bc4a2153ea167e0b32c2965c59bebcd2e2aca9","sha256":"b7d9df345ab018a9b39583c5687b176bacc4749af66571247cf2d049de4b805b","sha512":"3f0dfbe5a0afbb349d9121a148a4d634f9e845e9ed4a8c90cb41f0ca00790b0ccb0ce194744c97f989a76269177792efa9fb60f9ae2017af6d152ea91f63fe7d","ssdeep":"192:VNXaHYhsBPWN/D3xL4jiSSGv3/Y5roc/rLI4irw9bdWagTgAGa+:HqHYOPk/D3rSSGv3/Y5rTjw4dWa6Ma+","tlshash":"3822bf970b52e7a036ddd5fca1221cc12aafa2cc40bc9bd5d37480a42eae750b5cc4b5","first_seen":"2026-07-10T23:44:19.35116Z","last_seen":"2026-07-13T18:49:11.193215Z","times_seen":9,"resource_available":false,"data":null}},"time_used":371,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":371,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d9d87e71df5c4a7a82fcbe76dfa6f2dc?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.629Z","timestamp":1783945694629,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d9d87e71df5c4a7a82fcbe76dfa6f2dc?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 17930\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 3928\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"d9d87e71df5c4a7a82fcbe76dfa6f2dc\"; filename*=utf-8''d9d87e71df5c4a7a82fcbe76dfa6f2dc\r\nContent-Md5: JtWIQUOLZJ2nWMFwh85LGw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fq-pr7wd3RreMM3K0udDhrvkqSxq\"\r\nLast-Modified: Fri, 05 Jun 2026 11:28:51 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: uhlYppk3X\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: mtsAAADH_w2W1cEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17930,"size_decoded":18685,"mime_type":"image/png","magic":"PNG image data, 464 x 400, 8-bit/color RGBA, non-interlaced","md5":"26d58841438b649da758c17087ce4b1b","sha1":"afa9afbc1ddd1ade30cdcad2e74386bbe4a92c6a","sha256":"d857d22d284b433541374e657a786b9dbccc073b11eeef6b4718ae8578ca0154","sha512":"3b976daefe4d9dd380ac14bb93bb85f344bc3e32058b5df5c27fd379e27d035ed1ff84e8e66c9004f0beac75335ec1aa27ab681dcf34032fcd1c0c804b045667","ssdeep":"384:ZE46roF2yeq4xEw6DI5MUn+x7rW7Dv4b1ngK5122HIUSt16:ZE46lsDI5zn+lRb1nl5KHt16","tlshash":"9182c06a22a9bf70252dc0dc7a59dbb346505445f0bb9e3397565c032ffac0d6c610bc","first_seen":"2026-05-01T12:09:31.530522Z","last_seen":"2026-07-15T18:03:59.45748Z","times_seen":44,"resource_available":false,"data":null}},"time_used":1062,"timings":{"blocked":-1,"dns":23,"connect":255,"send":0,"wait":514,"receive":9,"ssl":261},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/b5287b19ea43429db59e05a03a9b638a?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.631Z","timestamp":1783945694631,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/b5287b19ea43429db59e05a03a9b638a?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 255958\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 2396\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"b5287b19ea43429db59e05a03a9b638a\"; filename*=utf-8''b5287b19ea43429db59e05a03a9b638a\r\nContent-Md5: 0DzY1VkYxJ9JsM3OhO9Mlg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FlLEHZv8nxvu0d-TlNVstt3cmw8r\"\r\nLast-Modified: Fri, 05 Jun 2026 11:29:00 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: lFP6c6iVw\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: LVoAAABgCL361sEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":255958,"size_decoded":256714,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"d03cd8d55918c49f49b0cdce84ef4c96","sha1":"52c41d9bfc9f1beed1df9394d56cb6dddc9b0f2b","sha256":"085d0ef7457922458df3510daa955bcee6767194328978b21394b84a6c476b2c","sha512":"57b83c319ec64bd83276c6bd2262f64ef36b40554768782118f85bdf206b57f9090780ef23abd3b0337e7b29620d1b9c6e255ae9931e614e80ac555ece0bb295","ssdeep":"6144:xZi93BBe7FwjeRyMXNNs9duQuzivA+6pGp+ScR5WBxpOq:xZiZBBe7FjZdKzJ4pI+v5WBxYq","tlshash":"9c4423cf82a69676657828eb434f6133696421c71f6de066c4793fc3c9cf6098af181b","first_seen":"2026-07-13T12:20:48.154586Z","last_seen":"2026-07-13T12:58:52.683169Z","times_seen":16,"resource_available":false,"data":null}},"time_used":1851,"timings":{"blocked":-1,"dns":21,"connect":254,"send":0,"wait":506,"receive":809,"ssl":262},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/css/index-399e2569.1781011881923.a7b0b4f4.css","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:10.002Z","timestamp":1783945690002,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /css/index-399e2569.1781011881923.a7b0b4f4.css HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:10 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-faee\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945690=CCac8hDsrbpYykEPFN5/XPYWTARB58kum4tSQMcDgGBqScVkYn3oe/4m0/vmogS5W6NImtdm0ZkgVO8gLQdV+0/+KgBEB3CTNPGw4G1LPRVJF+txskvNjZoFK2gpIoTqf9RZij5Bjuv2eFJmCQUUphXTWUgn4xHrp85cw4fLVzkqnQCxhbRtvjVxEfqhPuy8\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 028019f5b72fe7dfe37\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":64238,"size_decoded":34291,"mime_type":"text/css","magic":"ASCII text, with very long lines (64238), with no line terminators","md5":"1f30d2cd291b70a1848607e3460d9278","sha1":"e91e48518ec94fcaacf418789927f34d7527dc99","sha256":"8ce1851c7bd6e7db80ee5ee8da7a0c808f29756dda3c941bb3811dc3bd3e5afd","sha512":"3cf09b1afc740c4a219a45a233489d76587ec8bd80a57c52ab133f33fdffa8a3fe35a0a27e386270ebeaa9e86d156897e44733b8eb83ee6935fe67749c30cd0f","ssdeep":"768:E0ouVbMisnf7X8vtr9UL5srs7hAqpLe20TCKiNkZICSA2ohGyHukQ9aaV+TJtU+G:HoGws9isrQAqVe6KekWRlkQ9hf+Pe","tlshash":"c6538d3123e0286ee27b6b16ec51e659352b8602f127625af703362fc1d72f5c67b742","first_seen":"2026-03-20T12:57:26.768432Z","last_seen":"2026-07-17T12:51:04.930127Z","times_seen":1177,"resource_available":false,"data":null}},"time_used":1324,"timings":{"blocked":-1,"dns":0,"connect":292,"send":0,"wait":307,"receive":416,"ssl":309},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/kc523-1/sponsor/sponsor_web_1.png?1781011825626","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.324Z","timestamp":1783945693324,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_1.png?1781011825626 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68dbcacf-a556\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945696=r+0f956Z+TmDiOUQLZu0a/2eBiXaMlDGDrljKtw3frmnuePdFZCsh67A0toqxlD1o8H78rQNc6uRc/hS0HF+w6J9UlJi5zAC0wqT6u7hceKCl8QKLTzLJRKc8bZ/WHYQAiUrosF3UbS4xzW8QcR5dvmklpwBybIZeaeFU+NUOQdiyP8hIKI4wuI7oa1mhLch\r\nAge: 105953\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027c19f5b7315bd2ae1\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42326,"size_decoded":42417,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"e0ecbe5a9349aaa328ffd6f9515f9007","sha1":"79ebc30d345c812a3e3a122f152829d161b00a52","sha256":"452d27839b3f3f35d11c9a26f06d6cc9db56dc8c61261ee43e0512f69abf71f4","sha512":"fd322bf3ca925ce2eb45317adae1dee0f1c2e4f30035738052a97ccc054ffb576a92a46758559c8d13cff6be549caca5541d14c5692cbec2758ab2b3c7f3324a","ssdeep":"768:2o9mjFjepo5h5jLasrCO57PIrvmMOSf4t7q5bo6Wruv9CSMsfRLMD7XZ0:2ogpymTxRrwmDSM7mbo6WrutR60","tlshash":"8713f2ebe1075d80bb946c9b3925eec61da50f047bc78d68c5e055f921290bb0fa33a7","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-17T12:51:04.936914Z","times_seen":2059,"resource_available":false,"data":null}},"time_used":3628,"timings":{"blocked":3227,"dns":0,"connect":0,"send":0,"wait":330,"receive":71,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/loading.da46bff6.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.329Z","timestamp":1783945693329,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/loading.da46bff6.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:17 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-7384c\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945697=Y8wY1Rz8+nsWEzaT171EoSVw1V6QOLKgyV5hl0Psguoywo5vWkE+mvrqS2I5wKeOG8V6UnPoL1rn2EYkSxB1+/Gdi7ZvAW8Snric2mM/0qCL09PEwVFefWSddT9xXemyzWqK+Kc64VDD6kKv2AK5o2rKkDOM+adI4rB4P5cj8BIT5z1Iypy2zynkEKBhyWkH\r\nAge: 105952\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b73175423bf\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":473164,"size_decoded":468833,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"ac7ca483f10bc73cffa89f639f6ffa56","sha1":"03873b9607c635752526968af31773498d259afa","sha256":"a054b81d2850fe2da5b4f97a1c50c05ee59a24c37f1c700e5cc45fe6079598b6","sha512":"caa6b3e243f02c86ccaf71aafd0e716834a7a0cf07305c5c7cc0a1b9d637cc2802caa067b0010c7c3c064e3fe8f7881b26992f57137f98477266653342257760","ssdeep":"6144:NFoYczeWIF3Q/IUPYhuF0KX38I4z/tcKZPehCIjAl/CS+b:rLczeTUPpF083CBdeh7MlvI","tlshash":"79a423929b411988e1096432215fab4d23993b6458ab5fbf78843d88893cf059ff763f","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-07-17T12:47:21.587476Z","times_seen":1956,"resource_available":false,"data":null}},"time_used":4085,"timings":{"blocked":3633,"dns":0,"connect":0,"send":0,"wait":307,"receive":145,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/ecb/8f8306425cb6740e78b2802ff5047afa96a8ae096bee393c421cac4924db741c4a080b3f3ed2f2822673f3118bd3bae081df46a59bfce8","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.144Z","timestamp":1783945694144,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /ecb/8f8306425cb6740e78b2802ff5047afa96a8ae096bee393c421cac4924db741c4a080b3f3ed2f2822673f3118bd3bae081df46a59bfce8 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://g25j.top\r\nXign: lj9v/WM9Ch3Gv2oHMM0myJOMB5ajqN2V0LiQkYjEmIvDgrc5HtBy07rA7FpEEeJdyJIsworeK/IizaEVYEnJoZBuTZPXDgXF/vIq3POb7Q+aEEI3E9pcMdJohGJwBQSiFT1KdVsCvglS6If05XtEEPWsHFHnQye6fzOON8d1CXw=\r\ntimestamp: 1783945694142\r\nsign: b4k16335873306fa\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: HQKEwmeYFSSEaBtwbDNtyDn6TxTXzDaR\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:14 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Mon, 13 Jul 2026 12:38:14 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: 8637121a1fc64473a90474676cd2b115\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945694=E8FdoxMIiXaneiIJH8nRsEj9bqanUX/19vOzGBfRqOu7uMm0tthCqIaH5Z9EhkjGEJqO+UtOPdlD7oMK9qcmOqh42CeeqaqvIh3/4bt3zisg25NE+XlC0Mz1MIdp+DjwpVUU4FMunaWp2JkDKT2fS0ptq8rNVF5M2PBBB5EW11HVWyysDG98xECmcpSkiFbC\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b730da4247d\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13924,"size_decoded":14957,"mime_type":"application/json","magic":"data","md5":"3764ed0e4fe1fe3832578636ec158f3d","sha1":"a937c69ce90ab5ad127f190970b4b19795ffc2b2","sha256":"e76ad85c231475d7e4a6665e5c0e3963f42f7736c3d6574455c329798aba79aa","sha512":"aeab9e851b8ca5881bcb5f590de01be279e526f3c1ad445a39cd51b30202d101821065b6e374147f58e86110d564b3f4509fa36043e94d19b8064fea72ce01f9","ssdeep":"384:TQWOhUSRh0XJQP2tQLUqB/gEVLh0599hU1HO/b+uy:TAKS0ptckEBh0nfba","tlshash":"d692bf1ca217b339836789f8345145a4e56856dce9c39fc4ed3ce2b21f63138668f8d4","first_seen":"2026-07-10T23:44:19.360523Z","last_seen":"2026-07-13T18:49:11.303969Z","times_seen":9,"resource_available":false,"data":null}},"time_used":943,"timings":{"blocked":338,"dns":0,"connect":0,"send":0,"wait":605,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_95e34ac6-aa0b-4d3f-9ae0-451b7e2983d6.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.971Z","timestamp":1783945694971,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_95e34ac6-aa0b-4d3f-9ae0-451b7e2983d6.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_4d4d0270-e129-42d7-8f6f-0802c910d540.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.979Z","timestamp":1783945694979,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_4d4d0270-e129-42d7-8f6f-0802c910d540.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_e50c5112-b480-4217-95c2-f187843fa431.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.996Z","timestamp":1783945694996,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_e50c5112-b480-4217-95c2-f187843fa431.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:19 GMT\r\nContent-Type: image/webp\r\nContent-Length: 54466\r\nConnection: keep-alive\r\nEtag: \"d564e11aa2a3009b6985896da404739e\"\r\nLast-Modified: Sat, 06 Dec 2025 06:22:05 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dPZPcbHghhLBjt3UY6sQpaO8maw1NZvCqsjJQaXf7dWVEZLE5YNxiPC0q3WvVMe6N4NDNtyx3X4AK8R2Q5hwItf783vzvUq6jK%2BRtMNKbUc4PFPDfs1GYGxczuGG34fwQ8O6nkguI%2BsLZ9tAnrzOHxI%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105941\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e2efd99e34639-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945699=4MEiqPSe8OxMuqjLKZveDUbGED9Mvo3jTwEG5nI2R2GsBmFsb2Ea2LZ4cSajf5ZjdWZipM4lTTtxcnnFp3YhHrpEd5JqGB5AdfD1pY7l6RLd2tdtdQuP5GUr/lvKBKr79H83O6+4JFoMai8hLvCcHUKJzoh7r7ak9alQAIfeYO95g9NMuvfD8OEH79RBP7Tt\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b73212923c5\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54466,"size_decoded":55617,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d564e11aa2a3009b6985896da404739e","sha1":"5701d82c9e2fd24ec69db4bdc9ee3e32cffca139","sha256":"75d785fba01e17e56ae0ba404eb302e8537d3a7b7f84d11128164946a3987384","sha512":"1f6a7673f6ccb42f0f1e5135154db412145225615504419fcd52655726f8ac4c85ec419c54167c1d4e71c60cfbd30f87f7bc07d53858adb3e30e184f2fdb5623","ssdeep":"1536:+USdyAD4v4ReUeNhO2po1VPvBu3czLES5WjB6lieR:Wdym04TGeLvlQAC6geR","tlshash":"fa330269024c6463719556f833feb42aa760a7c63801a4799a8f3594fe24ce874cfd6c","first_seen":"2026-04-24T23:10:16.721458Z","last_seen":"2026-07-17T12:47:21.833463Z","times_seen":659,"resource_available":false,"data":null}},"time_used":4782,"timings":{"blocked":4462,"dns":0,"connect":0,"send":0,"wait":307,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/theme.config.ef94991b.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:10.003Z","timestamp":1783945690003,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /theme.config.ef94991b.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:10 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:10 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281706-1a62f\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945690=CCac8hDsrbpYykEPFN5/XPYWTARB58kum4tSQMcDgGBqScVkYn3oe/4m0/vmogS5W6NImtdm0ZkgVO8gLQdV+0/+KgBEB3CTNPGw4G1LPRVJF+txskvNjZoFK2gpIoTqf9RZij5Bjuv2eFJmCQUUphXTWUgn4xHrp85cw4fLVzkqnQCxhbRtvjVxEfqhPuy8\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b72fd4f0018\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":108079,"size_decoded":16737,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (38260)","md5":"90d279a2980268d2835cec593c23d286","sha1":"4374bf6da5cbdf8f025434137487bda68077cddf","sha256":"1679f19badc24dea0edab376edfb8583714645e18f705fb849037af6cf0b3ff8","sha512":"362ec1b73cebe1ad224a5b745c9ceebf2b86301deab27e35d6517d499499328b34c24d76a72e5b348d623e64a4d17bfa0ab08d2aa012f02af23c6a72df51817f","ssdeep":"1536:D2JREobVmtlIRM4Sb2mcTa2mnzyJog9CcHWHA:qEtlGu1Jnz45HT","tlshash":"c0b3bb7ae20c963a6177a8bfb46ce111d12f9c0c9b1d5fdef03e60a25710669c831de9","first_seen":"2026-06-12T19:29:57.324936Z","last_seen":"2026-07-17T12:51:04.907194Z","times_seen":635,"resource_available":true,"data":null}},"time_used":692,"timings":{"blocked":280,"dns":0,"connect":0,"send":0,"wait":330,"receive":82,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/kc523-1/sponsor/sponsor_web_2.png?1781011825626","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.325Z","timestamp":1783945693325,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_2.png?1781011825626 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68dbcacf-a049\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945696=r+0f956Z+TmDiOUQLZu0a/2eBiXaMlDGDrljKtw3frmnuePdFZCsh67A0toqxlD1o8H78rQNc6uRc/hS0HF+w6J9UlJi5zAC0wqT6u7hceKCl8QKLTzLJRKc8bZ/WHYQAiUrosF3UbS4xzW8QcR5dvmklpwBybIZeaeFU+NUOQdiyP8hIKI4wuI7oa1mhLch\r\nAge: 105953\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b73166f0031\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41033,"size_decoded":41402,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"66036fddf71ff69f45c146ca63883070","sha1":"4b3076a271d5042ef1b6cffc2ff49f421a819f08","sha256":"93c59a52fe04b0050dd4552a135177533afbe2dec54f10c516610b0dee857e0c","sha512":"29c2fc65e144e5d13c011e4897e0bdf771c7b4c249875eca4fa25589625696c71ec015e7e8ef3a5ee45f2a6ae9df3663da0bb736a6fb13c9628f0d0957827c71","ssdeep":"768:6eyNeN9huVfPKv0KhazApErcA6cFKSkS+pbTCx81TxUqIUgYWxDHc9wZGbYGniRl:6eXXh8KcQakywKK++tTCi6xD89HbxiD","tlshash":"b003f15c4c413e7777f19baae00ac84224d11fd4fdd5e3e61a8bc659a843a68bc2540e","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-17T12:51:05.087292Z","times_seen":2052,"resource_available":false,"data":null}},"time_used":3733,"timings":{"blocked":3406,"dns":0,"connect":0,"send":0,"wait":301,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/kc523-1/noData/cms_moren.png?1781011825626","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.331Z","timestamp":1783945693331,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /kc523-1/noData/cms_moren.png?1781011825626 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:17 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68dbcacf-4d14\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945697=Y8wY1Rz8+nsWEzaT171EoSVw1V6QOLKgyV5hl0Psguoywo5vWkE+mvrqS2I5wKeOG8V6UnPoL1rn2EYkSxB1+/Gdi7ZvAW8Snric2mM/0qCL09PEwVFefWSddT9xXemyzWqK+Kc64VDD6kKv2AK5o2rKkDOM+adI4rB4P5cj8BIT5z1Iypy2zynkEKBhyWkH\r\nAge: 105952\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b7318fafcc2\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19732,"size_decoded":20464,"mime_type":"image/png","magic":"PNG image data, 215 x 214, 8-bit/color RGBA, non-interlaced","md5":"f3c825751a70d4aad8da2ce57f76acf6","sha1":"732da443668abb03a79a70df2d0ea8d801158655","sha256":"c395f4c1941459ef620f6df95fabd39f9ac98e03f6a389886bf224157557ce41","sha512":"a3b3fa2a216c10d331fea4771b916825d0605b94e21ac242d152d7c5e4b984cf3baad7a3fd071dde3432162037514d756cce1a0f699baf3dc98eaf75483c91b0","ssdeep":"384:64pTwcIHFqFpIlD8SqhwFLW/na2PvyQXSOKvOi58KUezsTT5ZOon:67XlROe8WvOAPHQv","tlshash":"a592d0d8abcb6705bb132b43b941a3558e0dfd6a130b9bb131782805ee16151e8d7e3f","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-17T12:47:21.901105Z","times_seen":2008,"resource_available":false,"data":null}},"time_used":4348,"timings":{"blocked":4017,"dns":0,"connect":0,"send":0,"wait":329,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_8fe89870-1081-42db-97b7-f8272ac29ae0.jpg","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.692Z","timestamp":1783945694692,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_8fe89870-1081-42db-97b7-f8272ac29ae0.jpg HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_2a74177b-d024-4ea3-8b58-fce53f91051b.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.991Z","timestamp":1783945694991,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_2a74177b-d024-4ea3-8b58-fce53f91051b.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":65510,"size_decoded":66665,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1841972db1eb6b1b08f2b8849b98ffad","sha1":"6194c3f706be3f6aa4cf9042d0cc4b9c2a77a1a4","sha256":"0b162dd98f34fc830303fa40c47a002b14c2b6f4947a7378247db3c924bb7fac","sha512":"e9fb0eff09d46b3c88de962b1d6a020fd55f98d777e56ee4a0ac8aa615d14faa3d95de3ac35a92451ef4be5c8141532327b97c6fa95d5090aa61847b2b24d370","ssdeep":"1536:HsAMZEDXiepWzfRKc7nC3BQkbf9ptwv+AOtedy3JMw:HsAMZwMrC3BVTtAy3iw","tlshash":"5a5302765eef65629bf42eeb0331c6856fcb5a10803814b83059e1e5ee85c29f61d372","first_seen":"2026-04-24T23:10:16.852267Z","last_seen":"2026-07-17T12:47:21.626011Z","times_seen":659,"resource_available":false,"data":null}},"time_used":4660,"timings":{"blocked":3952,"dns":0,"connect":0,"send":0,"wait":402,"receive":306,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size704x442_7f760e34-ebbd-4cfc-bc28-666cc8a6234f.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.016Z","timestamp":1783945695016,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size704x442_7f760e34-ebbd-4cfc-bc28-666cc8a6234f.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 44494\r\nConnection: keep-alive\r\nEtag: \"693c20ba4107f736124e16931ead8d60\"\r\nLast-Modified: Sat, 06 Dec 2025 06:30:27 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PKgW8cRYXAZm8rycbrv5boBB%2FIsSgAk%2B%2Bp4NQPUA4r%2FuXMlMr%2BJXFQm8q49dcSaeMB8bgUhXUT0fNNtVFlQ375NYSAYBP0%2FxATrbaH73axqvFFysJ2HWmz6CW7CalC6OXz3%2ByDj1dnjEKNN7GJXDKXc%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105588\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e37a17a8b8573-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b732681fccf\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44494,"size_decoded":45655,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"693c20ba4107f736124e16931ead8d60","sha1":"6a247e864c0c0a9c40bb5be357de99524abf3e2e","sha256":"342bf65608ae9d71296ffcfbbfb4580c00ba782557c802be6496ec374d5fad11","sha512":"ae136a2a5baba143d5afd3fe4270a5ce2bd0a96655f2f56a65f2d9ea26ada4a90c63b36c96b6b79adb32dc0ac9f118040f236cfcdae958f82c05f3f600dc79da","ssdeep":"768:ssqja8OCwQkPOoS4nNgT3p8tZgn5DVWGgNS4RipleSQ6c5xlGY89B:JVQGS8A+wn5D4GgrkKKc5jGY89B","tlshash":"5a13019a26762833b187c36d0030062c1b78b89f3654c54ea4ed7924975f09ec7eca6f","first_seen":"2026-04-24T23:10:16.7563Z","last_seen":"2026-07-17T12:51:04.978678Z","times_seen":737,"resource_available":false,"data":null}},"time_used":6444,"timings":{"blocked":5828,"dns":0,"connect":0,"send":0,"wait":309,"receive":307,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/home.1781011881923.a94e73ca.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:12.592Z","timestamp":1783945692592,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/home.1781011881923.a94e73ca.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:12 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-319eb\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945692=qznV/A5DkUWRxrF/GJAyyFGufA0w5Vs4TDBQUs7FGM0/2jWWcHaN/Qf3Ohf7yhgdW3iZGlOD/fyAXe/zPXkRor82XFC/wYSnF3xx0Ep8xe4qLaK7dmOsrBRoTP9JRV8qG/w12/FtPGFK5+EySGIDP/+fSLyhdRl7BuGl3ldmXJRMfEYoQsB/tKnOUbd5M/O9\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b730643fcba\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":203243,"size_decoded":60718,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64174), with no line terminators","md5":"7ad9af47a2c0c93f65e42ff84b45dad7","sha1":"eed3b4bd1191c75416f457ee41317595880f8635","sha256":"c9d64aef33c7a35945a5963b08b2bc3157f403dc91a5c9c9463c82a0d4075af6","sha512":"757a63f9b96bc8a36491424f8e0ae9fd6813983817ab2da87bb3455e18b5cb5f71d5e682919941194e4a588bea925c790888e4d27f8531ee03c777c1e2c92678","ssdeep":"3072:T5daS9tSIMcewi8uJBuoMfqFf2GMkvVJuhxffj7TEOiGRlc:T5ES9tSIMcewiLQqFRmzffjAGHc","tlshash":"93141880b5f0e275575fc2a7d7371025b2271786d0ccac60e1f66b187e2879ab236db8","first_seen":"2026-06-12T19:29:57.277471Z","last_seen":"2026-07-17T12:51:04.963206Z","times_seen":580,"resource_available":true,"data":null}},"time_used":419,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":305,"receive":114,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/60024.1781011881923.e9a203dc.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.066Z","timestamp":1783945693066,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/60024.1781011881923.e9a203dc.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:13 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-11f9\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945693=73ZApDHt8ncnojFO9uRQaPhNZJ5tRe18RjCXPKXkWXxespjhHpCwLtBaszC+J/q8xLlbRcE3PMKSZdsJF5yW7kWOWJBcdABsf5O3MBD+NHHscog80WgEiTB/vuYo3smoMZYOSQoRe0+HHAG7/mIUHYrVbUjzGWa32+eteBkKxvdZO1+4NR+r30WPC+J5bmLn\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 028019f5b730880fe50\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4601,"size_decoded":2490,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4601), with no line terminators","md5":"ac04ba4305a374571b2d241fe1f50dc2","sha1":"e559b9a0a338e35fb6605942f7d14e96c031ae71","sha256":"788282499d13bd0bb6207ed41a15a3d0b2058ca97003d1e1a872e81401f02aa7","sha512":"6edc613a3f8585bf6cfb8c034199265c1c1daf368d0d3a6e2c41bf441a334a7f93139c0b0fb4147b98264567be9b135fab3cbe923e8fe040ec553e9fec04c8ae","ssdeep":"96:UR4NFRSZqe65bD7RM/Rsxkw9usN6tKex9sX2NaenPdqUDDEz:UR4NFRSZqesbD6Rgks0RxeX2NbnPdqUE","tlshash":"3491cbd876d2f071426f9678862f285fe27bead074ccb415d1c1e690aef062d8933d68","first_seen":"2026-06-12T19:29:57.341024Z","last_seen":"2026-07-17T12:51:04.974081Z","times_seen":576,"resource_available":true,"data":null}},"time_used":494,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":494,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/83749.1781011881923.02b71cf6.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.177Z","timestamp":1783945693177,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/83749.1781011881923.02b71cf6.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:13 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-16665\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945693=73ZApDHt8ncnojFO9uRQaPhNZJ5tRe18RjCXPKXkWXxespjhHpCwLtBaszC+J/q8xLlbRcE3PMKSZdsJF5yW7kWOWJBcdABsf5O3MBD+NHHscog80WgEiTB/vuYo3smoMZYOSQoRe0+HHAG7/mIUHYrVbUjzGWa32+eteBkKxvdZO1+4NR+r30WPC+J5bmLn\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027f19f5b7308ed14b2\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91749,"size_decoded":29137,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64016), with no line terminators","md5":"c1d2645de169d30e7a814fdbd1c1a47d","sha1":"41959bb5171f196d813c4b3c27bb3135d993ff43","sha256":"a400126839acc7fff4ce08e50633afc5560f3eb3e8aae7ec697fff30423bd26a","sha512":"21e02eeba3e71baf0938766c7abf83b68a4f54b149ea679f43c221c429729dacd395ed0e54233ff22be739636dcaf0104cd58083c50df9b6c521fcb2c3e27419","ssdeep":"1536:lcK/KnqHB3vmxuHXvKe+Gruc7iSxTcgOX8JwTl0sI5pQiVFFsdt+H+Xk:rB3vywXSex7HYgOXawTl0sgQi2tkwk","tlshash":"3693e7c4b5f4f5f8279ec5a2973644b8b02527c5b1c8ace0d2e96e147f19b62b0718bc","first_seen":"2026-06-12T19:29:57.252198Z","last_seen":"2026-07-17T12:51:04.936312Z","times_seen":574,"resource_available":true,"data":null}},"time_used":799,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":454,"receive":345,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/license.ea57c78d.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.286Z","timestamp":1783945693286,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/license.ea57c78d.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-7b8\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nAge: 105652\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b731195002a\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1976,"size_decoded":2702,"mime_type":"image/png","magic":"PNG image data, 161 x 52, 4-bit colormap, non-interlaced","md5":"60a2c7c150b01809fbb7b97932684b5b","sha1":"67fc9647c452a17b519c6a51dc8c38daa23755f9","sha256":"c5ce31558a1f979ae78c7779d2f312b196750375541e9c147b73d6e44d47c276","sha512":"2328442fa1c74e47c6eff4adab55920c7e7738e7ae51bd2b222fb696bbcf8201a14805089a33baa80c28a40db47061048d817c384bd72735b2e0c0116ff63c6f","ssdeep":"","tlshash":"b3412a6266729beced1a8c47592c7df1d8338ca1a200e1c150ed761f1bf8e1060e7a94","first_seen":"2025-08-29T11:05:53.23289Z","last_seen":"2026-07-17T12:51:05.056374Z","times_seen":2089,"resource_available":false,"data":null}},"time_used":2489,"timings":{"blocked":2200,"dns":0,"connect":0,"send":0,"wait":289,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_f0f83841-a720-4f18-8acd-c726f4c1e685.jpg","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.695Z","timestamp":1783945694695,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_f0f83841-a720-4f18-8acd-c726f4c1e685.jpg HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_50b16c20-cbfb-4c4c-ba8a-249055c85af3.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.983Z","timestamp":1783945694983,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_50b16c20-cbfb-4c4c-ba8a-249055c85af3.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_04beb05f-bdcc-4bf4-a35f-b560e45e45b0.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.001Z","timestamp":1783945695001,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_04beb05f-bdcc-4bf4-a35f-b560e45e45b0.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:19 GMT\r\nContent-Type: image/webp\r\nContent-Length: 73676\r\nConnection: keep-alive\r\nEtag: \"41e79b39dc26bbaf7f40e04fea71c634\"\r\nLast-Modified: Wed, 10 Dec 2025 11:53:06 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d0B0nlvQqZ7mLv57LSSMVswojjmWH9uOYt2vO3ztPxoDW2RUngIYK2XF%2FqeUCSg%2FG0rbPWf3D3e2eXUYBP2bl9rEDx04b28W%2FYEP6NGWF8a3lA%2FvrPygGJDRSxBkJLUMpuz9wUA0UCMjHmia%2FXhi8NI%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105654\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e35f998f01372-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945699=4MEiqPSe8OxMuqjLKZveDUbGED9Mvo3jTwEG5nI2R2GsBmFsb2Ea2LZ4cSajf5ZjdWZipM4lTTtxcnnFp3YhHrpEd5JqGB5AdfD1pY7l6RLd2tdtdQuP5GUr/lvKBKr79H83O6+4JFoMai8hLvCcHUKJzoh7r7ak9alQAIfeYO95g9NMuvfD8OEH79RBP7Tt\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b7322640040\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73676,"size_decoded":74833,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"41e79b39dc26bbaf7f40e04fea71c634","sha1":"477586286821f2dab7b013e04ff4921b7719f121","sha256":"a6091cb61f7968a02345dfef2905c4f62f401345fb3fd5d2bdf5306416b50d90","sha512":"5fd2068c26d3d5e6995cbe847edecc9145c7abcdfee76ed94e1db9b97da7abb651e8dc990d06f05d2bc9b04cfbaa5c9cb41fa32da479554d64e47eb91e01fe56","ssdeep":"1536:Dsmee6MaqRp352dNFckeb6yTb6Kpmd4xIccPip688s23Z72HuJjJrl:gEaqRfoeb6yTb6KsdiIccuE3Rfrl","tlshash":"c7730143ccff7298de2c687e0d5e0caa191442443f8c0ab3e6e5615571697af36b32b8","first_seen":"2026-04-24T23:10:16.752534Z","last_seen":"2026-07-17T12:47:21.790198Z","times_seen":659,"resource_available":false,"data":null}},"time_used":5119,"timings":{"blocked":4776,"dns":0,"connect":0,"send":0,"wait":298,"receive":45,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_aa2a4724-288d-4252-82c6-453d0458d8c1.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.002Z","timestamp":1783945695002,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_aa2a4724-288d-4252-82c6-453d0458d8c1.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:19 GMT\r\nContent-Type: image/webp\r\nContent-Length: 49050\r\nConnection: keep-alive\r\nEtag: \"bb2aa8a4e812ea372888371e3493b542\"\r\nLast-Modified: Wed, 10 Dec 2025 11:52:08 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4kEa4kB3HyMKXSR0f3quJNBekAziqbde4oqyfdqGnCKP4ewDi7HPQbVsLecF3gJN06vMgk8SUlDvPUcIiALzai8MGDYsCf3qW1LuGZ5%2BCp6ZXwCvt3Yv6kvzELweBy7QXx9OjCeQ3%2Fh4tYrNvG%2FkUUY%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105656\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e35f29eee2112-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945699=4MEiqPSe8OxMuqjLKZveDUbGED9Mvo3jTwEG5nI2R2GsBmFsb2Ea2LZ4cSajf5ZjdWZipM4lTTtxcnnFp3YhHrpEd5JqGB5AdfD1pY7l6RLd2tdtdQuP5GUr/lvKBKr79H83O6+4JFoMai8hLvCcHUKJzoh7r7ak9alQAIfeYO95g9NMuvfD8OEH79RBP7Tt\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b73226923c7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":49050,"size_decoded":50203,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bb2aa8a4e812ea372888371e3493b542","sha1":"4a36a3e778cd1cfaa8cbecc34e70d024963106a5","sha256":"fe97bdaee3660ca686cab03b1ef7af16d387780811e739ac2271082c7d4bb489","sha512":"f5ffb0368751705c8584d3a6bafa79c865cf33c0d4d8e58f06404807864ceefc41d20cd1162c01b17afcbc438a2fb2ed4f92b8f80938387b012bdd10e0ff2302","ssdeep":"768:6UQ6Jz2sCQ6dza0R/4YUaVSjgKLnkBM/jScHyXLEcDs5Op2jbOKz6im:tD5rCRNa0R2aOgKzkKucHybEcLKwl","tlshash":"2323f1d8f25dd108f9c51d3e9ebe898e6cbaeded3ec998c6224cd81c041494678d6623","first_seen":"2026-04-24T23:10:16.759919Z","last_seen":"2026-07-17T12:47:21.926715Z","times_seen":683,"resource_available":false,"data":null}},"time_used":5100,"timings":{"blocked":4782,"dns":0,"connect":0,"send":0,"wait":307,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/heying.d446c85d.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.322Z","timestamp":1783945693322,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/heying.d446c85d.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-591\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945696=r+0f956Z+TmDiOUQLZu0a/2eBiXaMlDGDrljKtw3frmnuePdFZCsh67A0toqxlD1o8H78rQNc6uRc/hS0HF+w6J9UlJi5zAC0wqT6u7hceKCl8QKLTzLJRKc8bZ/WHYQAiUrosF3UbS4xzW8QcR5dvmklpwBybIZeaeFU+NUOQdiyP8hIKI4wuI7oa1mhLch\r\nAge: 105951\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b73154d0030\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1425,"size_decoded":2156,"mime_type":"image/png","magic":"PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced","md5":"c0d0c516850381dd1ca39dd94b08f21b","sha1":"54522affec52debd9c0bd3784f0ce9bf692f5d6d","sha256":"301cbb9a8c3fae88d732c8b8fdfe40113e3257831d37150e95564cc0f9b8fbe7","sha512":"6d6b1263f2de2b35237c784fd0aa127c469f8b6ebf347ff1987d791611d5b36f0909f3a81f9db6b1571756ecae60454d854e776e5ed782acbdfcce4fda2b9c86","ssdeep":"","tlshash":"dd213b5023742cd0e8ae3457ef12e5fdb823417994f8dd0c99b9bc3e84908b1057a48e","first_seen":"2025-09-04T00:49:32.953523Z","last_seen":"2026-07-17T12:51:04.92397Z","times_seen":1986,"resource_available":false,"data":null}},"time_used":3405,"timings":{"blocked":3116,"dns":0,"connect":0,"send":0,"wait":289,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_f0600e57-43d6-4af4-8f1c-08ad10ecab8d.jpg","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.691Z","timestamp":1783945694691,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_f0600e57-43d6-4af4-8f1c-08ad10ecab8d.jpg HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:17 GMT\r\nContent-Type: image/webp\r\nContent-Length: 35520\r\nConnection: keep-alive\r\nEtag: \"cd3987864cb3f095323f43e0248e2180\"\r\nLast-Modified: Wed, 10 Dec 2025 10:48:07 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B89vLKPjqvcdfQ0daKKt9hhNZbj8aRKZAdZf9YHFNvzsxWAFZVoz%2FiK5PX9QnAZZxlKx3UYqgINRHPncOHmRWauels4uV8%2FZlqpIf8tIhvUg0%2BcvP4Gj5XlzLWMGMbbnICcj2A57j8NN4lxD8ou%2F0sg%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105947\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e2ec9eb87b9c5-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945697=Y8wY1Rz8+nsWEzaT171EoSVw1V6QOLKgyV5hl0Psguoywo5vWkE+mvrqS2I5wKeOG8V6UnPoL1rn2EYkSxB1+/Gdi7ZvAW8Snric2mM/0qCL09PEwVFefWSddT9xXemyzWqK+Kc64VDD6kKv2AK5o2rKkDOM+adI4rB4P5cj8BIT5z1Iypy2zynkEKBhyWkH\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b73190c0035\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/webp","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/ESPORT.4f4b51d4.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.900Z","timestamp":1783945694900,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/ESPORT.4f4b51d4.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-101b0\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nAge: 105584\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b731241002b\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65968,"size_decoded":66691,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"29610094acb703084f79c42c17547a7c","sha1":"3c824ba387e36bcce1a5f1d0d14b513fb278db9d","sha256":"8c3dc9ee49224eff4a37ec488ff0a413f3150ec7a62640a466a802750a573146","sha512":"db986acc62bb0d35583a1c298b468e1fa7869269c738eadc82b944b1a8f9b2c0723087db8a065d60495938e834337e72e3c438089d1d02ff90f4983e0d6461fb","ssdeep":"1536:ObUUUNbT8bJcHe4DyC8KLT/KKeRfm4AH7XAlzS7M2Z:rbgNcHwE/eshbE/2Z","tlshash":"b25302e1df60cb022efe65ca89acf12ae204a0a61476453f7a231d6f3744016af973c4","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-17T12:50:21.083954Z","times_seen":2021,"resource_available":false,"data":null}},"time_used":1133,"timings":{"blocked":760,"dns":0,"connect":0,"send":0,"wait":304,"receive":69,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_b0506ddf-52e0-4b2d-8f59-16f795505312.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.994Z","timestamp":1783945694994,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_b0506ddf-52e0-4b2d-8f59-16f795505312.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:19 GMT\r\nContent-Type: image/webp\r\nContent-Length: 47302\r\nConnection: keep-alive\r\nEtag: \"69bae2574526d5faae2cab421295d6fb\"\r\nLast-Modified: Sat, 06 Dec 2025 06:22:22 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105941\r\nCf-Cache-Status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tNIMIt0qLvVj%2FaFvadPfmkSGl7eqU4fJn4Frey1nXG79w6Ue3c1sXncJHL%2F81Y2d2L0am46qlFSZWdmy6WAB4Ihn13PBwd2rp8vOY78ZQjp5S56ksUFxTckxQjue%2F1137k82knhVwxGo8%2F7DIfjnADc%3D\"}]}\r\nCF-RAY: a19e2efc3bb85098-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945699=4MEiqPSe8OxMuqjLKZveDUbGED9Mvo3jTwEG5nI2R2GsBmFsb2Ea2LZ4cSajf5ZjdWZipM4lTTtxcnnFp3YhHrpEd5JqGB5AdfD1pY7l6RLd2tdtdQuP5GUr/lvKBKr79H83O6+4JFoMai8hLvCcHUKJzoh7r7ak9alQAIfeYO95g9NMuvfD8OEH79RBP7Tt\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b73201b003e\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":47302,"size_decoded":48457,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"69bae2574526d5faae2cab421295d6fb","sha1":"9fbb080feb70d0129b259ee1836a307e2f43a7a7","sha256":"24dc34c37f47f8b318cd186472dfb0aba29bc601bb589497d9131322abf3f12f","sha512":"b6b43f6f2a27bf41323dab6e956cf9e581be28a51078e3ec6568b79a145135dba1644d3e3b8e0a5bb8e7c8fdc132ea34c5002e2c81fa15a9e29e581767b9ad00","ssdeep":"768:3ZnM3sRPLsymAdeJz26xNEyuGpVt/5NS6xUdP8Hx3JZa1pASN7ZWjcTH:JnusBypuGLZnStl8HcjASN7ZW","tlshash":"6223f2c4856c2f711255d3f8ffa06b48c6783940bff8afb69f360a65186d2d2c90a44e","first_seen":"2026-04-24T23:10:16.805393Z","last_seen":"2026-07-17T12:47:21.789463Z","times_seen":653,"resource_available":false,"data":null}},"time_used":4777,"timings":{"blocked":4163,"dns":0,"connect":0,"send":0,"wait":614,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202603/_webp_size1080x1196_b15d1708-bfce-458e-bd99-5bc1134b7122.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.102Z","timestamp":1783945695102,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202603/_webp_size1080x1196_b15d1708-bfce-458e-bd99-5bc1134b7122.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:17 GMT\r\nContent-Type: image/webp\r\nContent-Length: 48628\r\nConnection: keep-alive\r\nEtag: \"170614bf75e281d0f05503cdeab75a59\"\r\nLast-Modified: Thu, 19 Mar 2026 14:50:59 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rZit%2FlV4oWv%2BsR9u4ajIHYiKBBE02gpgQxMpwFkZz%2F12eZN8UD1QrRiOjiEoLNuX3%2B78vRlAtO91RWLJcZnt8Q2SoYIjKI42yCvF6Q6puyX2G8h%2FSiS0Th3eIh%2F4JcWhKf8BeAv0VhZA6DOxPChLIyU%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 106314\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e25d07b7206b9-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945697=Y8wY1Rz8+nsWEzaT171EoSVw1V6QOLKgyV5hl0Psguoywo5vWkE+mvrqS2I5wKeOG8V6UnPoL1rn2EYkSxB1+/Gdi7ZvAW8Snric2mM/0qCL09PEwVFefWSddT9xXemyzWqK+Kc64VDD6kKv2AK5o2rKkDOM+adI4rB4P5cj8BIT5z1Iypy2zynkEKBhyWkH\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b73179efcc1\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48628,"size_decoded":49787,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x1196, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"170614bf75e281d0f05503cdeab75a59","sha1":"32025008b56adf94f2a64724f1b00f55939db943","sha256":"010f104d5782b172955179537b5945b89f7a5ac32185a63d67ea5405d5c13733","sha512":"e11fa01405248d40ad8f95f335734207193356f418418955cafc6ebdfa04f5a08d8e304d23c34b211fd9dc7cdab36710694ccd0585c79778a156bf214750346a","ssdeep":"768:tk9BmrgO1s4wjUc8pqYtHwHGvhSgV1iCdmcmxWSqZA16T2rrKhv0cQ6ZQOc4vS9P:tkbmrgO1srjUtkEn5LTdmcmxnqC0aKhm","tlshash":"4223f124d4de0cda1978e776f637574cdb8b325fabc4601f82c9499f800ab04c6628ee","first_seen":"2026-03-20T12:57:26.684793Z","last_seen":"2026-07-17T12:37:28.413999Z","times_seen":774,"resource_available":false,"data":null}},"time_used":2246,"timings":{"blocked":1934,"dns":0,"connect":0,"send":0,"wait":295,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/chunk-init-1656f0b4.1781011881923.32336986.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:10.008Z","timestamp":1783945690008,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/chunk-init-1656f0b4.1781011881923.32336986.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:11 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-21366\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945691=GzNdgISsvsovXzYSHcN5Rhee8puQLKTEAva6npTyyVjGZIQFsC97lDzy7xZh8aHHWCZG5DNdAoU/YOhaMRs0XZXnWKT8yLMbiQlToexwVVB3nYw4P7RRfOdU2V1iUK9Ck3wY3AAUnsJ4SxQm58SYWz3DLpsNlJIdwsPZ5PGlvuprVHoBSSXB9TXDmJ2OBdYM\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b72ff98001a\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136038,"size_decoded":38262,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (44088)","md5":"149a9a32eef525724cd200e4dce7a032","sha1":"29b091925cae6d90319391653e40685f6e6c5735","sha256":"10fcb7c4e44a141964cb31c527462c6e56f78d95c956fb02c50c61fc576cefd2","sha512":"62d80403786c13019e86e1c6b991d73cf52ff5bd25d4eeaec34ca12125d677604a269fc6c56ef301f074c42798f8e7935df623d6a0a62559d70749e53082085f","ssdeep":"1536:z2twqIPBoVbzfsO9ZuqpiXXIOU6Qgpp6KkB2EnBDsAxdrkm4SgiqvHynjM5TCif9:z2twqhOIK2nCLdyACifMur06/D","tlshash":"6dd3ec54b7d0b4b442cf13e6711b2475e3a61ca22058e8f0e31dee647f35689d26faac","first_seen":"2026-06-12T19:29:57.333908Z","last_seen":"2026-07-17T12:51:05.018981Z","times_seen":628,"resource_available":true,"data":null}},"time_used":1445,"timings":{"blocked":867,"dns":0,"connect":0,"send":0,"wait":304,"receive":274,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/index-a3dad144.1781011881923.1093b11d.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:10.015Z","timestamp":1783945690015,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/index-a3dad144.1781011881923.1093b11d.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:11 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-570e8\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945691=GzNdgISsvsovXzYSHcN5Rhee8puQLKTEAva6npTyyVjGZIQFsC97lDzy7xZh8aHHWCZG5DNdAoU/YOhaMRs0XZXnWKT8yLMbiQlToexwVVB3nYw4P7RRfOdU2V1iUK9Ck3wY3AAUnsJ4SxQm58SYWz3DLpsNlJIdwsPZ5PGlvuprVHoBSSXB9TXDmJ2OBdYM\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b7302922475\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":356584,"size_decoded":117591,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64562), with no line terminators","md5":"0fc0f4a0379e369b442d93ffb72561fd","sha1":"497d95fced30bab2efe9ad3a561c35cd40ad5e9c","sha256":"da926a537d946d3158d41a8531082a740aec7a6a4e3b98599d35546182f20806","sha512":"ef5664991d7fb472281b2696b3b25a322bf51f9bcbccf2043f77fdb67ca9a84d90b893029e93bedea935724bbc4b58a77154b35ac40b15f8e691b539cc3102e3","ssdeep":"6144:LrbhFOufhu/LHEY/T8CPis7lVV4YlRlNsmq9D7:3zBw/LHEY/TBas7lVVhsp9X","tlshash":"ed742b90f76ce1bd875e55ff7a329094902c1b41b0c89e58d29e2944fe6b385eeb04bc","first_seen":"2026-06-12T19:29:57.253128Z","last_seen":"2026-07-17T12:51:05.045354Z","times_seen":597,"resource_available":true,"data":null}},"time_used":2465,"timings":{"blocked":1629,"dns":0,"connect":0,"send":0,"wait":312,"receive":524,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/f33c5d379f0c49559576dad26a6b9167?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.652Z","timestamp":1783945694652,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/f33c5d379f0c49559576dad26a6b9167?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:17 GMT\r\nContent-Type: image/png\r\nContent-Length: 27726\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 3179\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"f33c5d379f0c49559576dad26a6b9167\"; filename*=utf-8''f33c5d379f0c49559576dad26a6b9167\r\nContent-Md5: uS19IKsxmofEQxS/d58Rmw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FgM8WoddJSJhpAbBJijqIdeXScF8\"\r\nLast-Modified: Fri, 05 Jun 2026 11:28:29 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 6OIcfUFP7\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: SWUAAABFkdpE1sEY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27726,"size_decoded":28481,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"b92d7d20ab319a87c44314bf779f119b","sha1":"033c5a875d252261a406c12628ea21d79749c17c","sha256":"489cbd723256fb665e160db96761a3095fd9bbe21c29049adb21a64c7cfa8f3f","sha512":"a77f984a96b09acbcd3659ae7569ddbdef794c78d5cdaa392447dce0fa3e7a6e0254349c058f295463088b1fe45fa6fc984496864de283692171648b75649f80","ssdeep":"768:hexKfZi/N1Dcdeabcun13eOffsQCQ/5t8XBhe2fWtjzY+cZ:oKfZs1ScQ13DcA8XXBfU3M","tlshash":"eac2e1396c58ade49794058826a73fd3b4f1e283cdf81f4326763027808d6fd56b4ac0","first_seen":"2023-05-19T01:28:08Z","last_seen":"2026-07-17T12:51:05.020569Z","times_seen":378,"resource_available":false,"data":null}},"time_used":2689,"timings":{"blocked":2374,"dns":0,"connect":0,"send":0,"wait":276,"receive":39,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/home-bg.1e09954b.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.657Z","timestamp":1783945694657,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/home-bg.1e09954b.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g25j.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:10 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281706-fae\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nAge: 105947\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b730f410026\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4014,"size_decoded":4740,"mime_type":"image/png","magic":"PNG image data, 278 x 80, 8-bit colormap, non-interlaced","md5":"ed0eb6c81f949885511fbbe4d666a2f0","sha1":"d74fb98c3b01727753bb182eb5ee5d6eedf3da4a","sha256":"7fecf4ed61ab1535aafe2800474ac643b49264b83f54fc1da596d7334868ae75","sha512":"dd2f749e24e6b35f80fa77856c9c8b1cb1e0cacb9250b947403283e152d8bb9e7bf539df00ca6743d4162aeac014e47ce82191b62847fabe6cbb5693b4cd7fec","ssdeep":"","tlshash":"1a816c7eb31a4997296ff194138b387d74b0709d0b546934388a9c31a4791fcf39e526","first_seen":"2025-08-29T11:05:53.155399Z","last_seen":"2026-07-17T12:32:49.779347Z","times_seen":2034,"resource_available":false,"data":null}},"time_used":522,"timings":{"blocked":232,"dns":0,"connect":0,"send":0,"wait":290,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/kc523-1/noData/cms_noimg.png?1781011825626","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.664Z","timestamp":1783945694664,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /kc523-1/noData/cms_noimg.png?1781011825626 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:17 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68dbcacf-269a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945697=Y8wY1Rz8+nsWEzaT171EoSVw1V6QOLKgyV5hl0Psguoywo5vWkE+mvrqS2I5wKeOG8V6UnPoL1rn2EYkSxB1+/Gdi7ZvAW8Snric2mM/0qCL09PEwVFefWSddT9xXemyzWqK+Kc64VDD6kKv2AK5o2rKkDOM+adI4rB4P5cj8BIT5z1Iypy2zynkEKBhyWkH\r\nAge: 105948\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027c19f5b73174d2ae4\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9882,"size_decoded":4614,"mime_type":"image/png","magic":"PNG image data, 1920 x 700, 8-bit/color RGBA, non-interlaced","md5":"85e60fd8767b18839ffb552a5d543f8a","sha1":"341cfd68a5b39cb246af6ade1e3171c857d2df5a","sha256":"4b7ad68306ffac25830d1016ba86154890deef8bd77a03257b767b37de1c8338","sha512":"785f028aab80d3f96794431f84025483f490d7d642022404a7b14ccb4785aa52fe4a21048d44acda3bd160eedeaccfb4959a677986dfe47ef038d80724f2acb2","ssdeep":"96:74iGykVWI7TGvGJUgTFSebsBzYofEC16+TqBK7R7LWKaR8a8D7uZNgAMXFL73:74iyHunEFSebsvP1nTP7IF2uAAMX5","tlshash":"141259118573d43cd82ce57926df6fb93b709f996890476e8328e7342f2a2f78d60848","first_seen":"2023-05-01T09:33:58Z","last_seen":"2026-07-17T12:37:28.599508Z","times_seen":2847,"resource_available":false,"data":null}},"time_used":2589,"timings":{"blocked":2291,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/js/45540.1781011881923.25dfba7d.js","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:10.010Z","timestamp":1783945690010,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /js/45540.1781011881923.25dfba7d.js HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:11 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-37ff6\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945691=GzNdgISsvsovXzYSHcN5Rhee8puQLKTEAva6npTyyVjGZIQFsC97lDzy7xZh8aHHWCZG5DNdAoU/YOhaMRs0XZXnWKT8yLMbiQlToexwVVB3nYw4P7RRfOdU2V1iUK9Ck3wY3AAUnsJ4SxQm58SYWz3DLpsNlJIdwsPZ5PGlvuprVHoBSSXB9TXDmJ2OBdYM\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 028019f5b730151fe3e\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":229366,"size_decoded":65835,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"7983a109fba451279f84fe7b75724983","sha1":"9487dc955240c6083cf3497e806dff89bec2061f","sha256":"80bb5c781336a9095ee3e8ae99d724f58a409c7f3c159bf0f320a9c948afe030","sha512":"ddf49f5cfb4721100ef951228391607209e248a8733d48229ff5196fd8a32fc3e759d90c1040dd591b1c0bd97ab83a1c8baaffa70fa96bbe2d556af2379478b0","ssdeep":"6144:1YD4wFsYiSGfKnCKPP6Xm9sm3MCln1OSgpozfEe5a:1YD4wFsYiSAKNH3TY5","tlshash":"e724f894f294f1be075fc1f1d23b501af35b5e6120cc9ca0d296e6942e20b49da77eac","first_seen":"2026-06-12T19:29:57.328205Z","last_seen":"2026-07-17T12:51:04.995275Z","times_seen":625,"resource_available":true,"data":null}},"time_used":1950,"timings":{"blocked":1308,"dns":0,"connect":0,"send":0,"wait":363,"receive":279,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/css/60024.1781011881923.0ab0fca2.css","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.065Z","timestamp":1783945693065,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /css/60024.1781011881923.0ab0fca2.css HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:13 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-1439\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945693=73ZApDHt8ncnojFO9uRQaPhNZJ5tRe18RjCXPKXkWXxespjhHpCwLtBaszC+J/q8xLlbRcE3PMKSZdsJF5yW7kWOWJBcdABsf5O3MBD+NHHscog80WgEiTB/vuYo3smoMZYOSQoRe0+HHAG7/mIUHYrVbUjzGWa32+eteBkKxvdZO1+4NR+r30WPC+J5bmLn\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b73087f001e\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5177,"size_decoded":1961,"mime_type":"text/css","magic":"ASCII text, with very long lines (5177), with no line terminators","md5":"a0ef4268641ef0b005737ce8cc0c4b44","sha1":"9bb50b9000a419e7a701392b0d7d6c992cf585bb","sha256":"f64c7a7e6ecd620d1c7f8cc67e1eda83a0a115a8d86f3954efdaba3c09d62e66","sha512":"07605ebd7e16aef28f0ad5ed406f29ea9b77e8ba6b2079c810aacf8faf0b4a8d18d4f7775c62860cbf6d4379729a60076103a4daa833c860ddebeee3793ccbe2","ssdeep":"48:ZSPkOO2s2L5Pukasq+nArLkrL4QuQKhUjUkM5P6CdRDRWURcWaTHR/:iOvyP2r4rEDFP61LR/","tlshash":"d1b1412f01703349641bad6807dc67098325d8b399eb37da259d2a0dcbc3f861eb718b","first_seen":"2025-06-26T16:31:28.933081Z","last_seen":"2026-07-17T12:51:05.000466Z","times_seen":3240,"resource_available":false,"data":null}},"time_used":488,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":486,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/vs.21f89f73.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.658Z","timestamp":1783945694658,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/vs.21f89f73.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g25j.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:10 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281706-51a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nAge: 105945\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b730f4123ba\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1306,"size_decoded":2037,"mime_type":"image/png","magic":"PNG image data, 70 x 28, 8-bit colormap, non-interlaced","md5":"41cff06a80e61ee3fcd32f7c29a6493e","sha1":"bb70bb0a3a0fde7a132788777aee629392c756e9","sha256":"3240fcea2e4168dc863b8aea602750e6a1fe11a557c18ac6a381781ef487746b","sha512":"fce7ff9f62b51c4f8994f0a8ec4a56f21570d0cd163471d99b357eb0a9a735c800b389c4a8a611ba441b208cea7eb483140042f5d11ef110b591c1c1898bbb8d","ssdeep":"","tlshash":"e921eaffe15b2c75ccb59bb3bc6c12656809582970866b137125e7588c539217f0c461","first_seen":"2025-08-29T11:05:53.184813Z","last_seen":"2026-07-17T12:41:27.27405Z","times_seen":2025,"resource_available":false,"data":null}},"time_used":535,"timings":{"blocked":232,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202506/_webp_size1260x1156_03543abb-5967-4969-b0c5-87347b24c4d6.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.955Z","timestamp":1783945694955,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202506/_webp_size1260x1156_03543abb-5967-4969-b0c5-87347b24c4d6.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202502/_webp_size328x442_27f7b303-88a3-4b2c-aaf9-2bc0106b5d62.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.987Z","timestamp":1783945694987,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202502/_webp_size328x442_27f7b303-88a3-4b2c-aaf9-2bc0106b5d62.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T13:40:27.954169Z","times_seen":17315391,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x422_936e6f39-c72d-42ec-ab51-2bd5a806c902.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.007Z","timestamp":1783945695007,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x422_936e6f39-c72d-42ec-ab51-2bd5a806c902.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 15760\r\nConnection: keep-alive\r\nEtag: \"dbd5bbca2ac98b7327bec49ec9e17a87\"\r\nLast-Modified: Tue, 02 Dec 2025 14:11:52 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105657\r\nCf-Cache-Status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Dgvp%2FksaDcFUZD4kZqjQBuDrzfenEwQfZf3KAgC9zzduLolp99H%2FKAQKjht6L1LFwCXmnywgsJ7on4Ro1zAW2xlsBP6en%2BWhVjXZR2ISWJhJlLZE8TrD%2F7gPZMpTu4zKF7HAhucm5wJRp8tXVwMWVXM%3D\"}]}\r\nCF-RAY: a19e35f29d09847e-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b7324e0248c\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15760,"size_decoded":16915,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"dbd5bbca2ac98b7327bec49ec9e17a87","sha1":"7ad876b6c3f6922c1cff9db452948604cfc691cf","sha256":"12e3a0e3de790b5f640b48e4fede8f5d1c881e23b4d710d1971282362277eee3","sha512":"c96a4f88a602c4bd5d8ccc3a0ae44ca9d85d5a75175b8b8c219c527d2ed1338b8d65e9bc52e9c1e844f34aa76e6d0d1d81c4eea6b28592de710a4f4922b11701","ssdeep":"384:z25GXKCP2DdvL8cWHImH7LKcCZzFwu/6unzgL4X9:S55Ce/xsln46un88","tlshash":"f462d0149f5537278cc4787941315fbf7f601c42b208e45296ffa86bba2c2957a146f3","first_seen":"2026-04-24T23:10:16.813188Z","last_seen":"2026-07-17T12:47:21.9465Z","times_seen":707,"resource_available":false,"data":null}},"time_used":5769,"timings":{"blocked":5357,"dns":0,"connect":0,"send":0,"wait":412,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/kc523-1/sponsor/sponsor_nav_web_1.png?1781011825626","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.267Z","timestamp":1783945693267,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_1.png?1781011825626 HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:17 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68dbcacf-1e8d\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945697=Y8wY1Rz8+nsWEzaT171EoSVw1V6QOLKgyV5hl0Psguoywo5vWkE+mvrqS2I5wKeOG8V6UnPoL1rn2EYkSxB1+/Gdi7ZvAW8Snric2mM/0qCL09PEwVFefWSddT9xXemyzWqK+Kc64VDD6kKv2AK5o2rKkDOM+adI4rB4P5cj8BIT5z1Iypy2zynkEKBhyWkH\r\nAge: 105952\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b7317b60033\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7821,"size_decoded":8530,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"0eb441aa3c30cc3c92da984283938f90","sha1":"74a769808afa9b87ea483a82d47958bf05ab9b87","sha256":"146f45de163728bb850c9a8e6c1693dd4c82caf7b6e1f58728395003b84f286c","sha512":"d1c9c8824c4f42f71db8ce2b62955647aa55bb590305765cd931000d0fc6023f7d57cd3daf6992094365ca6ecb42f02f93d606d79f6643a2f89d52f71200461e","ssdeep":"192:AnUYZGCj89cpWsWKE+hAqF7k4Pk7KJw7OjF57HUNuvs7alaUd:AFEijWKE+hHF7kt7857HU/eRd","tlshash":"20f19f3eececd52cd1a745f68caf47a6142c5031ee9d7929b82fdc728649a409d403c5","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-17T12:37:28.348275Z","times_seen":1963,"resource_available":false,"data":null}},"time_used":4087,"timings":{"blocked":3792,"dns":0,"connect":0,"send":0,"wait":295,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/left.34013cd8.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.277Z","timestamp":1783945693277,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/left.34013cd8.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g25j.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 237\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nETag: \"6a281707-ed\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945696=r+0f956Z+TmDiOUQLZu0a/2eBiXaMlDGDrljKtw3frmnuePdFZCsh67A0toqxlD1o8H78rQNc6uRc/hS0HF+w6J9UlJi5zAC0wqT6u7hceKCl8QKLTzLJRKc8bZ/WHYQAiUrosF3UbS4xzW8QcR5dvmklpwBybIZeaeFU+NUOQdiyP8hIKI4wuI7oa1mhLch\r\nAge: 105949\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027919f5b73134323bd\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":237,"size_decoded":905,"mime_type":"image/png","magic":"PNG image data, 14 x 44, 8-bit colormap, non-interlaced","md5":"5ecca260da6fc5e2843405c20ac69817","sha1":"3918cfad7493b6860ded9e259ba90bc6a853f1b1","sha256":"078a4aac39c49a33cbabf23cda7579fa7b76e875e6b6d24d16cfcbf9f8b250df","sha512":"b76a870a79a87a450e5d30a218d75093b57415c563e64a8ffd6839a31b36379dbc08398698b9c1368ecda671d65045d5cfebe3363b98d746d89dcaad15bcd8ce","ssdeep":"","tlshash":"6dd0a99be2076faed1c70bb3732e0ca18a8124e892944b088042c622ca663a1dd82042","first_seen":"2025-08-29T11:05:53.221032Z","last_seen":"2026-07-17T12:51:04.90937Z","times_seen":2190,"resource_available":false,"data":null}},"time_used":2939,"timings":{"blocked":2636,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/bj2.a8fabbac.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:13.279Z","timestamp":1783945693279,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/bj2.a8fabbac.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g25j.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:16 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-5809c\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945696=r+0f956Z+TmDiOUQLZu0a/2eBiXaMlDGDrljKtw3frmnuePdFZCsh67A0toqxlD1o8H78rQNc6uRc/hS0HF+w6J9UlJi5zAC0wqT6u7hceKCl8QKLTzLJRKc8bZ/WHYQAiUrosF3UbS4xzW8QcR5dvmklpwBybIZeaeFU+NUOQdiyP8hIKI4wuI7oa1mhLch\r\nAge: 105949\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027b19f5b73143dfcc0\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":360604,"size_decoded":360172,"mime_type":"image/png","magic":"PNG image data, 1920 x 641, 8-bit/color RGBA, non-interlaced","md5":"e0fe8ffeed1841f74df53c3b0c1f2db0","sha1":"77bf6dfe664cdc936776654af151f49368479ec3","sha256":"db4d87e8a403e388c54dd5d114b738c82e1d2dbe65b95630fd5782179f0d7d54","sha512":"825bf73262c2b613b6a8a8397f869db6b2cd4118e554689d228503e7a04c4e674d49c5649e4ac8e2423a7b526c0f6621c259566d0e9bb6ebfa0712a7352968fa","ssdeep":"6144:iAHwIFRCiRIygxWS9v34xfZzuwbIYGzl8BPp0eIiOk3Fg7la6RUIs4pU2:rwy0IgxDEfQwbjw8dpmiOiFgpLHFU2","tlshash":"2874238d711d48cc9c9b45003dd82d9e1c55aa2f7aab20b58264fed24d17ddeec0ea3b","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-17T12:51:04.999258Z","times_seen":2107,"resource_available":false,"data":null}},"time_used":3750,"timings":{"blocked":2816,"dns":0,"connect":0,"send":0,"wait":379,"receive":555,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_96811f47-5a2c-446d-a8ca-696df160de09.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:15.012Z","timestamp":1783945695012,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_96811f47-5a2c-446d-a8ca-696df160de09.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:20 GMT\r\nContent-Type: image/webp\r\nContent-Length: 46184\r\nConnection: keep-alive\r\nEtag: \"c0ef8343c60fc9c02bde9fb0823e1ef6\"\r\nLast-Modified: Sat, 06 Dec 2025 06:26:38 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Q0MRV65zGVxbYGODvJ5j%2B7bPs5QyBZpJkKt9XVUzjl5MRDuDTGgc3L2LPWBqIzIs30iKdWMR3ke4RZzXHGm%2FmJTSRTRzzQ%2BW9hiIWTSqRXeBKuMtRHsqF%2BOmNYMDFYViUcZJ8%2FTXaXgIJhTmavbhe4A%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 105656\r\nCf-Cache-Status: HIT\r\nCF-RAY: a19e35f8ba3685be-HKG\r\nalt-svc: h3=\":443\"; ma=86400\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-Safe: 1783945700=7Ne+JR5nfRf4kiKUj1JBrZ4eXUF4VQGbTvTX8XAkouwyqYBpPKm3vnh39U7/j0h9Kl+Zs4Um0gqLUq4gTTs410MM//Jc5Cfc/6ux7UlxYA6SKRYdF4o1ilyZXyyb43JfDEZwu/+HANrmDb3ops+Bs9z8xjU/p6ga6Cj5E1GPxZ3ZaDuL71bXtXl3kozyPSR/\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027a19f5b7325890045\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":46184,"size_decoded":47341,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c0ef8343c60fc9c02bde9fb0823e1ef6","sha1":"3a5e1c7a0e16e4df0a591749d4a8a1d01b381277","sha256":"1042e3632605c2e70706209ece9e2b341695afc4e57d5512818e458078c55040","sha512":"950b59f182c21e7d78ac56d6c1cb0f22a295ede2a579f9513c69166b2c227d5ebc4a8e16d5528f530488d5c36d8b88d9c29bb251820627d596156f90445a90f6","ssdeep":"768:fs+YB8yjw8RTKT4uT+QCkrgAEnaCA/RE4qehyRcQsII+IYJxT8sJk2RaA2b:fsDjxR+LT+vkrgAZ/R1hyqQ5IeJxTbR0","tlshash":"182302b81bd5a7b7cec731f89ce2890a4d17c2d5e183b0667d686bd6aa114c1f4c0ed1","first_seen":"2026-04-24T23:10:16.848247Z","last_seen":"2026-07-17T12:51:05.099498Z","times_seen":744,"resource_available":false,"data":null}},"time_used":5913,"timings":{"blocked":5581,"dns":0,"connect":0,"send":0,"wait":301,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/6d898bc337c441be9bffe123d27a8540?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.634Z","timestamp":1783945694634,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/6d898bc337c441be9bffe123d27a8540?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 10814\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 80879\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"6d898bc337c441be9bffe123d27a8540\"; filename*=utf-8''6d898bc337c441be9bffe123d27a8540\r\nContent-Md5: 8f8LHu5ntNsLkf1Gh13nVw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FiJeP9aGk1zJ13lcWD4qzWEq5tnV\"\r\nLast-Modified: Fri, 10 Jul 2026 01:49:09 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: nqe5E2zjr\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: nd8AAACNp1yZj8EY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10814,"size_decoded":11571,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 200x200, components 3","md5":"f1ff0b1eee67b4db0b91fd46875de757","sha1":"225e3fd686935cc9d7795c583e2acd612ae6d9d5","sha256":"5289c5cd6ffe695d2359c36b498444bcbaa466c75a4ee9b31b97bac2724200e0","sha512":"bbbdfa76b061341063c48ba8bc0a10e32db83857dbb0ac02f3fc11d473deb6397156c10eb41fb018ffe75fbfd56e0058d077fa44c6268a700d2e798f9ebb0976","ssdeep":"192:EVj1wyQxRmTyTIZ1o9AjMEVwkHgUXktsZJor+JZ5M0TxwzVx6K8Gl5G:CwxRGyTCGSHkOLJrpTixh5G","tlshash":"0722c0d72963f51ad078f7ff5126283bfb4abc126e7046369d4049738a09742be0c6a3","first_seen":"2026-01-24T15:18:57.161731Z","last_seen":"2026-07-17T12:47:21.568958Z","times_seen":120,"resource_available":false,"data":null}},"time_used":1268,"timings":{"blocked":981,"dns":0,"connect":0,"send":0,"wait":287,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g25j.top/img/SPORT.aab253e7.png","fqdn":"g25j.top","domain":"g25j.top","tld":"top"},"ip":{"addr":"154.39.104.142","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g25j.top/","date":"2026-07-13T12:28:14.893Z","timestamp":1783945694893,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m28r.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 03 Jul 2026 10:05:33 GMT","end":"Thu, 01 Oct 2026 10:05:32 GMT"},"fingerprint":{"sha1":"C8:56:9C:C1:2D:62:6F:75:F7:2F:DD:E6:E3:B6:99:75:83:46:01:82","sha256":"CA:20:EF:D9:26:20:70:5E:4D:A2:7E:68:FF:34:08:66:2E:88:05:A4:C3:BD:01:3A:8E:BB:46:47:A9:4A:D7:5A"}}},"request":{"raw":"GET /img/SPORT.aab253e7.png HTTP/1.1\r\nHost: g25j.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g25j.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2026 12:28:15 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-d854\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-Safe: 1783945695=K6075vCcOUGQ5k3J/aztiTgTX/gpL/4jJnGnrHwfq38WA2BPQ283vagyEPEkLclgYA3X2Qhjr0XoD897zkMLAurhGEUhZcOE9d+CSUTFEm3x1X83daoAklL1meFRuSqG+e0d6Y1SbC+jDDGY3hyIRCyfLWl/9pdyvchiSOvV67w8IWeFGwfgPOv//mX43rwf\r\nAge: 105584\r\nL-VIA: l1=CJR9oEa4UnlD0OBR\r\nL-VERSION: 1783076647\r\nL-Request-Id: 027819f5b73119e247f\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55380,"size_decoded":56122,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"3990a0dcf110f100c97ab413079e969e","sha1":"8087b72a149b71f4f5fc43b0f8bc07b89b621583","sha256":"6ddc189e7780b1313933d4903be9fbf6644b6a590e9aba83a6e4e50fdafb170e","sha512":"6b092584d42ec1423ecb94383907f29571e93308944813286d6e74b10f6eccb27536924220780f9a080dc259a095718a33f0757fc0adb04d737c83a6fa1647e5","ssdeep":"768:aEivx5zbZ4L0zze87wWbuKu4YIsZdCPX4ueh17yEs7NsGJSLsBQ1MDAaYHKJTbYC:aEi3eL0za8xbw4UmXI1VfJIRDYqz6W","tlshash":"bc43022944944c242384f1a6ac778dbc6dffa348a5f38f639a842bec7dcd84d95f4811","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-07-17T12:50:21.141638Z","times_seen":2047,"resource_available":false,"data":null}},"time_used":920,"timings":{"blocked":603,"dns":0,"connect":0,"send":0,"wait":304,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-13","alert":"Phishing Block","trigger":"g25j.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-13","alert":"Sinkholed","trigger":"g25j.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}