{"report_id":"0536eb96-835e-42cf-95a3-1f8f525b6bdb","version":0,"status":"done","tags":[],"date":"2026-09-22T21:18:04Z","url":{"schema":"http","addr":"ffslok.com/","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":0,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"ffslok.com/#/sign-in","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"title":"Crypto","dom":{"size":8744,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (3247)","md5":"3562b7c8ecbc3de2fddeb0942b6d659a","sha1":"8ba6dacd4fe3a272bd419323010f771f8e09fbef","sha256":"532caece51d334c3a4e749fffda64edf0745279dc802f3f57b707d99c93d36dd","sha512":"8a5afe523bab84953730aa476e5e6eff804fc7f349a417a7eeffc358beccce230147138e13f458c9f1fe7dda310a7aa1a7a2e225fdd4ff73e194fadfb52054d2","ssdeep":"192:e8T7Y7+ZCxfp2nfD3bL0/tg6dB1nYsYwfw:ZIiZCxB2MYpwI","tlshash":"9202852228907c5317a3c3c5f7e67d58ad95a30b82187840bddc42a54fe6ef1e4c76b6","dom_hash":"domhashd2b72bd00bd00a74b9e8f77164969ff3","first_seen":"2026-09-22T21:18:29.994624Z","last_seen":"2026-09-22T21:20:05.455002Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"ffslok.com/","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":0,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-27T21:18:04Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"h5-api.ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"echo-resssss.oss-cn-hongkong.aliyuncs.com","ip":{"addr":"47.79.64.164","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"domain_registered":"2012-04-01","domain_rank":0,"first_seen":"2026-02-27T19:52:37.379858Z","last_seen":"2026-08-28T13:10:08.868329Z","alert_count":0,"request_count":1,"received_data":486730,"sent_data":563,"comment":"","tags":null,"fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}]},{"fqdn":"h5-api.ffslok.com","ip":{"addr":"180.178.55.133","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":6,"request_count":7,"received_data":25657,"sent_data":3709,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"WebSocket","description":"WebSocket is a communication protocol that provides full-duplex communication channels over a single, long-lived connection, enabling interactive communication between web browsers and servers.","website":"https://en.wikipedia.org/wiki/WebSocket","common_platform_enumeration":"","icon":"WebSocket.svg","categories":["Miscellaneous"]}]},{"fqdn":"ffslok.com","ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":21,"request_count":21,"received_data":3088383,"sent_data":9787,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"ffslok.com/","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"334496d6c6985b4ca9b0ff9fa4f82391","sha1":"bc969d2c0c2fc078d63b2df0e8712bc929b62659","sha256":"15f7d924b28c1786fa24df90a12b52794c87fe1ca1f1d0f4c2bd23ea5e38ad85","sha512":"031690791fae734613928535c10e726fd326458e46d0479e83a85f2bc485867fd9ccc769bd7901b7b842c78b6d5e96d5761b68b02bea2fd42107371fe311fac6","ssdeep":"","tlshash":"0011abfe291a60296303404e976b7801647690a9000a184173cc9a9dbb9af7dd0cfb8c","size":1034,"data":"","first_seen":"2026-09-22T21:18:30.024758Z","last_seen":"2026-09-22T21:20:05.471032Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"cd7a34e714de94d5c29b8ac5acdde24b","sha1":"b722bccb435490630d97ef88cafeb02d92f70fd0","sha256":"312ebfdc50a0e168cff60c206811b02e944263a7d9060c2685509dacfacd7f71","sha512":"a724bc648a508c24e5bb1788e1f02b47030893bbb0b80a99e380d95480095983a35d8ec11193c53f0a67db47a289ab608fcbc9dbca846bfdd5d61a8832290f43","ssdeep":"","tlshash":"58e07d48ff28c7f316ce28ab516e770858d104d58c1b58024cebccc86935ed87291527","size":314,"data":"","first_seen":"2023-03-11T11:23:25Z","last_seen":"2026-09-22T21:57:49.790757Z","times_seen":48897,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"528dd01eb509d1fc3c68b48e165c9d77","sha1":"8d702f33d869eb8c53cf75c17014f96385322395","sha256":"b508dff20bdbd9138e31aa48c45bc501805e509d2fd4709b39c4a60cd5c6b43a","sha512":"4c1edeec560f431005363ff5291acc80c1c42edf7c9a6d6e4fde2f7539b6a35a8e36f0bc228503263277bf5df4525dc579575faadca614c32e5dfa885a2d343b","ssdeep":"","tlshash":"78a012bb71b851710cd51ba7a40455e01c20123105052c101c8d5151c011c171d394c0","size":84,"data":"","first_seen":"2023-04-07T06:55:59Z","last_seen":"2026-09-22T21:57:49.791407Z","times_seen":50196,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/charting_library/charting_library.min.js","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"2a5fa40461c4e10123b62c021ab0a4ed","sha1":"527b4a35104eda6479c5ac876f57b5375ab00f51","sha256":"bcee984fd52b4a82bd6b23543bb33f6472e076c125edbdd8756d29ca230628cb","sha512":"51c91bff846f3825a21d6b301b1e4615d05bb27defef6c39c622e647f5d0262fdb0382924c9245c4a18a11cd32b60e4c913ed451b6f4b2fec1c87ce871eb874b","ssdeep":"192:9fdWSo7ktFUnoBelr6lw2LfnzuIQPlaJ1i10K+Ei/ISJhvHIheu5Ph3Ffa5:vWS2ktFUnoIlD2LfnqIJimK+5/ISJhvB","tlshash":"58224f58ed2478720acb54f0427f180f8239e278d84944ed3c84e6ec59fd44a6a6fbb8","size":10859,"data":"","first_seen":"2024-07-11T15:08:28Z","last_seen":"2026-09-22T21:20:05.469276Z","times_seen":7335,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/#/sign-in","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"65cc32c48c6ca2b8b2fd44c1670ae667","sha1":"f2a116897b02c9bf0bb31247024703d913d0cd13","sha256":"83e989e9718ddc6751b336792e962c10faa616a9f3feaffc90f9c430e4c6d221","sha512":"bd8ce0e0a56f50ef5d499026d682702cf4fc60698a0152097cad28c8b889fcd4bdad15f87af7f14437f9cba7bac5e26d80af6bbc49249f7efbdc468ef39be9f4","ssdeep":"","tlshash":"11c08cc4a0c22d001602681110bf24e890244427704c5b028c98dc583e220b49237ed8","size":139,"data":"","first_seen":"2024-12-08T15:39:09.862859Z","last_seen":"2026-09-22T21:20:05.474143Z","times_seen":210,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/#/sign-in","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"6bfc68ca673adf29592b7f1080026574","sha1":"ea31642ffe2af1436592801a8899f159ccd82a3b","sha256":"90a28f86c845a175ad683b18ffe710f17fd7d92bdbcc4fa194446639d200cc69","sha512":"146399870300bb6b8d0aeb1a95741d9b1af123290b182c325d40837fd50efb35a9916ad72294989e0ef4ab1537e6a9bb79e033c0349f641ce5f82baeb22611c6","ssdeep":"","tlshash":"2fc080cca5f37d0516167561146f35d4d0289017704c5b02ddd4dc483f531f48237d98","size":172,"data":"","first_seen":"2025-09-27T05:00:10.576574Z","last_seen":"2026-09-22T21:20:05.474702Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/#/sign-in","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"3e883b29e312805d35e173466a244f14","sha1":"eefc298de991961468e62378b569f175c14dc818","sha256":"888088ed0d01d60fa11e8139c934fe6a06c9b3d45e59998a3f20cf13a679bbdc","sha512":"31acd3057da18e89af2375c73b699c33d07cddb0a48fda4f9e078e21190b653c7aaec6d208e34060c85253a702188510b51ea02d6569a9264fe36339cde0fbc3","ssdeep":"","tlshash":"a5c08cc4a0c22d001602651010af24e49028802674481b038c98d8482e220f08233e98","size":136,"data":"","first_seen":"2024-08-19T16:47:34.819407Z","last_seen":"2026-09-22T21:20:05.481182Z","times_seen":34,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/vendor-53e49052.js","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"3355080d4584b3c84d821f9b6a355422","sha1":"08c57a1c42087de63c4dde45ad4ec49d613e649c","sha256":"28154024be19577ebeca6cf5c3dd57105f8b70857f787bcc795205f273cf8873","sha512":"c589f1b9f83381b53181a59f732a2f74534f29448d1ee6e8dc41d2d89b1182434bb737d735712fff5947bf0ff78ba7c65b91a8f7b36b6eac0f58106e7d05482b","ssdeep":"24576:reV1VoLqIT5qxewDlNXSIvdM5gGpzWGfUHy:reV1VoLqIT5klkIvd2gGpzWGfIy","tlshash":"ba153ac57692f06157ab24e240bb0002f3396e59740e84a4f16dd8eb7d7ad89d2b7f38","size":952665,"data":"","first_seen":"2026-09-22T21:18:30.018083Z","last_seen":"2026-09-22T21:20:05.465461Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/#/sign-in","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"66f3832186e63f9e6dc840695647afd7","sha1":"c88b5b4a0ad23b5e63454693716ea7e6e9b37a4c","sha256":"11c1c2b458ec629dcc74c85cd672bb7708e34ffb7efbb68aeaeb6ac913255b71","sha512":"5424db2d753294f6a8a6c4034187ad5b9d12787552d9c5e70b8eac316ab99076b4c3710935cc347d80726007276d9b75887bd352641dae8529f2e95695256eb1","ssdeep":"","tlshash":"efc08cc4a0c36d001a06641010bf28e49034402674881b03ac94e8482e220b08233e98","size":139,"data":"","first_seen":"2024-07-02T13:45:50Z","last_seen":"2026-09-22T21:20:05.472751Z","times_seen":4733,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/#/sign-in","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"7f7087e22e9fb0739b6c02f8e48cb04a","sha1":"95a08ecba93f3b7aab887b4259c6146e34ff2466","sha256":"2e70d47bffa83b594a54437b067474ee1efa4c88d3283d2d397c4639fb1f1c19","sha512":"dbc7b09d29d1b93d9ebb6ca8f7337f95a07384299727c4e5c6d10e86f9dd704917bc5975be23a836f329a410702e01a0d208ce3ba2670fd02bffda38bd743e7f","ssdeep":"","tlshash":"59c08cc4a0c23e0026126a9460af24e8902444267049ab42cca4d8492e631f08237ea8","size":145,"data":"","first_seen":"2023-06-27T07:08:44Z","last_seen":"2026-09-22T21:20:05.473601Z","times_seen":164,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/#/sign-in","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"42f1ec1e25765b6167aa276055edb06e","sha1":"f03c0baaebc6cb10d1029381ad6d16bb9fead606","sha256":"38e75901c264a34a350fbf7fed28c84273ace577788ea49b8fe0697bbd5a2071","sha512":"5768a51fbc5431983581c055b1be4ea79a3df821aa868b1ab32b1473028e3c6df1a6cb12aabde3fd7f9783acc3b27e277c57c8db0677a5eb162e50d370fa86e4","ssdeep":"","tlshash":"79c08cc4b0da2d802602a82814af75e4a026442b704c2b428df8e8983ea24f09233ed8","size":157,"data":"","first_seen":"2026-09-22T21:18:30.031626Z","last_seen":"2026-09-22T21:20:05.477131Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/index-9f034ec2.js","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"dbab093c1d6e9d61da6606e6ad1f09d9","sha1":"996ea9010b276fd84fed7e70e42b1e7de1ad8fc3","sha256":"4955a3826306ea482da0c5d946a6d440eb68130482d8e94bc84fe07dc6816a18","sha512":"a25bfbbb54db9d3a5e904247708c9ac632d04f76665aa96eb63a53827e9552229246715b961552ec89c20fe7c2b35648155e0dbb4dff162b12f36a183804b21d","ssdeep":"1536:LTugjEHjV+ck2qNUu9KtzJHXLyv54PwRHm1Th+LHhON:LCVHjV+ckLUu4tzJHXLyv54PwRlHQN","tlshash":"7db34a8a65021fff68fe4858b91a091030ae1f96a8cccc9367be9e9537f9cd4174935c","size":112503,"data":"","first_seen":"2026-09-22T21:18:30.006889Z","last_seen":"2026-09-22T21:20:05.469866Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/#/sign-in","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"023498d4136a106119a4522dc89eff9a","sha1":"6c96d82ef412d37a6151a2dfe1401541717de40e","sha256":"e87ebe4c0aedf0e28ca04b341408a069ff8955da1d983e7d1e4e3bdee7d0d9df","sha512":"18c358ff9ea7c9f7802f77961945558b67b532c552660973974685fe887874ee631909c9798228a914710598f7507a79649f1e70c388eca64da0f88ee2873611","ssdeep":"","tlshash":"eac08cc4b0c7ae005602685014afa5e490244067b04d1b62ace8d8482e220b49233e9c","size":148,"data":"","first_seen":"2025-12-20T08:03:04.655505Z","last_seen":"2026-09-22T21:20:05.480534Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/#/sign-in","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"c7690a03fe112f4471075c532f776b2a","sha1":"f56333a82d7c86bb9a77ad6865957957f0a08840","sha256":"3176e82ebea83859f7c9ac504d3c96a2a5792977b80409f430d1f7861b2566e3","sha512":"9e2d714383ab911feeeb3edec7710944ffd71c463fe103ad05aed057527e5d797ba70cba12ef4d81411a3454b6762aad6098f6b976d2036fc97721411cdb3810","ssdeep":"","tlshash":"04c08cc4a0d32d001612a51514af24e8a028c026748c1b42cc98d8983e230b4c237ed8","size":145,"data":"","first_seen":"2024-06-14T00:55:54Z","last_seen":"2026-09-22T21:20:05.47526Z","times_seen":264,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/#/sign-in","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"ad9be46612616a75881e6ebaea8f0f39","sha1":"67007b30619b7a81bddf99d0afbdb2c6018b4d6b","sha256":"3108659c4688415a9100aa4be897a83db582888c99f8520620bfe019cede2859","sha512":"3eeb09aa1b4aaa3e4c5afc9b481bc0c6a589809f75a8329e119cd65555f36ae39cf17d03392477ebff2b29852d8ed8a59c56b583f5bc8cdcbe1c6ffac4baa2cb","ssdeep":"","tlshash":"dcc08cc4a0c32d401602a81411af24e49025402b70482b028ce4d8582e220b08233e98","size":139,"data":"","first_seen":"2023-04-15T04:17:29Z","last_seen":"2026-09-22T21:20:05.476348Z","times_seen":10411,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/#/sign-in","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"07b42b5993d327b8f9241a26cdd8cdd4","sha1":"c9bb7f93c5f9a8a6e8c328844b0562fc563000ff","sha256":"50a96a7d43a4fe20f4cbe6856c1ba243834955b0869276a294e7d2606ad0f690","sha512":"839738413f0df121475d23a9ec500ad76063bc31c79c1714ddf0c35783b267394ac67687fabd8b8cfc656497e6a9cc777be6d4fcd9634db4c94d4fb5084eda52","ssdeep":"","tlshash":"00c08cc8a0e66d101606681460bf36e49024802670485b028c94d8893e220b08233e98","size":145,"data":"","first_seen":"2026-09-22T21:18:30.03487Z","last_seen":"2026-09-22T21:20:05.478842Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/#/sign-in","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"5e4bba7a6647854575a490417d9a4f3f","sha1":"172e0b4e763f7835801f6497e9bff7a2a5bcbd60","sha256":"73b4ddc537fdf4494846c50e26f57c94084ac01a6395c987f53538f1c6ae23e1","sha512":"df100cc42610168fb1da5b3c6be6dc55536560f243017fc990775eab55369e6e741d47ed31ecc0b0139ba9b3f4840cff608e8198aca0d114837da41953ac580f","ssdeep":"","tlshash":"3ee09ee662a19505e778563959cf792da5154272bc0cce3e78b478402f72c341594c67","size":295,"data":"","first_seen":"2026-08-28T13:08:57.728247Z","last_seen":"2026-09-22T21:20:05.478151Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/zh-ab58fd16.js","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"e829e38a6290d349f0b0d4dc57b7dd6a","sha1":"8ec520ce1cce51bf9f2072fb2d5dd485c1d01104","sha256":"fa66ebe3effda0df83c3fc95c04e49759a0ebed533f96fdec432dfb08eee4b16","sha512":"13b089748116e12bd217a39f9be7a9a2531f652cffb8cad3bab5422563cc8352a1d66efa43b27c83f0d22bbe0b8ae44f707c18b8d5e0ed6364e6991f2c398fbf","ssdeep":"768:D9sgcXP80FU/WLVWLW0ebh/mgrUYxP7ePriuwq:DzcXRj5gW0e4Z","tlshash":"5003f6c43daecd9a80e3a637b04e850120f75ec6c66684191fed9ef562d8f039793b20","size":38355,"data":"","first_seen":"2026-09-22T21:18:30.017176Z","last_seen":"2026-09-22T21:20:05.461924Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/#/sign-in","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"ba8e3427f06cf210b979e4c37ac3cbba","sha1":"877f31305e48f63552e913bf3300c3055f471375","sha256":"d4380798b2a2d057db8d59b339dce9640990c1afea3fc0ab03d66cad0c2fe5ab","sha512":"8f05d6df6b531b139b33a49a0817cccaaa20fa9d142569fedf0029607cde45d89d8a3267d4ebc7b5a8c4111fd877d43717bf9554daaa2785c3cccdcbbdb6018c","ssdeep":"","tlshash":"65c08cc4a0c22d041602681151af24e4a028502a70482b82edd4d8582ea20f09233e98","size":145,"data":"","first_seen":"2026-09-22T21:18:30.037669Z","last_seen":"2026-09-22T21:20:05.479701Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"h5-api.ffslok.com/api/user/getCountryCode","fqdn":"h5-api.ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"180.178.55.133","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:34.839Z","timestamp":1790111854839,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"h5-api.ffslok.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 14:32:11 GMT","end":"Mon, 07 Dec 2026 14:32:10 GMT"},"fingerprint":{"sha1":"5F:F9:71:6D:82:0F:97:D6:15:BA:C1:A6:85:BE:95:CD:57:49:62:DC","sha256":"44:F3:1F:48:0F:53:3F:78:C5:34:EC:CB:B2:1B:34:1C:98:AA:6B:FA:C5:D3:44:5A:F2:FC:97:D8:4B:24:DD:9E"}}},"request":{"raw":"OPTIONS /api/user/getCountryCode HTTP/1.1\r\nHost: h5-api.ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang,language\r\nOrigin: https://ffslok.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:34 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://ffslok.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang, language\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":450,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":219,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":219,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"h5-api.ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5-api.ffslok.com/api/common/type/defi_activity_type","fqdn":"h5-api.ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"180.178.55.133","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:34.841Z","timestamp":1790111854841,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"h5-api.ffslok.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 14:32:11 GMT","end":"Mon, 07 Dec 2026 14:32:10 GMT"},"fingerprint":{"sha1":"5F:F9:71:6D:82:0F:97:D6:15:BA:C1:A6:85:BE:95:CD:57:49:62:DC","sha256":"44:F3:1F:48:0F:53:3F:78:C5:34:EC:CB:B2:1B:34:1C:98:AA:6B:FA:C5:D3:44:5A:F2:FC:97:D8:4B:24:DD:9E"}}},"request":{"raw":"OPTIONS /api/common/type/defi_activity_type HTTP/1.1\r\nHost: h5-api.ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang,language\r\nOrigin: https://ffslok.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:34 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://ffslok.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang, language\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":450,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":219,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":219,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"h5-api.ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-22T21:17:30.293Z","timestamp":1790111850293,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:31 GMT\r\ncontent-type: text/html\r\nlast-modified: Tue, 22 Sep 2026 12:55:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27ad7-14af\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5295,"size_decoded":2116,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1094), with CRLF, LF line terminators","md5":"24bd01ba760c2b61ccb0a9828a4333e9","sha1":"a8df838976ad3d5cecd5c78a33f22f6812aebeb0","sha256":"dbc7c292ed7986b8c6229e33155bfea7286575baea54d88e8b69e1a17e386dd6","sha512":"236dfc7928fe6c50bb325570e26f0e3e513f5871d12f6ad6fd59a07fba5ead7ea393f2a0ff729218944068423c7c7253aad09b0f7336beaf804a89052aacc8b4","ssdeep":"96:+r82L2f53uSP6luO4t/4lr6TCZydHRH/gH2mUsGKAiowGwuB1niHMiHQH/2:+Fq9P6QqZCxfu2nfD3bwuB1nisiwf2","tlshash":"88b140b36da0881a23b1012aeed7f41cdfa1519385195854b1cc40ee8fe6fe584dbb6a","first_seen":"2026-09-22T21:18:29.999325Z","last_seen":"2026-09-22T21:20:05.464792Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1096,"timings":{"blocked":0,"dns":241,"connect":217,"send":0,"wait":216,"receive":0,"ssl":422},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/language-6f76e5e0.png","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:34.824Z","timestamp":1790111854824,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /assets/language-6f76e5e0.png HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:34 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 22 Sep 2026 12:55:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27ad7-647\"\r\nexpires: Thu, 22 Oct 2026 21:17:34 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1607,"size_decoded":1981,"mime_type":"image/png","magic":"PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced","md5":"e046ada889a5c3d69634f6b14dbe0ea0","sha1":"c50ca991ba66cc890cc5eb028118ce610ce99881","sha256":"6f76e5e0b74595b9ebf143cfdd220c4a407be5ce15ff64505e46a31246b6a5e5","sha512":"836e9aefb7b76c43d481b4714ff764b66485450fb39179e6a5352e546a8f67e7ef5a0b60dd66d2401e15eab7535355e950aac2ddbd9fbb31fa235978a88c3e2b","ssdeep":"","tlshash":"b3310ab9d6b2477ce7b84196c6c4f57058b83aa65234db0f2517fc5394b51ab0a23e04","first_seen":"2025-07-28T13:32:09.8142Z","last_seen":"2026-09-22T21:20:05.457567Z","times_seen":9,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"echo-resssss.oss-cn-hongkong.aliyuncs.com/echo2.0c73d752f967840659958726f45cba761.png","fqdn":"echo-resssss.oss-cn-hongkong.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.64.164","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:35.116Z","timestamp":1790111855116,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"oss-cn-hongkong.aliyuncs.com","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 04 Feb 2026 11:46:56 GMT","end":"Mon, 08 Mar 2027 11:46:55 GMT"},"fingerprint":{"sha1":"07:DD:45:99:F9:D3:55:D6:EB:41:00:22:C7:FA:B0:8F:DB:0B:E9:4C","sha256":"F5:2E:3B:65:89:04:A9:28:79:6A:C1:49:B6:17:06:AB:A8:09:30:D8:2A:1F:43:B7:BB:27:72:92:C0:3C:54:F8"}}},"request":{"raw":"GET /echo2.0c73d752f967840659958726f45cba761.png HTTP/1.1\r\nHost: echo-resssss.oss-cn-hongkong.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Tue, 22 Sep 2026 21:17:36 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 486153\r\nConnection: keep-alive\r\nx-oss-request-id: 6AB2F070CE63A83732FD8084\r\nAccept-Ranges: bytes\r\nETag: \"19CB884553FC12F389F7CC187FA9D044\"\r\nLast-Modified: Sat, 05 Sep 2026 21:27:33 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 10315728275505826987\r\nx-oss-storage-class: Standard\r\nCache-Control: no-cache\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: GcuIRVP8EvOJ98wYf6nQRA==\r\nx-oss-server-time: 4\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":486153,"size_decoded":486730,"mime_type":"image/png","magic":"PNG image data, 2048 x 2048, 8-bit/color RGBA, non-interlaced","md5":"19cb884553fc12f389f7cc187fa9d044","sha1":"9cc44634d16380b50c6db852be04532f5d8e8665","sha256":"26b7138d934329968fd43382d40ba6377aaf6a6ea1654cda1b40b21c73754ba2","sha512":"5c3ce52573c2ef0c4fef12c01b345c709dbdfef23d58bc1800eeae5ff04bf944066edf1e01a20184cbf4eddb45956680e10340d6ef22b96cfeb37d41b68cc572","ssdeep":"12288:2yyP2cee4sCbj6QlhSC3ozN7iHHrSuG/c3YlgbxopA:kP+eTwrgwLj3IgopA","tlshash":"fca4235ab3b6182aceb3923f92dd8d376f61280bb980711d0663f28f49c5a75d36051f","first_seen":"2026-09-22T21:18:30.002071Z","last_seen":"2026-09-22T21:20:05.459282Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2361,"timings":{"blocked":-1,"dns":30,"connect":274,"send":0,"wait":280,"receive":954,"ssl":823},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/resource/fonts/Arial.ttf","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:32.764Z","timestamp":1790111852764,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /resource/fonts/Arial.ttf HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ffslok.com/assets/index-5b988fa6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:32 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 1047012\r\nlast-modified: Wed, 01 Nov 2023 13:05:30 GMT\r\netag: \"65424d1a-ff9e4\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1047012,"size_decoded":1047301,"mime_type":"application/octet-stream","magic":"TrueType Font data, digitally signed, 25 tables, 1st \"DSIG\", 58 names, Unicode, � 2017 The Monotype Corporation. All Rights Reserved. ","md5":"ffe66dbfc4b07f36ef38dd621ad2c7cc","sha1":"e032b102cfc37c3226d17e1b462edea5fbf8fe1c","sha256":"c1216a01b3cc4e94df72577a6f618154058a1d8999ed58fa31ab7e54c7e4be4b","sha512":"3c7952b71c8117938c5284efca0e0b3e8c20d7b84c74a4890f76a72af3b26295786b0f7c33d9b6c980527b4c4c8dad628d1f5e7e5f202d11076367f082349bb3","ssdeep":"24576:NoQIQRjo/Y7wjgTmKJ4WxA7EAD4OBfDamXKE6AMra:NHIQJo/Y7wjgTm0PxAwJHE6hG","tlshash":"f125be0bf3929f0fe3902b38c9a5d761939b76189b2743b73d8c5858ecc85a45e487d2","first_seen":"2023-07-29T15:16:45Z","last_seen":"2026-09-22T21:40:26.146749Z","times_seen":8259,"resource_available":false,"data":null}},"time_used":483,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":218,"receive":265,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5-api.ffslok.com/api/common/getAllSetting","fqdn":"h5-api.ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"180.178.55.133","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:33.141Z","timestamp":1790111853141,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"h5-api.ffslok.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 14:32:11 GMT","end":"Mon, 07 Dec 2026 14:32:10 GMT"},"fingerprint":{"sha1":"5F:F9:71:6D:82:0F:97:D6:15:BA:C1:A6:85:BE:95:CD:57:49:62:DC","sha256":"44:F3:1F:48:0F:53:3F:78:C5:34:EC:CB:B2:1B:34:1C:98:AA:6B:FA:C5:D3:44:5A:F2:FC:97:D8:4B:24:DD:9E"}}},"request":{"raw":"OPTIONS /api/common/getAllSetting HTTP/1.1\r\nHost: h5-api.ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://ffslok.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:34 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://ffslok.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":440,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":997,"timings":{"blocked":0,"dns":112,"connect":212,"send":0,"wait":223,"receive":0,"ssl":450},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"h5-api.ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/theme-9cebe652.png","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:34.822Z","timestamp":1790111854822,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /assets/theme-9cebe652.png HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:34 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 22 Sep 2026 12:55:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27ad7-d7a\"\r\nexpires: Thu, 22 Oct 2026 21:17:34 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3450,"size_decoded":3824,"mime_type":"image/png","magic":"PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced","md5":"49e5b15d6114c9cecaa33e896f8ba785","sha1":"5f850113de6ff1163d0af1324ff5b3543e2b76f0","sha256":"9cebe65235f5c1ab63abebd0f95e975f27690134d5ce193b4715c116b22bf612","sha512":"3bdfa6357174c1d755cb2c65b033260323375e59776b5190715e22cfbe73afb37f7c1b08bb5e19fd336a463a8bd59e7b01fe54b2bad9eed3bd17fecc9b24f2d9","ssdeep":"","tlshash":"08617e856450296e100a0bed3a6fed464a13e698e3557c0cdcfd824fde75d413c31b4b","first_seen":"2026-09-22T21:18:30.003936Z","last_seen":"2026-09-22T21:20:05.467537Z","times_seen":2,"resource_available":false,"data":null}},"time_used":222,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":222,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5-api.ffslok.com/api/user/getCountryCode","fqdn":"h5-api.ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"180.178.55.133","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:34.831Z","timestamp":1790111854831,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"h5-api.ffslok.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 14:32:11 GMT","end":"Mon, 07 Dec 2026 14:32:10 GMT"},"fingerprint":{"sha1":"5F:F9:71:6D:82:0F:97:D6:15:BA:C1:A6:85:BE:95:CD:57:49:62:DC","sha256":"44:F3:1F:48:0F:53:3F:78:C5:34:EC:CB:B2:1B:34:1C:98:AA:6B:FA:C5:D3:44:5A:F2:FC:97:D8:4B:24:DD:9E"}}},"request":{"raw":"POST /api/user/getCountryCode HTTP/1.1\r\nHost: h5-api.ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nlanguage: zh\r\nlang: zh\r\nOrigin: https://ffslok.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:35 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://ffslok.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22018,"size_decoded":5658,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (20211), with no line terminators","md5":"ec520b3418b581b9b42e2cc0d95ab2bf","sha1":"58b482f8adfa2ae036d957b880fd0c0879944736","sha256":"b97120c2c7995a2b13bb06e5ebe79fbea4f97a04eadb63431f57d3b8a0f54ee1","sha512":"bfed4de1b10c5c8095d1363569674d0d8ab162d7ffe682811df3e173c4de42aad0bdb0f0575b267ad0b479509bc0fc495d89b64a71a8840d1ece8e76c0008778","ssdeep":"192:0N412kx/U7/cLVkL/GWJfQXvAYLB4lVDiZ6OU1L2cCDQHk3jnB8LWlAQnZU/6Eun:0NouXcvAz2Z6UFSy2WQ2gn1C","tlshash":"32a22f7e650cfd6dbf24a6e3a04b27390ab5b1bd06c85c1bd5cc9eb2f2d16a92431530","first_seen":"2025-09-21T22:51:26.860054Z","last_seen":"2026-09-22T21:18:30.00514Z","times_seen":102,"resource_available":true,"data":null}},"time_used":264,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":264,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"h5-api.ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/fudu-2532505c.png","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:34.832Z","timestamp":1790111854832,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /assets/fudu-2532505c.png HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:34 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 22 Sep 2026 12:55:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27ad7-ede\"\r\nexpires: Thu, 22 Oct 2026 21:17:34 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3806,"size_decoded":4180,"mime_type":"image/png","magic":"PNG image data, 41 x 21, 8-bit/color RGBA, non-interlaced","md5":"9f5f9f86102b4320b76af3cd6b5da9a5","sha1":"ff4e51fe75e5d31a5e14af73c48b5459b591205e","sha256":"2532505c6858c439123820ea912e4c2454ae72467e5c7c2415c4b8aa197ef7fa","sha512":"50f2c86d437414b255bc6dd166a8ca8b0dee17446c08242293bb90e1771c41e0a729126c5857a2d199cdead0d988a46a451cf2df87a9ba766ee2da57bdff6a83","ssdeep":"","tlshash":"8e716d8a7148496d16ca4bb9693f9f024926da4062082fcccae9930f9610d717c6aeda","first_seen":"2026-09-22T21:18:30.005726Z","last_seen":"2026-09-22T21:20:05.456778Z","times_seen":2,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/index-9f034ec2.js","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:31.641Z","timestamp":1790111851641,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /assets/index-9f034ec2.js HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 22 Sep 2026 13:05:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27d33-1b777\"\r\nexpires: Wed, 23 Sep 2026 09:17:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":112503,"size_decoded":31700,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65146), with no line terminators","md5":"dbab093c1d6e9d61da6606e6ad1f09d9","sha1":"996ea9010b276fd84fed7e70e42b1e7de1ad8fc3","sha256":"4955a3826306ea482da0c5d946a6d440eb68130482d8e94bc84fe07dc6816a18","sha512":"a25bfbbb54db9d3a5e904247708c9ac632d04f76665aa96eb63a53827e9552229246715b961552ec89c20fe7c2b35648155e0dbb4dff162b12f36a183804b21d","ssdeep":"1536:LTugjEHjV+ck2qNUu9KtzJHXLyv54PwRHm1Th+LHhON:LCVHjV+ckLUu4tzJHXLyv54PwRlHQN","tlshash":"7db34a8a65021fff68fe4858b91a091030ae1f96a8cccc9367be9e9537f9cd4174935c","first_seen":"2026-09-22T21:18:30.006889Z","last_seen":"2026-09-22T21:20:05.469866Z","times_seen":2,"resource_available":true,"data":null}},"time_used":430,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":430,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/platform/dev/favicon.ico?2.0.1790081751116","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:33.557Z","timestamp":1790111853557,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /platform/dev/favicon.ico?2.0.1790081751116 HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:33 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 4286\r\nlast-modified: Sun, 10 Nov 2024 13:45:57 GMT\r\netag: \"6730b915-10be\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4286,"size_decoded":4559,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"775b5315c2d47212f536c3c6d601fc31","sha1":"972ef2b0de8b8fb968a214858e0877e800169f3c","sha256":"e0e03f101b546191ce10790e32fe237a5624c3cb8a3f622744386f2e7a67be62","sha512":"696116effa94b434b09669a92d9673ba1be26ebac2478505ed133decce96bb7d74601d38c069a0693f3c1f7cffd124c4e8cf59e6de46fc74d0bd8944522ed2fd","ssdeep":"96:iwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwy:hn25","tlshash":"9f91991d24104eadf7da0b3404916a6abce1ac3385883d5fd695b26acf355b320fb61e","first_seen":"2026-01-11T16:22:54.666418Z","last_seen":"2026-09-22T21:20:05.461422Z","times_seen":9,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/theme-5e44d7f6.png","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:34.820Z","timestamp":1790111854820,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /assets/theme-5e44d7f6.png HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:34 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 22 Sep 2026 12:55:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27ad7-4aa\"\r\nexpires: Thu, 22 Oct 2026 21:17:34 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1194,"size_decoded":1568,"mime_type":"image/png","magic":"PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced","md5":"b618d2ea4faafb9b8468911177a7e8df","sha1":"e0e019745dfad67f94376225e5cb5f5ef1b634e4","sha256":"5e44d7f6bc3e8c413a6a27f80bcb63fec634091a876e1aaec87716de93c996eb","sha512":"f37f43ebc64531ea628d3794061d33fe398d0720c5a46c16d380dcaa1779a4f0e0108062a2d6dcc20cd2619930ed557c9e540089a0ae5c4c0bdd035970062643","ssdeep":"","tlshash":"7821e48303a8d439035fec6ec9464858a24f489aa022cf81ba7bbd3b222719451a916b","first_seen":"2025-07-28T13:32:09.831281Z","last_seen":"2026-09-22T21:20:05.470526Z","times_seen":9,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/language-c7b5e05a.png","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:34.826Z","timestamp":1790111854826,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /assets/language-c7b5e05a.png HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:34 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 22 Sep 2026 12:55:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27ad7-e82\"\r\nexpires: Thu, 22 Oct 2026 21:17:34 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3714,"size_decoded":4088,"mime_type":"image/png","magic":"PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced","md5":"9c6eb7806340a3cb377265a6d0c4f3c7","sha1":"f42b994d503f5a172cd4a21b41462267ed07f292","sha256":"c7b5e05a380f3bc088bae7429426342b984a9ae67a3c3318bcb61d1ecf72b26b","sha512":"883eeea9274641358431168d12b466f931434b6c7a195a26a540e4b20edd523e14c0e49a0fecb0b5a41a52269f8cfe5b3ee546e464452274e998cd910af83339","ssdeep":"","tlshash":"bf719ec86c60442a10490bb7626bef010a47ebe4531e5f2c99fe524f9730e113cb4f67","first_seen":"2026-09-22T21:18:30.01126Z","last_seen":"2026-09-22T21:20:05.458117Z","times_seen":2,"resource_available":false,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":220,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/service-3ed634d1.png","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:34.827Z","timestamp":1790111854827,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /assets/service-3ed634d1.png HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:34 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 22 Sep 2026 12:55:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27ad7-440\"\r\nexpires: Thu, 22 Oct 2026 21:17:34 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1088,"size_decoded":1460,"mime_type":"image/png","magic":"PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced","md5":"f26333d9715aa3998de707461b1b3fc4","sha1":"23cb4e209894ff778cb03c7dc5f4f4e3210ed338","sha256":"3ed634d1efd0d25c4546b37b01f224a4e9ad6d325b434a425f541ae43ac51cb5","sha512":"8b448c2237a922daf2f373d0b441a38f49abb1ee63211b7e54bf39f3fa207fe29bbb94484228ed77aaa6f3b54fbea14c184a68920acadae43ceabd05c6a33bb7","ssdeep":"","tlshash":"3711b9cab7de36b4cc485e35e34629aacc775b11076bd879cd8910609547cd4419c70b","first_seen":"2026-07-08T14:56:22.356574Z","last_seen":"2026-09-22T21:20:05.456021Z","times_seen":3,"resource_available":false,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":220,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/service-d09ed614.png","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:34.829Z","timestamp":1790111854829,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /assets/service-d09ed614.png HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:34 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 22 Sep 2026 12:55:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27ad7-d51\"\r\nexpires: Thu, 22 Oct 2026 21:17:34 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3409,"size_decoded":3783,"mime_type":"image/png","magic":"PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced","md5":"eda4e36642feb0cffda415aa7a6c718d","sha1":"ddb821370b65f13332bf00df0a9807fee5bc5d68","sha256":"d09ed614cdb1f5a6b5d1f048444f10f46eae472fea91e7076592f54ee4dd3b2c","sha512":"4bee95905692cb50c839187fc2935061866d1e138b700363b2bc260d72e4e5ff2d379a8d417ec14dde8f9bd06afd283024360152e9063b19b572547a09462e72","ssdeep":"","tlshash":"7c613b8915444daf100e1b66257fdf09463bf6c892695e1cadfa824e9724c123c7176b","first_seen":"2026-09-22T21:18:30.013198Z","last_seen":"2026-09-22T21:20:05.468276Z","times_seen":2,"resource_available":false,"data":null}},"time_used":219,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":219,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/vendor-e77f7878.css","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:31.651Z","timestamp":1790111851651,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /assets/vendor-e77f7878.css HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:31 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 22 Sep 2026 12:55:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27ad7-159b2\"\r\nexpires: Wed, 23 Sep 2026 09:17:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":88498,"size_decoded":37314,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65018), with no line terminators","md5":"600a6e4edf24fa66c53c6b81640d1715","sha1":"499dbb0c2840150f8c2ffcf3cdbe5cb0590fef37","sha256":"e77f7878b551ad78cd703660d9ded0d74b3d068d7778f5290d5f14d4a7fcb0ef","sha512":"dc05553b707f33bcf1caefa9fec3234b61f2ae501b1da045e46f13d36e17ea7504e8f8803f80d70252c6933124d574870d122f750ce8883e2fe1ae50818da32b","ssdeep":"1536:BtIyNBi3MFYaQj7FCwsBlDOFIxuVox8D/4:BnNIClDsIxuVS8M","tlshash":"7383e5a5a9c461fc6f2ae2659b4765e8f13cf671cc01daa0f105511d0fcbbf60613a3a","first_seen":"2026-09-22T21:18:30.01407Z","last_seen":"2026-09-22T21:20:05.463021Z","times_seen":2,"resource_available":true,"data":null}},"time_used":859,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":859,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/index-5b988fa6.css","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:31.658Z","timestamp":1790111851658,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /assets/index-5b988fa6.css HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:31 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 22 Sep 2026 12:55:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27ad7-4c538\"\r\nexpires: Wed, 23 Sep 2026 09:17:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":312632,"size_decoded":67715,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65018), with no line terminators","md5":"36c9542b73bb8e1a6ec1dd7b9cba943d","sha1":"0ba7faf8d40e833ef9bf080e3e7b745833aa6d6a","sha256":"5b988fa63773dd43324c75f3e1d9eee5b4eb078ebdaf27aa7306b7bc1f31c488","sha512":"713163319d1e64a190cc27c0e622cff6e61e8899597eceb8fe0417efa2570bd7cf77feb4d77b49fbb1419c1fcccd11ede43bbbd4667407e87e6fb913efcdb7ea","ssdeep":"6144:n8vxsaTJ03EkZ8w71ZACkFDS3vyf58rBeV05TnDetQJo:8v1+3dZ8w71ZACkFDS3vyf58rBeV05Tq","tlshash":"7a64d7a9a590117c6f27aa759bce5ad8f23ce6719c118de8f20120094fc7ff92363617","first_seen":"2026-09-22T21:18:30.015196Z","last_seen":"2026-09-22T21:20:05.46402Z","times_seen":2,"resource_available":true,"data":null}},"time_used":851,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":851,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/platform/dev/config.js?1790111853134","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:33.137Z","timestamp":1790111853137,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /platform/dev/config.js?1790111853134 HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:33 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 269\r\nlast-modified: Sat, 28 Mar 2026 13:31:58 GMT\r\netag: \"69c7d84e-10d\"\r\nexpires: Wed, 23 Sep 2026 09:17:33 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":269,"size_decoded":620,"mime_type":"application/javascript","magic":"ASCII text, with CRLF line terminators","md5":"bb64cac8540fc5924accdf787b912ac9","sha1":"f595168f3f5c9b06d27106e42371913c6564cde7","sha256":"9782ff185a518308f4149880113c6749aa65ffb876adc0252cf1963f2a22ecee","sha512":"3a3b5a897ac074525999b54b64cbf836f3baa18a074edf059bc6f537bdb69a5373a8a7d3609db705f5d6a48f26a60304cba9ead0570da3da9b439aa1a02119a1","ssdeep":"","tlshash":"c4d092e662a18605e778463959cf7a2da6064272bc0cce3e78b868402f72c3405a4863","first_seen":"2026-08-28T13:08:57.699424Z","last_seen":"2026-09-22T21:20:05.467033Z","times_seen":4,"resource_available":true,"data":null}},"time_used":217,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5-api.ffslok.com/api/common/getCoinList","fqdn":"h5-api.ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"180.178.55.133","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:33.145Z","timestamp":1790111853145,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"h5-api.ffslok.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 14:32:11 GMT","end":"Mon, 07 Dec 2026 14:32:10 GMT"},"fingerprint":{"sha1":"5F:F9:71:6D:82:0F:97:D6:15:BA:C1:A6:85:BE:95:CD:57:49:62:DC","sha256":"44:F3:1F:48:0F:53:3F:78:C5:34:EC:CB:B2:1B:34:1C:98:AA:6B:FA:C5:D3:44:5A:F2:FC:97:D8:4B:24:DD:9E"}}},"request":{"raw":"OPTIONS /api/common/getCoinList HTTP/1.1\r\nHost: h5-api.ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://ffslok.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:34 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://ffslok.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":440,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":1154,"timings":{"blocked":0,"dns":109,"connect":206,"send":0,"wait":219,"receive":0,"ssl":619},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"h5-api.ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/zh-ab58fd16.js","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:34.549Z","timestamp":1790111854549,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /assets/zh-ab58fd16.js HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:34 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 22 Sep 2026 12:55:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27ad7-9763\"\r\nexpires: Wed, 23 Sep 2026 09:17:34 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":38755,"size_decoded":14632,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (28582)","md5":"e829e38a6290d349f0b0d4dc57b7dd6a","sha1":"8ec520ce1cce51bf9f2072fb2d5dd485c1d01104","sha256":"fa66ebe3effda0df83c3fc95c04e49759a0ebed533f96fdec432dfb08eee4b16","sha512":"13b089748116e12bd217a39f9be7a9a2531f652cffb8cad3bab5422563cc8352a1d66efa43b27c83f0d22bbe0b8ae44f707c18b8d5e0ed6364e6991f2c398fbf","ssdeep":"768:D9sgcXP80FU/WLVWLW0ebh/mgrUYxP7ePriuwq:DzcXRj5gW0e4Z","tlshash":"5003f6c43daecd9a80e3a637b04e850120f75ec6c66684191fed9ef562d8f039793b20","first_seen":"2026-09-22T21:18:30.017176Z","last_seen":"2026-09-22T21:20:05.461924Z","times_seen":2,"resource_available":true,"data":null}},"time_used":220,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":220,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/vendor-53e49052.js","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:31.648Z","timestamp":1790111851648,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /assets/vendor-53e49052.js HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 22 Sep 2026 12:55:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27ad7-e8959\"\r\nexpires: Wed, 23 Sep 2026 09:17:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":952665,"size_decoded":313457,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"3355080d4584b3c84d821f9b6a355422","sha1":"08c57a1c42087de63c4dde45ad4ec49d613e649c","sha256":"28154024be19577ebeca6cf5c3dd57105f8b70857f787bcc795205f273cf8873","sha512":"c589f1b9f83381b53181a59f732a2f74534f29448d1ee6e8dc41d2d89b1182434bb737d735712fff5947bf0ff78ba7c65b91a8f7b36b6eac0f58106e7d05482b","ssdeep":"24576:reV1VoLqIT5qxewDlNXSIvdM5gGpzWGfUHy:reV1VoLqIT5klkIvd2gGpzWGfIy","tlshash":"ba153ac57692f06157ab24e240bb0002f3396e59740e84a4f16dd8eb7d7ad89d2b7f38","first_seen":"2026-09-22T21:18:30.018083Z","last_seen":"2026-09-22T21:20:05.465461Z","times_seen":2,"resource_available":true,"data":null}},"time_used":640,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":640,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/platform/dev/logo_144.png?2.0.1790081751116","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:33.556Z","timestamp":1790111853556,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /platform/dev/logo_144.png?2.0.1790081751116 HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:33 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 01 Nov 2023 13:05:30 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65424d1a-b5c\"\r\nexpires: Thu, 22 Oct 2026 21:17:33 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2908,"size_decoded":3282,"mime_type":"image/png","magic":"PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced","md5":"9a5a67a3b984ab223eef25ac3f419432","sha1":"5b07513414db526d86d32c3b8f42c0dbb62a8e71","sha256":"38055609c5d61aad696e97b746489c7f886b79cc069326312c6a111062019777","sha512":"4f610ac72700d9727ff6d32567b7d71a582a8c87eb067e4f33a8a910c66968514277df68c0794d1db6ce3a94ed0111003a71afd8cab40dcb3bc062dfb9f14bad","ssdeep":"","tlshash":"0c5119e6d89d003a4dd329b7b0f03e45fe7ab5fb5ab6330480972b3065552ab84d8327","first_seen":"2024-10-20T08:32:52.883488Z","last_seen":"2026-09-22T21:20:05.460925Z","times_seen":327,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/assets/bg-c7493b6c.png","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:34.842Z","timestamp":1790111854842,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /assets/bg-c7493b6c.png HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:34 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 22 Sep 2026 12:55:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab27ad7-76a7f\"\r\nexpires: Thu, 22 Oct 2026 21:17:34 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":486015,"size_decoded":486278,"mime_type":"image/png","magic":"PNG image data, 750 x 744, 8-bit/color RGBA, non-interlaced","md5":"84d15602260722682e01e1bb82514522","sha1":"7ea6507d3ab91d7c61b6c1298f587e6e72d8e521","sha256":"c7493b6c1e175084e73fb3ab4c9e66a7109df98494098847e346d0cc2b8ecca8","sha512":"fee319a3738167471af42f41fb8161f6dccf21e7c2850429b7b68c6063f5aa348661a87d1597dd7b6d88253b8cf626112afa77e91afa284c1de56e92ca407b0c","ssdeep":"12288:Ot+0ZLFtfUdzdGRuIGJYt1Vm2fDpc6iir+vg9xnk1ETUSq:Og0ZJtfUVdQuIGJYVDpxii9HM97","tlshash":"30a4236ffaa011e4ed9c18d272d9ebc7cd8710a856fb0160189c9bcb794a0fc6e514bd","first_seen":"2025-07-28T13:32:09.844333Z","last_seen":"2026-09-22T21:20:05.460425Z","times_seen":9,"resource_available":false,"data":null}},"time_used":218,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/charting_library/charting_library.min.js","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:31.636Z","timestamp":1790111851636,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /charting_library/charting_library.min.js HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:31 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 01 Nov 2023 13:05:30 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65424d1a-2a6b\"\r\nexpires: Wed, 23 Sep 2026 09:17:31 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10859,"size_decoded":3537,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10857), with CRLF line terminators","md5":"2a5fa40461c4e10123b62c021ab0a4ed","sha1":"527b4a35104eda6479c5ac876f57b5375ab00f51","sha256":"bcee984fd52b4a82bd6b23543bb33f6472e076c125edbdd8756d29ca230628cb","sha512":"51c91bff846f3825a21d6b301b1e4615d05bb27defef6c39c622e647f5d0262fdb0382924c9245c4a18a11cd32b60e4c913ed451b6f4b2fec1c87ce871eb874b","ssdeep":"192:9fdWSo7ktFUnoBelr6lw2LfnzuIQPlaJ1i10K+Ei/ISJhvHIheu5Ph3Ffa5:vWS2ktFUnoIlD2LfnqIJimK+5/ISJhvB","tlshash":"58224f58ed2478720acb54f0427f180f8239e278d84944ed3c84e6ec59fd44a6a6fbb8","first_seen":"2024-07-11T15:08:28Z","last_seen":"2026-09-22T21:20:05.469276Z","times_seen":7335,"resource_available":true,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://h5-api.ffslok.com/ws/f1a51140-be8b-4b14-9167-fd2a666aa055","fqdn":"h5-api.ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"180.178.55.133","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:33.258Z","timestamp":1790111853258,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"h5-api.ffslok.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 14:32:11 GMT","end":"Mon, 07 Dec 2026 14:32:10 GMT"},"fingerprint":{"sha1":"5F:F9:71:6D:82:0F:97:D6:15:BA:C1:A6:85:BE:95:CD:57:49:62:DC","sha256":"44:F3:1F:48:0F:53:3F:78:C5:34:EC:CB:B2:1B:34:1C:98:AA:6B:FA:C5:D3:44:5A:F2:FC:97:D8:4B:24:DD:9E"}}},"request":{"raw":"GET /ws/f1a51140-be8b-4b14-9167-fd2a666aa055 HTTP/1.1\r\nHost: h5-api.ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://ffslok.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: xucgfy5HSMjECrp7XoX7oQ==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 \r\nServer: nginx\r\nDate: Tue, 22 Sep 2026 21:17:34 GMT\r\nConnection: upgrade\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nAccess-Control-Allow-Origin: https://ffslok.com\r\nAccess-Control-Allow-Credentials: true\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: Sv8yE0b8eFw9MOYQL3DuxJ3Wuj0=\r\nSec-WebSocket-Extensions: permessage-deflate\r\nX-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"WebSocket","description":"WebSocket is a communication protocol that provides full-duplex communication channels over a single, long-lived connection, enabling interactive communication between web browsers and servers.","website":"https://en.wikipedia.org/wiki/WebSocket","common_platform_enumeration":"","icon":"WebSocket.svg","categories":["Miscellaneous"]}],"data":{"size":0,"size_decoded":440,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-22T23:48:35.854858Z","times_seen":18608177,"resource_available":true,"data":null}},"time_used":2741,"timings":{"blocked":0,"dns":1050,"connect":1260,"send":0,"wait":214,"receive":0,"ssl":217},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/resource/svg/light/jiantou10x5-x.svg?2.0.1790081751116","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:34.833Z","timestamp":1790111854833,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /resource/svg/light/jiantou10x5-x.svg?2.0.1790081751116 HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:34 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 281\r\nlast-modified: Wed, 01 Nov 2023 13:05:32 GMT\r\netag: \"65424d1c-119\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":281,"size_decoded":553,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5072b7b231db2ac3ee3dfd41c956ba5b","sha1":"7b6e605cf4b8b9ad289a750adf276d0537010f99","sha256":"d14e9fb7f9663b10f8c461b29f0560856ea41f1f96ee3da44c2dd79382856440","sha512":"2799b9465315adbbb28944eb457490472a3c8f5409e39464b0f4f0aabc746674faddb83f9385d1579c0ba15db78c19c87ccbe9e354f515445d7cbb8314fc8e98","ssdeep":"","tlshash":"05d02b7a80898d8995045e3177e82298426eb4c3d25744f5f7d105774a7088719fdba8","first_seen":"2025-12-25T22:01:33.808911Z","last_seen":"2026-09-22T21:20:05.462543Z","times_seen":4,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5-api.ffslok.com/api/common/type/defi_activity_type","fqdn":"h5-api.ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"180.178.55.133","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:34.835Z","timestamp":1790111854835,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"h5-api.ffslok.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 08 Sep 2026 14:32:11 GMT","end":"Mon, 07 Dec 2026 14:32:10 GMT"},"fingerprint":{"sha1":"5F:F9:71:6D:82:0F:97:D6:15:BA:C1:A6:85:BE:95:CD:57:49:62:DC","sha256":"44:F3:1F:48:0F:53:3F:78:C5:34:EC:CB:B2:1B:34:1C:98:AA:6B:FA:C5:D3:44:5A:F2:FC:97:D8:4B:24:DD:9E"}}},"request":{"raw":"POST /api/common/type/defi_activity_type HTTP/1.1\r\nHost: h5-api.ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nlanguage: zh\r\nlang: zh\r\nOrigin: https://ffslok.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:35 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://ffslok.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":635,"size_decoded":665,"mime_type":"application/json","magic":"JSON text data","md5":"de1360b2f7f65d78c90793b7d9933bea","sha1":"232be3ac99edfdd6e2f3c8f532c8da150ecbd5e9","sha256":"411d365a425ca7223e376e3cb00c9d9a5506c258dfe520b2b9e8b45400842e9d","sha512":"da7efe25a534c01ef5a5b71cbf78a94eafb977e8eeed08b7607c4fc1ec341b6ee669eb3c836c564bf60d6e8222422e57065db12ccf52a7412ab3945d3c64db1c","ssdeep":"","tlshash":"a9f028143d3dcebf0d8f65e745ec7814299c052794b0fca058ab0f3c5ae4172448920c","first_seen":"2026-09-22T21:18:30.022949Z","last_seen":"2026-09-22T21:18:30.022949Z","times_seen":1,"resource_available":true,"data":null}},"time_used":225,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":225,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"h5-api.ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ffslok.com/resource/svg/light/yanjin-g.svg?2.0.1790081751116","fqdn":"ffslok.com","domain":"ffslok.com","tld":"com"},"ip":{"addr":"182.16.59.213","port":443,"asn":45753,"as":"Netsec Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ffslok.com/","date":"2026-09-22T21:17:34.837Z","timestamp":1790111854837,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ffslok.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 18 Sep 2026 21:16:49 GMT","end":"Thu, 17 Dec 2026 21:16:48 GMT"},"fingerprint":{"sha1":"65:94:0D:F9:75:25:76:A3:07:A6:1E:89:3B:02:F6:BF:7D:5C:24:9F","sha256":"27:F6:77:76:07:0D:4F:44:30:2E:B7:BC:81:5B:DC:50:A1:D1:13:86:41:44:53:D7:DF:10:C3:85:7A:02:00:73"}}},"request":{"raw":"GET /resource/svg/light/yanjin-g.svg?2.0.1790081751116 HTTP/1.1\r\nHost: ffslok.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 22 Sep 2026 21:17:34 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 01 Nov 2023 13:05:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65424d1c-487\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1159,"size_decoded":898,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"726fe5e89944d2c8d3c71f3f140186f8","sha1":"ded9c355d32cf4fb5928f4c20d8087d01438a750","sha256":"94e9ec919058dd73af1983b641d7c58f40c142417cdf7441639b2e56331236c3","sha512":"bb5df137f747ace655ee3146945d48d33a3f9ffcc3a27fc59b405ecf2c4e1913c1394614a551f27bc6a821c952c6d9bebe3f19aee2b589886d4cd3b4ac066531","ssdeep":"","tlshash":"882100b782355be930e94b248fe0460cb23ae653f05600d0eb5728be7c0198328b8d60","first_seen":"2025-12-20T08:03:04.631603Z","last_seen":"2026-09-22T21:40:26.140694Z","times_seen":46,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"ffslok.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}