{"report_id":"040b16b2-cb02-4f06-aa03-eb618ec4dda0","version":0,"status":"done","tags":[],"date":"2026-09-22T21:11:17Z","url":{"schema":"http","addr":"marketplace.merchant-cashier-date.cfd/gets/VQZCV7N78J.html","fqdn":"marketplace.merchant-cashier-date.cfd","domain":"merchant-cashier-date.cfd","tld":"cfd"},"ip":{"addr":"43.160.253.80","port":0,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"final":{"url":{"schema":"http","addr":"marketplace.merchant-cashier-date.cfd/gets/VQZCV7N78J.html","fqdn":"marketplace.merchant-cashier-date.cfd","domain":"merchant-cashier-date.cfd","tld":"cfd"},"title":"帶價pm","dom":{"size":9606,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (601)","md5":"d84ad39299269810bb5a3695cc582e43","sha1":"021cd0e75294d659caefe16391c7061d23002ae6","sha256":"8075fbec95f9469b759c831fc83bb603825f1d2a724de4748c33f09760d585f1","sha512":"6ea84b0d09273ec54645f2da6d583b282dd450bd1c0cf5135152bce58c52414ade9241b90cb9ea155fb012acd30dfdc046489376b3dfd0a758ea36dea884afd8","ssdeep":"192:SOhTChUua26oEBbJ8ciQy7yGLKQDgDhVmBThz8IbgsDCh:Sg77vi8ygDbmFhz8w4","tlshash":"91128462a5f1052655ee4054b46aaf0b3f22db03c68e9390b36c6ee54fcadc2cd2774c","dom_hash":"domhashfba13e063d4c4c0175a44d87692f9b83","first_seen":"2026-09-22T21:11:27.223089Z","last_seen":"2026-09-22T21:11:27.223089Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"marketplace.merchant-cashier-date.cfd/gets/VQZCV7N78J.html","fqdn":"marketplace.merchant-cashier-date.cfd","domain":"merchant-cashier-date.cfd","tld":"cfd"},"ip":{"addr":"43.160.253.80","port":0,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-27T21:11:17Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"ab.cinderlo.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ab.cinderlo.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"marketplace.merchant-cashier-date.cfd","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2026-09-15","domain_rank":0,"first_seen":"2026-09-22T13:41:26.390523Z","last_seen":"2026-09-22T13:41:26.390523Z","alert_count":15,"request_count":5,"received_data":5955,"sent_data":2298,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"ab.cinderlo.cfd","ip":{"addr":"104.21.30.132","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":18,"request_count":9,"received_data":265599,"sent_data":5085,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"marketplace.merchant-cashier-date.cfd/gets/VQZCV7N78J.html","fqdn":"marketplace.merchant-cashier-date.cfd","domain":"merchant-cashier-date.cfd","tld":"cfd"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"55053232a7555855a8469ac8b8fa938b","sha1":"420b7be0a33a3620af818db0fa33d63a2e62a78e","sha256":"4988c302c4600b85637246463850634d930ef2a808da2befdbfdf16cca821cd0","sha512":"384a34406173e90c1c4ed7f38d62977ca342e76f531b638555031dd2ee96473aaa6a237b1ddabca3700727344b6a41abe923b55aacd9612a011a9d4e3c257613","ssdeep":"","tlshash":"318004d0574d0c57111cd307cd47313d340c1d5d5101450c450df44130304c70471340","size":37,"data":"","first_seen":"2026-09-22T14:03:41.557063Z","last_seen":"2026-09-22T21:11:27.236203Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"marketplace.merchant-cashier-date.cfd/route-loader.js?v=20260918-3","fqdn":"marketplace.merchant-cashier-date.cfd","domain":"merchant-cashier-date.cfd","tld":"cfd"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"fb1506c84fa3c4a161a24e6f2d981704","sha1":"35d7601af94043e633ccfa75f87134b14bf5fb77","sha256":"6ce987304814cd941ff8e8eb0fbe57451373bd23db56a1388480ebcde435d82e","sha512":"a3f0ffeeeae6e55694ee851057837c1680d014b22afaa147e16dc5c1da4b75f58fed53f76461a922b639c7d18d3c9bfbdd44a0339d2a342b6ba1f9fc13df57af","ssdeep":"","tlshash":"db61a43c1df70a3156e7525e7b6fb06ab260d0620087d911bdaee45c5fe0d981a3dacc","size":3208,"data":"","first_seen":"2026-09-22T13:35:41.851688Z","last_seen":"2026-09-22T21:11:27.225208Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ab.cinderlo.cfd/get/VQZCV7N78J","fqdn":"ab.cinderlo.cfd","domain":"cinderlo.cfd","tld":"cfd"},"ip":{"addr":"104.21.30.132","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"49f4857b275840b299f0d14addde91e3","sha1":"7e994710832db052c35598494df7d136d31dce17","sha256":"b87114ce5223908af73ece2018a82444db73d48b0b5aec93439c282389992e8b","sha512":"1e07096e4af9b9ec5a570fd38f8c643a1f1fb82e691bcc586d998fe455d04b8c6570680c4cdeda4f6d99d1c6bc8c05951b0a0e0a263880b9f784d1d69ae4befc","ssdeep":"","tlshash":"715153c778b72a7618ef553a302f3a02763149074d01d241e71d49964ff9fc42966fac","size":2569,"data":"","first_seen":"2026-09-22T13:35:41.862961Z","last_seen":"2026-09-22T21:11:27.237099Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ab.cinderlo.cfd/index/v8c78df7c7c0f484497ecbca7046644da1771523124516","fqdn":"ab.cinderlo.cfd","domain":"cinderlo.cfd","tld":"cfd"},"ip":{"addr":"104.21.30.132","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4f67ea9205c3ca7c9e04582d3b9bdd1d","sha1":"d3b68ad3eb88d3db3d843211d4905143c3bff281","sha256":"4b77eae349a8cbcea7133cf3640a64ebf1f69d54d8f6469d7be6fdc188ca4ca4","sha512":"f034bbae022b026821045c28393ba371fe83f6b5ef1fcc66f0943525ad3587d417f04cd795d8accee7d86b82057ca74b50a4d3ae74855cb0e4504393ad943c42","ssdeep":"384:BXi1f+hZCIy1f84QDRuT9WKw00QmLnivMt+BERzR0c744BKJKe0620vFjOkcXo9g:+V584QlIrw6OPIJJtFjj09N","tlshash":"bce218eeb591b13603f7a072447f210b733ab56264494408e21bd6c22c78eeed257fad","size":31169,"data":"","first_seen":"2026-02-19T19:35:51.221473Z","last_seen":"2026-09-22T21:11:27.234397Z","times_seen":78369,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"marketplace.merchant-cashier-date.cfd/gets/VQZCV7N78J.html","fqdn":"marketplace.merchant-cashier-date.cfd","domain":"merchant-cashier-date.cfd","tld":"cfd"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-22T21:10:38.855Z","timestamp":1790111438855,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /gets/VQZCV7N78J.html HTTP/1.1\r\nHost: marketplace.merchant-cashier-date.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T05:48:32.452556Z","times_seen":18612924,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"marketplace.merchant-cashier-date.cfd/route-loader.js?v=20260918-3","fqdn":"marketplace.merchant-cashier-date.cfd","domain":"merchant-cashier-date.cfd","tld":"cfd"},"ip":{"addr":"43.160.253.80","port":80,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://marketplace.merchant-cashier-date.cfd/gets/VQZCV7N78J.html","date":"2026-09-22T21:10:40.823Z","timestamp":1790111440823,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /route-loader.js?v=20260918-3 HTTP/1.1\r\nHost: marketplace.merchant-cashier-date.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://marketplace.merchant-cashier-date.cfd/gets/VQZCV7N78J.html\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:10:40 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Fri, 18 Sep 2026 12:24:21 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6aad2d75-c88\"\r\nExpires: Wed, 23 Sep 2026 09:10:40 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3208,"size_decoded":1937,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (327)","md5":"fb1506c84fa3c4a161a24e6f2d981704","sha1":"35d7601af94043e633ccfa75f87134b14bf5fb77","sha256":"6ce987304814cd941ff8e8eb0fbe57451373bd23db56a1388480ebcde435d82e","sha512":"a3f0ffeeeae6e55694ee851057837c1680d014b22afaa147e16dc5c1da4b75f58fed53f76461a922b639c7d18d3c9bfbdd44a0339d2a342b6ba1f9fc13df57af","ssdeep":"","tlshash":"db61a43c1df70a3156e7525e7b6fb06ab260d0620087d911bdaee45c5fe0d981a3dacc","first_seen":"2026-09-22T13:35:41.851688Z","last_seen":"2026-09-22T21:11:27.225208Z","times_seen":4,"resource_available":true,"data":null}},"time_used":291,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":291,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"marketplace.merchant-cashier-date.cfd/favicon.ico","fqdn":"marketplace.merchant-cashier-date.cfd","domain":"merchant-cashier-date.cfd","tld":"cfd"},"ip":{"addr":"43.160.253.80","port":80,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://marketplace.merchant-cashier-date.cfd/gets/VQZCV7N78J.html","date":"2026-09-22T21:10:41.228Z","timestamp":1790111441228,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: marketplace.merchant-cashier-date.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://marketplace.merchant-cashier-date.cfd/gets/VQZCV7N78J.html\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:10:41 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":308,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-09-23T05:49:59.210059Z","times_seen":561906,"resource_available":true,"data":null}},"time_used":284,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":284,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ab.cinderlo.cfd/route-health.php?nonce=mud64sau19gzaj97xof","fqdn":"ab.cinderlo.cfd","domain":"cinderlo.cfd","tld":"cfd"},"ip":{"addr":"104.21.30.132","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://marketplace.merchant-cashier-date.cfd/gets/VQZCV7N78J.html","date":"2026-09-22T21:10:41.479Z","timestamp":1790111441479,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cinderlo.cfd","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 19 Sep 2026 06:20:28 GMT","end":"Fri, 18 Dec 2026 06:20:27 GMT"},"fingerprint":{"sha1":"7E:19:84:93:D8:19:30:C8:C7:75:7C:FE:80:C9:4C:0C:B5:3D:0E:31","sha256":"87:8F:1B:76:0E:3B:EC:1A:EF:B6:61:77:AC:7A:D7:99:62:E4:D9:87:8A:50:B2:2C:A1:44:2E:E2:D7:AC:FE:AC"}}},"request":{"raw":"GET /route-health.php?nonce=mud64sau19gzaj97xof HTTP/1.1\r\nHost: ab.cinderlo.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://marketplace.merchant-cashier-date.cfd/\r\nOrigin: http://marketplace.merchant-cashier-date.cfd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 21:10:45 GMT\r\ncontent-type: application/json; charset=utf-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: no-store, no-cache, must-revalidate\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bpTWskyK6fDTPERaYaxzecxM6FWG%2FI146i4OcSubPirMLlhTt73j40Dcbb4w2phT9JrvgvAhtZFd6aFD6%2Fdlmq4W0s0Fy%2Fg1WO5xabPcTnFD7F4o9U9TWsrlH9S3USuwqGg%3D\"}]}\r\ncf-ray: a3f44c516b35c272-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":64,"size_decoded":838,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"e86d91380cc8a7dd72dcc15d71b26bb9","sha1":"df9b338609333466dedb216f186173dead71b711","sha256":"a5ae014252eadde63d85ed57e9e3953afe6e3e489225ed611fdd21a55af913e3","sha512":"5435535fc6937e212af703e547a91222afa5da486e996d94174e59a89593fb3d84961d33148db95c6f3eab561fad302e4029ac3a26aeada38232ba94aff7cfd7","ssdeep":"","tlshash":"24a0220a23c80ca0080082f22c2a0af3208c08b2808800800ba8c880ab8e8bc838c220","first_seen":"2026-09-22T21:11:27.226276Z","last_seen":"2026-09-22T21:11:27.226276Z","times_seen":1,"resource_available":true,"data":null}},"time_used":3627,"timings":{"blocked":0,"dns":98,"connect":1,"send":0,"wait":403,"receive":0,"ssl":3124},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"ab.cinderlo.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ab.cinderlo.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ab.cinderlo.cfd/index/logo.png","fqdn":"ab.cinderlo.cfd","domain":"cinderlo.cfd","tld":"cfd"},"ip":{"addr":"104.21.30.132","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ab.cinderlo.cfd/get/VQZCV7N78J","date":"2026-09-22T21:10:45.508Z","timestamp":1790111445508,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cinderlo.cfd","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 19 Sep 2026 06:20:28 GMT","end":"Fri, 18 Dec 2026 06:20:27 GMT"},"fingerprint":{"sha1":"7E:19:84:93:D8:19:30:C8:C7:75:7C:FE:80:C9:4C:0C:B5:3D:0E:31","sha256":"87:8F:1B:76:0E:3B:EC:1A:EF:B6:61:77:AC:7A:D7:99:62:E4:D9:87:8A:50:B2:2C:A1:44:2E:E2:D7:AC:FE:AC"}}},"request":{"raw":"GET /index/logo.png HTTP/1.1\r\nHost: ab.cinderlo.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ab.cinderlo.cfd/get/VQZCV7N78J\r\nCookie: PHPSESSID=9iec8m9jpplc51rgqash31add3\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 21:10:45 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 14 May 2026 06:52:33 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OC8Pawq%2FaSqFENKF9vX8c0m34cAr2IBJOnLcZCpXzryrF4NBlFBmVtm6hl%2FkPf3vaQ%2Fy0LC45yb1sAAkhnsqus9QQf%2BLegIpgHP4njLlxAOuu7sjUzeaXYNxXmwwcjxSdBI%3D\"}]}\r\npriority: u=5,i\r\nvary: Accept-Encoding\r\netag: W/\"6a057131-7b04\"\r\nexpires: Thu, 22 Oct 2026 21:10:45 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f44c566838120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31492,"size_decoded":29078,"mime_type":"image/png","magic":"PNG image data, 960 x 961, 8-bit/color RGBA, non-interlaced","md5":"d34dfbfda499b663e49e6fa561a7f109","sha1":"36af86a297ada3cf3508196e39e83e5e6fe49388","sha256":"badf944468924c680b6158863d051e05133b606f8d6829b4fa71dcda1ca19c68","sha512":"2763c9f2c952c6dfc7ab179754ac1d81e210ee4cc4c9d2f9a197a2c57565f6d756e2ecd347ca46a36fdf888111f77fece1da2be759ae4ab59489b9b17a5f2920","ssdeep":"768:BpH8VcYQzmEe21UVpda+FtJKWEYoiME+y5wr6:BF8ixrzU/da+FuFYoiMl2","tlshash":"7ee2cfc7b0f3f847a5c32e3261aa52b12913f1e54ec165b642b910571b07bf43e71a6b","first_seen":"2026-09-22T13:35:41.855987Z","last_seen":"2026-09-22T21:11:27.227427Z","times_seen":2,"resource_available":false,"data":null}},"time_used":585,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":405,"receive":180,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ab.cinderlo.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"ab.cinderlo.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ab.cinderlo.cfd/upload/default/2026-09/6aafd18e0fe31.jpg","fqdn":"ab.cinderlo.cfd","domain":"cinderlo.cfd","tld":"cfd"},"ip":{"addr":"104.21.30.132","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ab.cinderlo.cfd/get/VQZCV7N78J","date":"2026-09-22T21:10:45.512Z","timestamp":1790111445512,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cinderlo.cfd","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 19 Sep 2026 06:20:28 GMT","end":"Fri, 18 Dec 2026 06:20:27 GMT"},"fingerprint":{"sha1":"7E:19:84:93:D8:19:30:C8:C7:75:7C:FE:80:C9:4C:0C:B5:3D:0E:31","sha256":"87:8F:1B:76:0E:3B:EC:1A:EF:B6:61:77:AC:7A:D7:99:62:E4:D9:87:8A:50:B2:2C:A1:44:2E:E2:D7:AC:FE:AC"}}},"request":{"raw":"GET /upload/default/2026-09/6aafd18e0fe31.jpg HTTP/1.1\r\nHost: ab.cinderlo.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ab.cinderlo.cfd/get/VQZCV7N78J\r\nCookie: PHPSESSID=9iec8m9jpplc51rgqash31add3\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 21:10:45 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sun, 20 Sep 2026 12:29:02 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8B%2B%2BPVyePw0pqc1Hw28H167SQKruHrL8%2FN3WKSew%2FLZT9p4yATa5ysMdV%2B6xrhhrwVzKcdMPALTLKFVbM2PW3xwQZ8W1mlT4nfGcQW5Ljt8ti2yZ9u9HlT3Q7HMm9yenESA%3D\"}]}\r\npriority: u=5,i\r\nvary: Accept-Encoding\r\netag: W/\"6aafd18e-29f77\"\r\nexpires: Thu, 22 Oct 2026 21:10:45 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f44c56783a120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":171895,"size_decoded":172706,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 960x720, components 3","md5":"567467fccb847f555742bf7a36419016","sha1":"e082594ad92eedec269d9f1a7f854708e84a57ce","sha256":"279516a8bc15c405e25e424d6d8ace73a8c22ab3766ad2ca8d87c5f44cb33d9e","sha512":"ef282d3c8fac6a426fd1237fa33d6c6cd9354b959f8df2755322e7777a6c7250208804488f5b176ed31141eb7445932bfef98113a0a84746114b70afdb66b0fb","ssdeep":"3072:2+k1XkAWQX3xKNanE7Ep8LpgvzwZKWO2XK1PReaXegtrAUmR7FpbN:2+4JFnEAp8LSwZKW1K93jmR5P","tlshash":"b8f31222ee9717709d7b68f0fbeb671419551f8c2f4aba204037c95469fe10c8de1a98","first_seen":"2026-09-22T21:11:27.228511Z","last_seen":"2026-09-22T21:11:27.228511Z","times_seen":1,"resource_available":false,"data":null}},"time_used":937,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":394,"receive":543,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"ab.cinderlo.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ab.cinderlo.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ab.cinderlo.cfd/static/images/kf.png","fqdn":"ab.cinderlo.cfd","domain":"cinderlo.cfd","tld":"cfd"},"ip":{"addr":"104.21.30.132","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ab.cinderlo.cfd/get/VQZCV7N78J","date":"2026-09-22T21:10:45.514Z","timestamp":1790111445514,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cinderlo.cfd","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 19 Sep 2026 06:20:28 GMT","end":"Fri, 18 Dec 2026 06:20:27 GMT"},"fingerprint":{"sha1":"7E:19:84:93:D8:19:30:C8:C7:75:7C:FE:80:C9:4C:0C:B5:3D:0E:31","sha256":"87:8F:1B:76:0E:3B:EC:1A:EF:B6:61:77:AC:7A:D7:99:62:E4:D9:87:8A:50:B2:2C:A1:44:2E:E2:D7:AC:FE:AC"}}},"request":{"raw":"GET /static/images/kf.png HTTP/1.1\r\nHost: ab.cinderlo.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ab.cinderlo.cfd/get/VQZCV7N78J\r\nCookie: PHPSESSID=9iec8m9jpplc51rgqash31add3\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 21:10:45 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 22 May 2026 05:38:11 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jqeTqyw%2BDq1UehBEYwELHu4GKNsvsgHpNiglcir4iGAr2kIrUXzZWdGOoXCY1hx4eRodjB1Ckk3DNFe0MM6NwwbkFIMjQkQLb9kV288Nlj%2B5VyOSUe6RHTWqgYsh9sMUC5Y%3D\"}]}\r\npriority: u=5,i\r\nvary: Accept-Encoding\r\netag: W/\"6a0febc3-1d65\"\r\nexpires: Thu, 22 Oct 2026 21:10:45 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f44c56783b120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7525,"size_decoded":7977,"mime_type":"image/png","magic":"PNG image data, 320 x 320, 8-bit/color RGBA, non-interlaced","md5":"825555cfbe114185e46ced7f13b7023b","sha1":"718359f218026c06e4199e885873193f33cd09bb","sha256":"9f87d65bbf95f7138a9ffd13e16a2e3e833b0e293e5e047170dbeda8cecb9757","sha512":"b82012c095f0126c3fe94095c6fd6c92ed95e3ce6df69df78989b5788fa713e43c4e9457cfedfeea5836fdaaa04eff16c6ba4c5073fa52edc54ef93c5e6a5e5c","ssdeep":"192:/SHIIHUCD4wa96q8IVkaysDlNDax5CxI/BcVtIS:q50w+DKa2x5MI/BcsS","tlshash":"f2f18edb549a05b3352a12bebea78f064ea24670031b5dec9d1e73cd920dc513c717a9","first_seen":"2026-09-22T13:35:41.847912Z","last_seen":"2026-09-22T21:11:27.22967Z","times_seen":2,"resource_available":false,"data":null}},"time_used":404,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":404,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"ab.cinderlo.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ab.cinderlo.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"marketplace.merchant-cashier-date.cfd/gets/VQZCV7N78J.html","fqdn":"marketplace.merchant-cashier-date.cfd","domain":"merchant-cashier-date.cfd","tld":"cfd"},"ip":{"addr":"43.160.253.80","port":80,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-22T21:10:40.093Z","timestamp":1790111440093,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /gets/VQZCV7N78J.html HTTP/1.1\r\nHost: marketplace.merchant-cashier-date.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:10:40 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1333,"size_decoded":859,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"2c742ddc37cad9ffe95c2ab726a031f8","sha1":"0c18485fb75caad54ff94655bd6057163b34bca2","sha256":"4ea274fd42135b40e2e9be121944293033c841af388afd43203fe63a6b4127e5","sha512":"399a6fee572f8fe7c046b65afd5c06518082de28bdba81d25c569cd3bf340bda1ce36a939ba3c5837e47bb3dc901cd716e4378c73166f97365ed0299e27df787","ssdeep":"","tlshash":"0921ceb35f2188da6278c2241edb354c92391997a3b5cc647ad1b14b4ac5fd1c0f3787","first_seen":"2026-09-22T14:03:41.546994Z","last_seen":"2026-09-22T21:11:27.230641Z","times_seen":2,"resource_available":true,"data":null}},"time_used":615,"timings":{"blocked":-1,"dns":10,"connect":302,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"marketplace.merchant-cashier-date.cfd/urls.json?t=1790111441122","fqdn":"marketplace.merchant-cashier-date.cfd","domain":"merchant-cashier-date.cfd","tld":"cfd"},"ip":{"addr":"43.160.253.80","port":80,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://marketplace.merchant-cashier-date.cfd/gets/VQZCV7N78J.html","date":"2026-09-22T21:10:41.124Z","timestamp":1790111441124,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /urls.json?t=1790111441122 HTTP/1.1\r\nHost: marketplace.merchant-cashier-date.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://marketplace.merchant-cashier-date.cfd/gets/VQZCV7N78J.html\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:10:41 GMT\r\nContent-Type: application/json\r\nContent-Length: 151\r\nLast-Modified: Sat, 19 Sep 2026 07:26:33 GMT\r\nConnection: keep-alive\r\nETag: \"6aae3929-97\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":151,"size_decoded":433,"mime_type":"application/json","magic":"JSON text data","md5":"84c06d044feb1afa4b812d59ecf6cb57","sha1":"52977c6cfeef4a3d492333ae8c337adb603ab616","sha256":"0d97bf75136d4c41181269875d21e34a66b7054708ed462ce4eb864e287bb8e6","sha512":"cfd16afe4f406dbd60065616108ed20cb672060ec9207ec18c8d19244dd69081b43eefbfc20ef04f637dc038384d74e74a4591ddf397fb1038c4754c2dc81cea","ssdeep":"","tlshash":"a3c001a304912068d28c03a4c089362ca70aa9aa2ec2aa26a343c0044e2a2f3026c18b","first_seen":"2026-09-22T13:35:41.853623Z","last_seen":"2026-09-22T21:11:27.231565Z","times_seen":4,"resource_available":true,"data":null}},"time_used":349,"timings":{"blocked":0,"dns":0,"connect":174,"send":0,"wait":175,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"marketplace.merchant-cashier-date.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ab.cinderlo.cfd/get/VQZCV7N78J","fqdn":"ab.cinderlo.cfd","domain":"cinderlo.cfd","tld":"cfd"},"ip":{"addr":"104.21.30.132","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"http://marketplace.merchant-cashier-date.cfd/gets/VQZCV7N78J.html","date":"2026-09-22T21:10:45.211Z","timestamp":1790111445211,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cinderlo.cfd","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 19 Sep 2026 06:20:28 GMT","end":"Fri, 18 Dec 2026 06:20:27 GMT"},"fingerprint":{"sha1":"7E:19:84:93:D8:19:30:C8:C7:75:7C:FE:80:C9:4C:0C:B5:3D:0E:31","sha256":"87:8F:1B:76:0E:3B:EC:1A:EF:B6:61:77:AC:7A:D7:99:62:E4:D9:87:8A:50:B2:2C:A1:44:2E:E2:D7:AC:FE:AC"}}},"request":{"raw":"GET /get/VQZCV7N78J HTTP/1.1\r\nHost: ab.cinderlo.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 21:10:45 GMT\r\ncontent-type: text/html; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4agqFkmTYVKmfuXXVT1ZpXN5KC3kl2JKtavZynCIHfySw3Vz2%2F6GGO7VFuX6R1p3cypsLOCJwpIg%2FmD7en2GJuFgp0XxhvY8ONVqCi2v0y4A3Ri01QYRL5%2BJViKh11aQGeM%3D\"}]}\r\npriority: u=4,i=?0\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=9iec8m9jpplc51rgqash31add3; path=/; secure; HttpOnly; SameSite=None\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a3f44c549fd8120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"9iec8m9jpplc51rgqash31add3","quoted":false,"path":"/","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"PHPSESSID=9iec8m9jpplc51rgqash31add3; path=/; secure; HttpOnly; SameSite=None"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9713,"size_decoded":4809,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (601)","md5":"db3292f57cea60cb869d319b69a4a52d","sha1":"0041f1635e3fea3d729ac7ba1e908aede797864c","sha256":"4e6ee99b4903f3dc0760d9728398f92d9446f6c32d7e1e0dbf382ad4930e89ff","sha512":"35130f2ee88282a868c3c2410614344c39020e36d0f8e5c5b9ace4c007a158030f0d94680175fd8701e22bbadec820659d7e148d26e2ee73bb03e0da3a8db089","ssdeep":"192:JOhTChUua26oEBbJ8ciQy7yGLKQDgDhVmBThz8IbgsDCh:Jg77vi8ygDbmFhz8w4","tlshash":"c0128562a5f1052655ee4054b466af0b3f22db03c68e9390b36c6ee55fcadc2cd2774c","first_seen":"2026-09-22T21:11:27.232111Z","last_seen":"2026-09-22T21:11:27.232111Z","times_seen":1,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"ab.cinderlo.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ab.cinderlo.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ab.cinderlo.cfd/index/marketplace.css","fqdn":"ab.cinderlo.cfd","domain":"cinderlo.cfd","tld":"cfd"},"ip":{"addr":"104.21.30.132","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ab.cinderlo.cfd/get/VQZCV7N78J","date":"2026-09-22T21:10:45.505Z","timestamp":1790111445505,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cinderlo.cfd","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 19 Sep 2026 06:20:28 GMT","end":"Fri, 18 Dec 2026 06:20:27 GMT"},"fingerprint":{"sha1":"7E:19:84:93:D8:19:30:C8:C7:75:7C:FE:80:C9:4C:0C:B5:3D:0E:31","sha256":"87:8F:1B:76:0E:3B:EC:1A:EF:B6:61:77:AC:7A:D7:99:62:E4:D9:87:8A:50:B2:2C:A1:44:2E:E2:D7:AC:FE:AC"}}},"request":{"raw":"GET /index/marketplace.css HTTP/1.1\r\nHost: ab.cinderlo.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ab.cinderlo.cfd/get/VQZCV7N78J\r\nCookie: PHPSESSID=9iec8m9jpplc51rgqash31add3\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 21:10:45 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 14 May 2026 06:52:33 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Rp6QPB1rQk%2BrLX57Y2SAVIwtT%2FSPhzVyNWtsFi%2Fq8%2F9LW677Dg4bkbj47CTcBapFKGNEHpp4rDC4Rt48rZqOzJ5wowOoUZRPt2F5zqA%2FZntyWEJPrOQVzp3kXzYlGX0xqmU%3D\"}]}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"6a057131-1875\"\r\nexpires: Wed, 23 Sep 2026 09:10:45 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f44c566836120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6261,"size_decoded":2689,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"fe89efa213eea0a0bc9412a9a9388680","sha1":"947c39efa169d1e8d42592cc583d2ca05aee30e3","sha256":"5021dc7b19dd83915aa94524bf3323cfd091e2e0ca3b6b5c328252d5348ee6c0","sha512":"bcb1bd87ed5f1849ba20ae5899f79b8b1f35b5fa5b4f2a4b0c039f3bd112e5eeb527bb018124d80c8484ac186909ea2997560974d4c4a742454ba853df2bb0c1","ssdeep":"96:N7tv2pxrhWGRgiAApywDg6v9GLtfiIdpRNWD6vhj:Pv2TtWGRrAnwbvWtfiIdoG5j","tlshash":"f6d142b2a514d12c703bd6a8f8b0afdf71949012d3b60becde547138c9895b72eb464c","first_seen":"2026-09-22T13:35:41.861812Z","last_seen":"2026-09-22T21:11:27.233352Z","times_seen":2,"resource_available":true,"data":null}},"time_used":402,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":402,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"ab.cinderlo.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ab.cinderlo.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ab.cinderlo.cfd/index/v8c78df7c7c0f484497ecbca7046644da1771523124516","fqdn":"ab.cinderlo.cfd","domain":"cinderlo.cfd","tld":"cfd"},"ip":{"addr":"104.21.30.132","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ab.cinderlo.cfd/get/VQZCV7N78J","date":"2026-09-22T21:10:45.510Z","timestamp":1790111445510,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cinderlo.cfd","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 19 Sep 2026 06:20:28 GMT","end":"Fri, 18 Dec 2026 06:20:27 GMT"},"fingerprint":{"sha1":"7E:19:84:93:D8:19:30:C8:C7:75:7C:FE:80:C9:4C:0C:B5:3D:0E:31","sha256":"87:8F:1B:76:0E:3B:EC:1A:EF:B6:61:77:AC:7A:D7:99:62:E4:D9:87:8A:50:B2:2C:A1:44:2E:E2:D7:AC:FE:AC"}}},"request":{"raw":"GET /index/v8c78df7c7c0f484497ecbca7046644da1771523124516 HTTP/1.1\r\nHost: ab.cinderlo.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ab.cinderlo.cfd/get/VQZCV7N78J\r\nCookie: PHPSESSID=9iec8m9jpplc51rgqash31add3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 21:10:45 GMT\r\ncontent-type: application/octet-stream\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 14 May 2026 06:52:33 GMT\r\npriority: u=3,i=?0\r\netag: \"6a057131-79c1\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XaJbuU5Zror9ShuY%2FHmy0B15YBHoWz%2Fq%2FPvOebNM36FdLwhzT5ysuKyXKeSusxS%2BeDdIT4ujaCc2zkY57WC2crz68pwPkbqSBPMvFLQ9vYQ0RHKlWyGBHCvBeoKkVH3McAA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3f44c567839120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 31169\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31169,"size_decoded":31896,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (31169), with no line terminators","md5":"4f67ea9205c3ca7c9e04582d3b9bdd1d","sha1":"d3b68ad3eb88d3db3d843211d4905143c3bff281","sha256":"4b77eae349a8cbcea7133cf3640a64ebf1f69d54d8f6469d7be6fdc188ca4ca4","sha512":"f034bbae022b026821045c28393ba371fe83f6b5ef1fcc66f0943525ad3587d417f04cd795d8accee7d86b82057ca74b50a4d3ae74855cb0e4504393ad943c42","ssdeep":"384:BXi1f+hZCIy1f84QDRuT9WKw00QmLnivMt+BERzR0c744BKJKe0620vFjOkcXo9g:+V584QlIrw6OPIJJtFjj09N","tlshash":"bce218eeb591b13603f7a072447f210b733ab56264494408e21bd6c22c78eeed257fad","first_seen":"2026-02-19T19:35:51.221473Z","last_seen":"2026-09-22T21:11:27.234397Z","times_seen":78369,"resource_available":true,"data":null}},"time_used":400,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":211,"receive":189,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"ab.cinderlo.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ab.cinderlo.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ab.cinderlo.cfd/received/1778734320/chat/unread","fqdn":"ab.cinderlo.cfd","domain":"cinderlo.cfd","tld":"cfd"},"ip":{"addr":"104.21.30.132","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ab.cinderlo.cfd/get/VQZCV7N78J","date":"2026-09-22T21:10:45.945Z","timestamp":1790111445945,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cinderlo.cfd","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 19 Sep 2026 06:20:28 GMT","end":"Fri, 18 Dec 2026 06:20:27 GMT"},"fingerprint":{"sha1":"7E:19:84:93:D8:19:30:C8:C7:75:7C:FE:80:C9:4C:0C:B5:3D:0E:31","sha256":"87:8F:1B:76:0E:3B:EC:1A:EF:B6:61:77:AC:7A:D7:99:62:E4:D9:87:8A:50:B2:2C:A1:44:2E:E2:D7:AC:FE:AC"}}},"request":{"raw":"GET /received/1778734320/chat/unread HTTP/1.1\r\nHost: ab.cinderlo.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ab.cinderlo.cfd/get/VQZCV7N78J\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=9iec8m9jpplc51rgqash31add3\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nserver: cloudflare\r\ndate: Tue, 22 Sep 2026 21:10:46 GMT\r\ncontent-type: text/html\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3UBDa%2Bn79ov3ahMxr0%2FEAUO%2Bsv3yT4zjjufMdB1JbjYcdk4m0qqYYjtjP4K1BWovZEBvvel2Em3AoEBGn3qLQw5sQr%2F8E3vkt%2Ft7q%2FoHyf8%2FZJ%2B4KC6YCKFhow4QTyGgF1M%3D\"}]}\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a3f44c5928fb120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":505,"size_decoded":961,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"f554227f9c9dd6d6acc625bede0d537e","sha1":"9bc18a5f0f35164189bf5cfcfca2aa2bc60ddc60","sha256":"34d76ad76c83adf293ce2900b18c73d4eb9260d6227852633d8ab976bacbdee4","sha512":"91417b06a71b9556fc6d440e3f3a6d99118486086acf5ba623e1eb03c519a24efb1fd7f25888bcdc742245d565ed2b9b64fe4dc0efac268d1102b112651eceab","ssdeep":"","tlshash":"0af09ea3b1470c0e12a915b037b2b064989679875b470e518465707f9cd1699c7537d9","first_seen":"2023-03-07T18:20:32Z","last_seen":"2026-09-22T21:11:27.235016Z","times_seen":557,"resource_available":true,"data":null}},"time_used":210,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ab.cinderlo.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"ab.cinderlo.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ab.cinderlo.cfd/cdn-cgi/rum?","fqdn":"ab.cinderlo.cfd","domain":"cinderlo.cfd","tld":"cfd"},"ip":{"addr":"104.21.30.132","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ab.cinderlo.cfd/get/VQZCV7N78J","date":"2026-09-22T21:10:46.455Z","timestamp":1790111446455,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cinderlo.cfd","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 19 Sep 2026 06:20:28 GMT","end":"Fri, 18 Dec 2026 06:20:27 GMT"},"fingerprint":{"sha1":"7E:19:84:93:D8:19:30:C8:C7:75:7C:FE:80:C9:4C:0C:B5:3D:0E:31","sha256":"87:8F:1B:76:0E:3B:EC:1A:EF:B6:61:77:AC:7A:D7:99:62:E4:D9:87:8A:50:B2:2C:A1:44:2E:E2:D7:AC:FE:AC"}}},"request":{"raw":"POST /cdn-cgi/rum? HTTP/1.1\r\nHost: ab.cinderlo.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\ncontent-type: application/json\r\nContent-Length: 637\r\nOrigin: https://ab.cinderlo.cfd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ab.cinderlo.cfd/get/VQZCV7N78J\r\nCookie: PHPSESSID=9iec8m9jpplc51rgqash31add3\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":637,"data":"{\"memory\":{},\"resources\":[],\"referrer\":\"\",\"eventType\":1,\"firstPaint\":0,\"firstContentfulPaint\":744,\"startTime\":1790111445205,\"versions\":{\"fl\":\"2024.11.0\",\"js\":\"2026.2.0\",\"timings\":2},\"pageloadId\":\"997f596b-1875-40c6-ab03-b6aa937f4c29\",\"location\":\"https://ab.cinderlo.cfd/get/VQZCV7N78J\",\"nt\":\"navigate\",\"timingsV2\":{\"nextHopProtocol\":\"\",\"domainLookupStart\":0,\"domainLookupEnd\":0,\"connectStart\":0,\"connectEnd\":0,\"requestStart\":0,\"responseStart\":0,\"responseEnd\":237,\"domInteractive\":739,\"domComplete\":1247,\"loadEventStart\":1247,\"loadEventEnd\":1247,\"transferSize\":0,\"decodedBodySize\":0},\"siteToken\":\"e66f4a0e96e94264acaeb591a391135b\",\"st\":2}"}},"response":{"raw":"HTTP/3 404 \r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Tue, 22 Sep 2026 21:10:46 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OUWsJuGCYDShvdALb6n%2B2dHRAOvYdLEesVnwGKU9ONT8GCHLh2M9GPvY5H%2FtJ2f%2Fu0WNFiACJ0peZH674vMwieMVCEk%2BOB00K760iLC9ZKHr95lv5Pr1C%2FQpJ39AeQUjgr4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncf-ray: a3f44c5c597a120a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":151,"size_decoded":873,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"45efc4779b2e6b43ed200755328af518","sha1":"badb6097a3c8fad00517f38352ba72b9f7b6637b","sha256":"d66dd0f2f24c4343661a5396e1ba76782fe651f7d422209eded956ebf90900fc","sha512":"862ceb668672d90ed3da9419ca69bf0214b5c34dec2353fea792a75fb1c0c2e5fd54e6e56cf1e9d4d60c4eaa7d98411f5cb5e128be2661d9bbd084d0dbd085e0","ssdeep":"","tlshash":"a1c02b3d35637e0c8563303522c3b190d0c6833774ba00220500c00330cb2e9cac33d7","first_seen":"2023-09-18T10:37:28Z","last_seen":"2026-09-22T21:11:27.235575Z","times_seen":19535,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ab.cinderlo.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"ab.cinderlo.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}