{"report_id":"2228e11c-29f2-410c-990d-81d25625f72a","version":6,"status":"done","tags":[],"date":"2026-01-14T15:07:34Z","url":{"schema":"https","addr":"io-zh-28.com","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":0,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"io-zh-28.com/","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"title":"加拿大28开奖平台 - 数据实时发布","dom":{"size":12075,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"624955db8fdb7177c418520d4b459d75","sha1":"afbb9a3f0649d9c1e7b7f7109cbf3041693ed6ce","sha256":"4250c07f26464999a9b2531d43ab4ac43b99c89386351177cd55998230487cf5","sha512":"a891a8477e2f05ca5a9f44b877678fb011485334a2ffcfc448d39959a49e8f90c75b1c01fad40609ead15b3ee923d0549693f83141bcc3e6410edd76d1b0a53e","ssdeep":"192:wWC0O/OZOmkPHgFkF0IXvwtNlwiwpp8kp1aCp8ahFwu4LlEa0OjFSXGPnYYsFpWQ:wWHO/OZRiHgFA0IXvwtyFpWQ","tlshash":"ce4210b085f6482712b39092a969638b2fd9ea73c81b4b417bbd57e85fc7d91cc4310d","dom_hash":"domhashde955bef661b76de7d7be7ceb6c9c3a2","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"io-zh-28.com","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":0,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-18T15:07:34Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"io-zh-28.com","ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":53,"request_count":53,"received_data":5173374,"sent_data":30634,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"tongji.kaiyunh5.cc","ip":{"addr":"154.85.235.194","port":443,"asn":134175,"as":"UNIT A17,9F SILVERCORP INTL TOWER 707-713 NATHAN RD","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-07-14","domain_rank":0,"first_seen":"2025-09-22T20:25:40.959647Z","last_seen":"2026-01-09T10:40:20.854342Z","alert_count":0,"request_count":3,"received_data":69594,"sent_data":2176,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"cheng88888.com","ip":{"addr":"122.10.18.4","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-07-15","domain_rank":0,"first_seen":"2025-08-31T14:29:35.029965Z","last_seen":"2026-01-09T10:40:20.235987Z","alert_count":0,"request_count":1,"received_data":3201,"sent_data":426,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"io-zh-28.com/","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"introduction_type":"eventHandler","is_inline":false,"md5":"e56ddbb05a974a6bc5ea44661e509a21","sha1":"448d4cb69f9441e10731b1ff4aa9dc81502589bd","sha256":"1759e8c6c2ce9c987245281cd33bb9260ce82e31b604131a5da486db89369913","sha512":"a3b2b0accbc0f18d13fc0eb6d742a5bf00a9614399e05b97b96ed0963e7d29b5868f73ef541c5f5bf8d125e7f7040d03f39cc853a52ffa2f1e2ebb7a20165242","ssdeep":"","tlshash":"7b700008080000800a002c00e000020080c2000802202008c020a8a0082c088808f800","size":21,"data":"","first_seen":"2023-04-10T22:51:51Z","last_seen":"2026-07-28T16:07:38.803583Z","times_seen":48886,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/iozh28com/gate.php","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d36d4a3956121a110a96afd809592903","sha1":"fca59a09b59d11b881d51009ba6cd507d7a2a23f","sha256":"248db9d114b9231135bec02e312a79fa49f85cd6632ff627f42a5bffa61ecca9","sha512":"a4b6c743d53edaf7c02d11dcdeabb859a014242d80a51c08d22518843b09e596875a82e53bd73d7751b55ce17a53d0d972260a662d75d7e1eabbe7595494a593","ssdeep":"","tlshash":"a5412337ba5214311066924d3ab7c70875b2001f9a85e105b3dc901c6fadd6b1cf9bbc","size":1990,"data":"","first_seen":"2026-01-14T15:07:41.501206Z","last_seen":"2026-01-14T15:11:41.810037Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/iozh28com/js/bootstrap.bundle.min.js","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"12b767b52298b7437b56d103d5c5bc50","sha1":"131d862a7a499870dd1822d2e8e4476b7d3172e0","sha256":"5317830fec028fc80cd947a083f872eced09b72731ca9b0ea77b593ed3f57b13","sha512":"094c93f390a1446554bcc3c7e8c40a656fee37267a94e5542c29f3bc687a799e676f1b58d8f74ac6de58d0d2c8e750a6016f3f1d11e08c3a45f1a56cdb8cb9a1","ssdeep":"1536:fSwJiEbnTl6R2t49CFliFCIg/yWszSraJd5qUFH9tZwcE+iYZMgZdj:awfs+SSO5q4tZwcEVYZFj","tlshash":"0783b5593244b8730ade85b68037430bf2265998b14b812cb57cadde2a7dcc67277f78","size":80863,"data":"","first_seen":"2026-01-14T15:07:41.548822Z","last_seen":"2026-01-14T15:07:41.548822Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tongji.kaiyunh5.cc/matomo.js","fqdn":"tongji.kaiyunh5.cc","domain":"kaiyunh5.cc","tld":"cc"},"ip":{"addr":"154.85.235.194","port":443,"asn":134175,"as":"UNIT A17,9F SILVERCORP INTL TOWER 707-713 NATHAN RD","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"4b32d11120a738ec529e5d64979e9d10","sha1":"deedcd7014f47a999da6c19786713cd7a236040a","sha256":"1762dd6a64fcd59421610b68625258f9224a1f278159c4d99282adb631470465","sha512":"258a126ba730a9f57d0adef037bdf90f349265128ceb8d7d9e5c7754eb14751895dffb3220bc1da307021ea8c37c45b837064c89731313acf22a3245b3812452","ssdeep":"1536:ATgnSINAJrRJqerEKlFXhuXEjmbMNfwS9h2BLy1z71B8I6fJIKIQaFLa:AT+Z2fuqXYy1PGJ9d5","tlshash":"3963d8ce72c2753a4bcb6075a43f114ab27e9caa1448c4b4e62ac4f6383491d657bf7c","size":67972,"data":"","first_seen":"2025-09-25T22:45:46.07207Z","last_seen":"2026-07-28T06:19:33.810032Z","times_seen":17505,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/yu.php","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"03b14fe18e642a14515a010e3fabfa44","sha1":"33453ca05fa03a117ed0c78ba3c5e49f7cd63993","sha256":"c88709d0cb8e780e7b630026e231cac9031537a6aa39daa240d57eb03f09102b","sha512":"7b541b0fa4c7040ff8f1fd63f89efb77678ad3f870836054cd5ed5b8dd06969516906b10a838cd6d12dc9f94f275e2e6f0ecef194febb676adb43885711f22be","ssdeep":"","tlshash":"d67000822300a0000282882a8000000800a200cb0803e022000a3000a808080022300a","size":18,"data":"","first_seen":"2023-03-13T12:33:53Z","last_seen":"2026-06-27T03:44:48.149184Z","times_seen":65,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cheng88888.com/link.js?0.0643081224759452","fqdn":"cheng88888.com","domain":"cheng88888.com","tld":"com"},"ip":{"addr":"122.10.18.4","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"c7656a07d710557fc36453a5a3177b94","sha1":"3bff2fcfda15ba1b13d0c7d818e6862553978db3","sha256":"a1faf75964265fadea64688779b0d5414f490cbe80ae87c169c4b4ad343062e4","sha512":"21c747a92f5b0e55169112329ea863ca80a12b62a617fd40b7f7d02449422798de20f3043be4414a003fac785dbcd05a7d6c509dd3e9af149fe180fb24a29f66","ssdeep":"","tlshash":"4f51eb6b55d54c44099b90341afb652c90bfb00fe89d98487e9ddb601fb302bfec62b9","size":2842,"data":"","first_seen":"2026-01-14T15:07:41.511254Z","last_seen":"2026-01-14T15:11:41.845833Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"dedb6025751f70fab2f5bdb2dc690176","sha1":"f9543409a57d8f4a3b27e3825020a17cad4bc72f","sha256":"fd1b21ebb66794f3ac55f6eca1ebddc0885b8c529a2c6c2c7ab1a590094b5e7d","sha512":"e5e1131510cd05ac159a1d1733a9ec39b2548a334855f840bc8c3b962410879242e14536786df717e39f10191fef104643cb1039b971cda96f2c0b8bdd953ff1","ssdeep":"","tlshash":"3ab012430c56c041c54c42c4d071e01cc010e30f8610c85584c560cc32146c98824094","size":96,"data":"","first_seen":"2026-01-14T15:07:41.574612Z","last_seen":"2026-01-14T15:07:41.574612Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"io-zh-28.com/skin/cover/iozh28com/iozh28comtx5-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.477Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/cover/iozh28com/iozh28comtx5-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 116202\r\nlast-modified: Mon, 12 Jan 2026 17:04:48 GMT\r\netag: \"696529b0-1c5ea\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":116202,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 763x763, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7b8e6b8d9231d3997744bc018eb91fa7","sha1":"cdd7da4f4c0b4573076e07d28baf3b012f509e80","sha256":"f85516c35b2cc581b93db67589a75017b501ec888192d0ee3f03c145ff152394","sha512":"f33bd7019d049e12401ff8698cd0a697ca6720f67e73e31b416b52f06225ec8f5414295fa5648d3d73f7f6451b2cf484224411a47a32f7d1733e073a23cb9166","ssdeep":"3072:0n6tInw0i1a5Zztg/9JIucSc9suTCx4DW56Uw:G1nw/Drq9ZS4DVd","tlshash":"edb312a0e70b5e8aee5cb798105c0e50fc075d4ef1b9c712f1f6621427e9b12e49ad3a","first_seen":"2026-01-14T15:07:41.482204Z","last_seen":"2026-01-14T15:07:41.482204Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1516,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":633,"receive":883,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tongji.kaiyunh5.cc/matomo.php?action_name=%E5%8A%A0%E6%8B%BF%E5%A4%A728%E5%BC%80%E5%A5%96%E5%B9%B3%E5%8F%B0%20-%20%E6%95%B0%E6%8D%AE%E5%AE%9E%E6%97%B6%E5%8F%91%E5%B8%83\u0026idsite=17\u0026rec=1\u0026r=516393\u0026h=15\u0026m=7\u0026s=15\u0026url=https%3A%2F%2Fio-zh-28.com%2F\u0026_id=a4d8d8ffe628365e\u0026_idn=1\u0026send_image=0\u0026_refts=0\u0026pv_id=sosPin\u0026pf_net=668\u0026pf_srv=424\u0026pf_tfr=1\u0026pf_dm1=1138\u0026uadata=%7B%7D\u0026pdf=1\u0026qt=0\u0026realp=0\u0026wma=0\u0026fla=0\u0026java=0\u0026ag=0\u0026cookie=1\u0026res=1280x1024","fqdn":"tongji.kaiyunh5.cc","domain":"kaiyunh5.cc","tld":"cc"},"ip":{"addr":"154.85.235.194","port":443,"asn":134175,"as":"UNIT A17,9F SILVERCORP INTL TOWER 707-713 NATHAN RD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:15.324Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tongji.kaiyunh5.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 10:00:50 GMT","end":"Sun, 05 Apr 2026 10:00:49 GMT"},"fingerprint":{"sha1":"EE:CC:71:C4:91:67:2F:88:E3:4E:4C:71:56:F8:74:AB:2B:90:EE:FD","sha256":"CD:BE:A5:E6:92:95:9A:C0:54:69:D8:53:C2:69:5D:E9:D7:D2:00:F4:4B:C2:06:6B:3D:B1:1F:C5:A4:67:71:51"}}},"request":{"raw":"POST /matomo.php?action_name=%E5%8A%A0%E6%8B%BF%E5%A4%A728%E5%BC%80%E5%A5%96%E5%B9%B3%E5%8F%B0%20-%20%E6%95%B0%E6%8D%AE%E5%AE%9E%E6%97%B6%E5%8F%91%E5%B8%83\u0026idsite=17\u0026rec=1\u0026r=516393\u0026h=15\u0026m=7\u0026s=15\u0026url=https%3A%2F%2Fio-zh-28.com%2F\u0026_id=a4d8d8ffe628365e\u0026_idn=1\u0026send_image=0\u0026_refts=0\u0026pv_id=sosPin\u0026pf_net=668\u0026pf_srv=424\u0026pf_tfr=1\u0026pf_dm1=1138\u0026uadata=%7B%7D\u0026pdf=1\u0026qt=0\u0026realp=0\u0026wma=0\u0026fla=0\u0026java=0\u0026ag=0\u0026cookie=1\u0026res=1280x1024 HTTP/1.1\r\nHost: tongji.kaiyunh5.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\r\nContent-Length: 0\r\nOrigin: https://io-zh-28.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:15 GMT\r\naccess-control-allow-origin: https://io-zh-28.com\r\naccess-control-allow-credentials: true\r\nset-cookie: SITE_TOTAL_ID=08f53ae224ededdc5775f81be5910f2b; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T16:56:23.922969Z","times_seen":17583285,"resource_available":true,"data":null}},"time_used":466,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":466,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/cover/iozh28com/iozh28comrongyu3-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/cover/iozh28com/iozh28comrongyu3-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 119456\r\nlast-modified: Mon, 12 Jan 2026 17:04:42 GMT\r\netag: \"696529aa-1d2a0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":119456,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 603x434, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b128467c1040a4317c81bb6c165c87fc","sha1":"54589d245ea6d59399761ba076505fa65ae7ca2b","sha256":"a318153978fb15453ce1b7a0ae242417e464f4014fc6c4db7994286696c373d2","sha512":"b097bddd55d281f092855d8cc80b35774ca0b5bb9ab0722de2ddb1f0eb0e656137a4f20507a470ef9a5a82b3744c6660b98770de25bfff2ce2b268473fa1821e","ssdeep":"1536:A7WNQdQZX28bsAyINodaskjV1Lrb5/k/sQ1ODbFBsUl2gp1omX036ZZTRl:akZBsAyModn8Xp/k/hSFulgnomXcMZT","tlshash":"abc3128095b98dfc54b140317f9376caa36335ed77df8202e6e4e0ea6c05b3c56a8ca5","first_seen":"2026-01-14T15:07:41.486616Z","last_seen":"2026-01-14T15:07:41.486616Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1454,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":636,"receive":818,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/yu.php","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:15.030Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/yu.php HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://io-zh-28.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:15 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nx-robots-tag: noindex, nofollow\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0\r\npragma: no-cache\r\nexpires: 0\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12383,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"e09bce1354462166f1ab21f70b32d55f","sha1":"1be3a3ea0f903e6d2a6f713b51f8d0518d359fa5","sha256":"f9bc81a2f72c2848299bfb984c9c551f7b177ead26b653900680356837879349","sha512":"23fcc73f253d9f53ef3fc82a810949764d1dfcc0172b7970fbc1e8c4e6b60f7aa9e9221c3d4efb072250bae3fcc5270f14738a55cc056629f24c2f541cef860a","ssdeep":"192:ChC0O/OZNmkPHgFkF0IXvwtNlwuu5pTpp8vTp1aWTp8aDTFwuUTLlEuT0ybFSXGe:ChHO/OZYiHgFA0IXvwt65wFpWa","tlshash":"73420fb181f6086712b39092696963ab2fd9ea73c81b5b417bbc5be85fc3d91cc4310d","first_seen":"2026-01-14T15:07:41.489198Z","last_seen":"2026-01-14T15:07:41.489198Z","times_seen":1,"resource_available":false,"data":null}},"time_used":620,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":620,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tongji.kaiyunh5.cc/matomo.php?action_name=%E5%8A%A0%E6%8B%BF%E5%A4%A728%E5%BC%80%E5%A5%96%E5%B9%B3%E5%8F%B0%20-%20%E6%95%B0%E6%8D%AE%E5%AE%9E%E6%97%B6%E5%8F%91%E5%B8%83\u0026idsite=7\u0026rec=1\u0026r=443173\u0026h=15\u0026m=7\u0026s=15\u0026url=https%3A%2F%2Fio-zh-28.com%2F\u0026_id=dd40ea56d5acfa6b\u0026_idn=1\u0026send_image=0\u0026_refts=0\u0026pv_id=j2VKei\u0026pf_net=668\u0026pf_srv=424\u0026pf_tfr=1\u0026pf_dm1=1138\u0026uadata=%7B%7D\u0026pdf=1\u0026qt=0\u0026realp=0\u0026wma=0\u0026fla=0\u0026java=0\u0026ag=0\u0026cookie=1\u0026res=1280x1024","fqdn":"tongji.kaiyunh5.cc","domain":"kaiyunh5.cc","tld":"cc"},"ip":{"addr":"154.85.235.194","port":443,"asn":134175,"as":"UNIT A17,9F SILVERCORP INTL TOWER 707-713 NATHAN RD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:15.329Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tongji.kaiyunh5.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 10:00:50 GMT","end":"Sun, 05 Apr 2026 10:00:49 GMT"},"fingerprint":{"sha1":"EE:CC:71:C4:91:67:2F:88:E3:4E:4C:71:56:F8:74:AB:2B:90:EE:FD","sha256":"CD:BE:A5:E6:92:95:9A:C0:54:69:D8:53:C2:69:5D:E9:D7:D2:00:F4:4B:C2:06:6B:3D:B1:1F:C5:A4:67:71:51"}}},"request":{"raw":"POST /matomo.php?action_name=%E5%8A%A0%E6%8B%BF%E5%A4%A728%E5%BC%80%E5%A5%96%E5%B9%B3%E5%8F%B0%20-%20%E6%95%B0%E6%8D%AE%E5%AE%9E%E6%97%B6%E5%8F%91%E5%B8%83\u0026idsite=7\u0026rec=1\u0026r=443173\u0026h=15\u0026m=7\u0026s=15\u0026url=https%3A%2F%2Fio-zh-28.com%2F\u0026_id=dd40ea56d5acfa6b\u0026_idn=1\u0026send_image=0\u0026_refts=0\u0026pv_id=j2VKei\u0026pf_net=668\u0026pf_srv=424\u0026pf_tfr=1\u0026pf_dm1=1138\u0026uadata=%7B%7D\u0026pdf=1\u0026qt=0\u0026realp=0\u0026wma=0\u0026fla=0\u0026java=0\u0026ag=0\u0026cookie=1\u0026res=1280x1024 HTTP/1.1\r\nHost: tongji.kaiyunh5.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\r\nContent-Length: 0\r\nOrigin: https://io-zh-28.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:15 GMT\r\naccess-control-allow-origin: https://io-zh-28.com\r\naccess-control-allow-credentials: true\r\nset-cookie: SITE_TOTAL_ID=1c35b7be51859416dbf5ca0b06202286; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T16:56:23.922969Z","times_seen":17583285,"resource_available":true,"data":null}},"time_used":481,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":481,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/img/MKAPP.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.677Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/MKAPP.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:15 GMT\r\ncontent-type: image/webp\r\ncontent-length: 46428\r\nlast-modified: Sun, 07 Sep 2025 09:35:20 GMT\r\netag: \"68bd51d8-b55c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":46428,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"99b9b60cd4776d948a16be0b496663c0","sha1":"e7eafeda1d0c51f3244b312de85e942e111ec1cb","sha256":"7c2c028999ec7e450fb3bac79804f0a4973062e1e1b39dd70fdc198899b6bff1","sha512":"0e7c5119a59190463f5d603201d8cc969afd5bec0dd10a7e06dbf027fb36cdba8f74687b46ddc6a9bb7d7171c44eed24209e9fef10bd17086368e64969ba99a8","ssdeep":"768:HzYqO3sUrrM+5sV/IYe5q0YAzQJ1HIAzJ1MZcmRt/errw0AZrzK7kA7co:HzYqOcIw7V/E0jJ1HIiJpwt/Sr2xzno","tlshash":"48230132f61b22b85fbdb3f694217d708c018f11ca7d49c680e295d2f45b0f4a25b9b9","first_seen":"2025-09-24T09:47:29.00799Z","last_seen":"2026-05-18T18:12:32.942574Z","times_seen":23,"resource_available":false,"data":null}},"time_used":226,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":220,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-14T15:07:12.052Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:12 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}],"data":{"size":34865,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (29412), with no line terminators","md5":"43fdfe9d787fac765eb2625cf01814aa","sha1":"ffdaa378f8987421d1885b022a33a8b64e8babeb","sha256":"92883918a345337a8e7cbcccebf2ed890f8a3042d5a5d10d27128197ad9a8324","sha512":"46eda3763d666c568db8118b7a22cdfd0ac12e21239d149dc11babeec889e7258856bef4c2fae3f02b298ce117b93bc0321964b81b9dbeb55684cbc8bb5871cb","ssdeep":"384:IQi3JyDyIIJl6LKmmhOZCHoRuqFdwfugr9xV4kPYIskTfQEp9I21TfnEYwxltIQl:k3IIzmmAYIRuqFdwfug1sa2AYpKMEQt","tlshash":"cef2e933d28ab6b7351f89ec55a37b2a30c3f11dc1678800eaf8625e17e6cd5b141e66","first_seen":"2026-01-14T15:07:41.494198Z","last_seen":"2026-01-14T15:07:41.494198Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1739,"timings":{"blocked":655,"dns":223,"connect":212,"send":0,"wait":424,"receive":0,"ssl":220},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/iozh28com/css/home.css","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.450Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /iozh28com/css/home.css HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:31 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d23-90307\"\r\nexpires: Thu, 15 Jan 2026 03:07:13 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":590599,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65491)","md5":"0ca954ac5bfaa93122063e6a28c98205","sha1":"5be542edd1494afe251b6888c39d50c1ef4c2cb7","sha256":"2c2d79a27c13f555b8470903c0576c414d615485ceae30ef781a4c03707db9b6","sha512":"a1c30032ccf0c4ffc09c7d6fc65689aa2335328feb0e30ce49bda348272f2c536e39114b356588ca84490895be78c5ea1b231a187d2a42ae387ac746b8878546","ssdeep":"12288:m+qNgxamFIN8Wwx21EmLsXeuZU5nh8I22Bg0jH:XqNgxTINWx21P","tlshash":"5cc4c8a49340b17dbc1bfa9897cc868e71217423e82277fced96b521c4c76f31664b89","first_seen":"2026-01-14T15:07:41.496651Z","last_seen":"2026-01-14T15:07:41.496651Z","times_seen":1,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/iozh28com/css/all.min.css","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.454Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /iozh28com/css/all.min.css HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:31 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d23-190ab\"\r\nexpires: Thu, 15 Jan 2026 03:07:13 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":102571,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (52231)","md5":"f966c469319b86f83b1b5f73376499c0","sha1":"e00caec1bb8911e254eaa56a8bf7cd2df7884945","sha256":"7091c8ee2204bfbcd667442d5be81968a4888265d4079b005b4b5f954c002925","sha512":"9f45eb99b087d8535c35bd8eeafc25cb3cf164a1cea7424b48f7250486589259d28ab56d62e0b8ea729a577807f0010dfc222105a2727df193d5aa74c82af2a8","ssdeep":"1536:1wMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPG9ZpgmLCq:Z709gMGFiyPG9ZimLCq","tlshash":"20a3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2026-01-14T15:07:41.498772Z","last_seen":"2026-01-14T15:07:41.498772Z","times_seen":1,"resource_available":false,"data":null}},"time_used":642,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":642,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/iozh28com/gate.php","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.458Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /iozh28com/gate.php HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nx-robots-tag: noindex, noarchive, nosnippet\r\nx-content-type-options: nosniff\r\ncross-origin-resource-policy: same-site\r\ncache-control: private, max-age=600\r\nvary: Accept-Encoding, User-Agent, Referer, Sec-Fetch-Site, Sec-Fetch-Dest\r\netag: W/\"d36d4a3956121a110a96afd809592903\"\r\nlast-modified: Sat, 10 Jan 2026 19:04:34 GMT\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1990,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text","md5":"d36d4a3956121a110a96afd809592903","sha1":"fca59a09b59d11b881d51009ba6cd507d7a2a23f","sha256":"248db9d114b9231135bec02e312a79fa49f85cd6632ff627f42a5bffa61ecca9","sha512":"a4b6c743d53edaf7c02d11dcdeabb859a014242d80a51c08d22518843b09e596875a82e53bd73d7751b55ce17a53d0d972260a662d75d7e1eabbe7595494a593","ssdeep":"","tlshash":"a5412337ba5214311066924d3ab7c70875b2001f9a85e105b3dc901c6fadd6b1cf9bbc","first_seen":"2026-01-14T15:07:41.501206Z","last_seen":"2026-01-14T15:11:41.810037Z","times_seen":5,"resource_available":true,"data":null}},"time_used":641,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":641,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/cover/iozh28com/iozh28comfuwu2-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.460Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/cover/iozh28com/iozh28comfuwu2-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 127748\r\nlast-modified: Mon, 12 Jan 2026 17:04:35 GMT\r\netag: \"696529a3-1f304\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":127748,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 628x418, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4dbf1e9395828d9a8556cf0a6666d1e9","sha1":"2a6a488d5c08e6697586997b1636d28f01564cd4","sha256":"5891fbac22d4f995d899fc9f771c37ad7ea58aff8cb1765f04b2bcd8d20806c7","sha512":"1733aa6094c91c86873502ca7c53926b2e37f5cb8c7a836589070dc39799deb7abcaa3e88b7b53461a46a561c04ba85fa0e63231ae5c06cef3866cab9434d2ca","ssdeep":"1536:xs75XeyczLtc7AvmhhrlGYIhYrqCjuZq8yWFPY8K1cc/DVEx2b8xdJLs48E+Y3WG:VPtApwYrB8XFwqcB1SRBbHP32a/v","tlshash":"8fc3125b6c8b809cba162f6c4be474c00b3483675e0a1f67f9753af1af98a027cd45d2","first_seen":"2026-01-14T15:07:41.503076Z","last_seen":"2026-01-14T15:07:41.503076Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1336,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":639,"receive":697,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/tb/iozh28com/iozh28comanquan2-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.481Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/tb/iozh28com/iozh28comanquan2-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 25014\r\nlast-modified: Mon, 12 Jan 2026 17:04:49 GMT\r\netag: \"696529b1-61b6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25014,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 512x512, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4218b9b63b5eb8fa47a39dac5dadea9d","sha1":"09f35fa20b6079dab08e57f69e46bb0228553d66","sha256":"d1d4f940256d5a390cfaf4b5df8dc7f7a74cccbe52c18f0dd4c05b5ee1f1f419","sha512":"b4c883cab31fc1787191bdac21aa18ab603a5a3dee0e1c18795358f967111af973b261253d789f19bcdaf4505f7dca36d43e8d0ec4d9d942eafc867d7d8556b1","ssdeep":"768:bSL7n1ubp1koMWDQECgAd4qCaeMFcRF9aGbF3jt:auH+EHi7ROF7h","tlshash":"6db2e12af0be918b72d741f603c1836dd97cb1985201cfc25066debce60e502e2b8d67","first_seen":"2026-01-14T15:07:41.504643Z","last_seen":"2026-01-14T15:07:41.504643Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1303,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":633,"receive":670,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/cover/iozh28com/iozh28comtx2-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.474Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/cover/iozh28com/iozh28comtx2-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 174360\r\nlast-modified: Mon, 12 Jan 2026 17:04:46 GMT\r\netag: \"696529ae-2a918\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":174360,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 746x746, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7ef347024b6579afb6c50545bb32a4ce","sha1":"10b3b47199d13ee5b35b132ccaca7e4968343caa","sha256":"f566f4aa286b90afe4c28df1eb142df3dff1955722bff7273a470fdbe0c21ae7","sha512":"2b84848119aca46cce870327ed9c7519e0188e549421808a2ec5e5370bb651726bef361b6bdae64ea3e8f7c7928ca892a593c522565fd8aed26aaee09e2880e8","ssdeep":"3072:XvzMy8+I9ojGjJMGdIEFE+bDyholtGUIFrO9G9sL+AjaJpledgtciaMxYx9CRxa9:/zk+Iy116bGhdUmOwu+AIedfnB9C6qve","tlshash":"d90423ee93d2c32bdd32172d2120d1f734222aae66273385329e4526d4ed3b5d05ae1d","first_seen":"2026-01-14T15:07:41.506768Z","last_seen":"2026-01-14T15:07:41.506768Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1549,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":635,"receive":914,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/tb/iozh28com/iozh28comanquan1-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.478Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/tb/iozh28com/iozh28comanquan1-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 36558\r\nlast-modified: Mon, 12 Jan 2026 17:04:49 GMT\r\netag: \"696529b1-8ece\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36558,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 512x512, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2ab3b5e3d3c7c9b814c93e20e25860b0","sha1":"5ddfca7efca5a06a003e88e2ea84d464b1e79db9","sha256":"11b2a38d47480a28fc7f8979df03803a9eb2db47458dbb300def3361195eefb3","sha512":"182f394e4a79b0230171ec03d1a7378beba59535c6afba394914466b85eca67523369fc6e28ddf57d5db0d04ecf3f7738662fbc13d7459482409b6daefd8863c","ssdeep":"768:6EQyK2wpFIdkPSmPTFdlM6olYW6dH3tX0LIUqmAuAKRugf:6E024FeYSwhd+efE0UpxAKTf","tlshash":"97f2f28b395a892ce17e8373cbcf4042b2a2c1e54a0b65ef92514f1ad243537f48798a","first_seen":"2026-01-14T15:07:41.508578Z","last_seen":"2026-01-14T15:07:41.508578Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1300,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":633,"receive":667,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/iozh28com/webfonts/fa-solid-900.woff2","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:14.475Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /iozh28com/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/iozh28com/css/all.min.css\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:14 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 158220\r\nlast-modified: Fri, 13 Dec 2024 14:50:06 GMT\r\netag: \"675c499e-26a0c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":158220,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 158220, version 775.1280","md5":"4a6591ab5460ae5cbff1ecbd6e52193a","sha1":"7cd8afd6501962fda35d66f0e4c3b8815ac471d8","sha256":"aa75998623a391e61c6901794ace832e3ecdd288b56d608f21bea0411acc0b8e","sha512":"96c5d3283b71613b595b6b0420333bef5d64451af05c59dde27ec5b3e7cfe6e9549c604cddfbcb79cbc0fd4cd6f2e22a130c9a220b1b7ef933ac9df8c8e695d6","ssdeep":"3072:RauSB5FANIRLpsBaBrJGNG3ECNQztRvHHqkqLrlF:guSqN6ptrJGo3POh9KT9F","tlshash":"0ef312a710c6b95684a3a51b336adeb52c3ed363fcb6cd73be340114689da9c2e4d190","first_seen":"2024-12-19T10:41:23.153533Z","last_seen":"2026-07-28T14:53:08.948652Z","times_seen":32702,"resource_available":false,"data":null}},"time_used":749,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":530,"receive":219,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cheng88888.com/link.js?0.0643081224759452","fqdn":"cheng88888.com","domain":"cheng88888.com","tld":"com"},"ip":{"addr":"122.10.18.4","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cheng88888.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Nov 2025 05:37:53 GMT","end":"Sat, 28 Feb 2026 05:37:52 GMT"},"fingerprint":{"sha1":"67:68:64:7A:AA:CA:42:94:E8:14:C9:AF:1B:EB:09:E0:6C:BA:7E:8C","sha256":"65:BB:2E:CB:D1:0A:2C:B0:F2:CE:FF:C9:DD:38:65:E0:65:10:1D:74:AB:BC:AB:A0:94:06:C5:A3:9A:80:F9:FD"}}},"request":{"raw":"GET /link.js?0.0643081224759452 HTTP/1.1\r\nHost: cheng88888.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:16 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 14 Jan 2026 15:06:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6967b0f5-b1a\"\r\nexpires: Thu, 15 Jan 2026 03:07:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2842,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"c7656a07d710557fc36453a5a3177b94","sha1":"3bff2fcfda15ba1b13d0c7d818e6862553978db3","sha256":"a1faf75964265fadea64688779b0d5414f490cbe80ae87c169c4b4ad343062e4","sha512":"21c747a92f5b0e55169112329ea863ca80a12b62a617fd40b7f7d02449422798de20f3043be4414a003fac785dbcd05a7d6c509dd3e9af149fe180fb24a29f66","ssdeep":"","tlshash":"4f51eb6b55d54c44099b90341afb652c90bfb00fe89d98487e9ddb601fb302bfec62b9","first_seen":"2026-01-14T15:07:41.511254Z","last_seen":"2026-01-14T15:11:41.845833Z","times_seen":5,"resource_available":true,"data":null}},"time_used":1133,"timings":{"blocked":467,"dns":64,"connect":198,"send":0,"wait":198,"receive":0,"ssl":204},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/cover/iozh28com/iozh28comtx3-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.475Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/cover/iozh28com/iozh28comtx3-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 223408\r\nlast-modified: Mon, 12 Jan 2026 17:04:47 GMT\r\netag: \"696529af-368b0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":223408,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 730x730, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"6c0bf562710ede98dcbb338b40c2e965","sha1":"d67b0e86bbcad6fb292013288188157986c9e39d","sha256":"702214ef55aea295253386f553cc41af0e4651a64814577e2208013e57fcec81","sha512":"e21f566fa70c3d2ef4bdbe281cbf6c09320fdfea5e22c3b7ae6b0ded094487826538bb675c11c8a19dd35aa1320b34a3795ea629a84d14e5f2fc1c41b0d93ac1","ssdeep":"6144:4K+ikgalnDmYQhkLGFYS6pVr9Tq6Q5eTG2XcdvNelmpI0:QgadfLGm5uN5kG+N8","tlshash":"aa2423c196b41a7076342b531a9e3eb6093617dabbafbe08813d1b1c517e23b4d53738","first_seen":"2026-01-14T15:07:41.512891Z","last_seen":"2026-01-14T15:07:41.512891Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1556,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":634,"receive":922,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/cover/iozh28com/iozh28comemail-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.484Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/cover/iozh28com/iozh28comemail-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 110840\r\nlast-modified: Tue, 13 Jan 2026 17:53:53 GMT\r\netag: \"696686b1-1b0f8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":110840,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 556x370, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"356b31ac79b0bc7e87464255ad575a79","sha1":"eb90aab5421bdbbe44cbee82d83e40a6927e216a","sha256":"d3337511f1dd6d5f05c8079c11bf19df24d24f4c85bfb7be39ea24020cd61ec5","sha512":"67ee583ffe67ec46357541a4e4a53dab99cc52ab6ec5b75efd7a6aec8cb65b632954b14f9b8a81f40436a7e836b772af21ea868463f1671eaac532102bf6879b","ssdeep":"3072:3h388MV/zx/gOU2ZN7nhcr4LiUVNuSHGEMrFBwfw:xsTd/c2ZZhcU5YrwI","tlshash":"1db312e502482de0b5de08755eddc1a11086b80f26779d2b7bdce27875efb97290b20b","first_seen":"2026-01-14T15:07:41.51477Z","last_seen":"2026-01-14T15:07:41.51477Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1518,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":631,"receive":887,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/img/hthlogo.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.934Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/hthlogo.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 18412\r\nlast-modified: Sun, 07 Sep 2025 09:34:44 GMT\r\netag: \"68bd51b4-47ec\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18412,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a856a132c94cfe122c65e3fea41155f7","sha1":"b891eee6bcbbc6d239a88da6803d7962e5053aa3","sha256":"74f75d276694dbde95b6faba24ddc0f1f0fdd9bcadac15247a85c37920191792","sha512":"fe66855b60ae68d968788e70060e4461ae338c7d3106f7fe43a2284ec7ed228e2043bb26bc41b5a43584d05ce72cb966559d57dc3619655a5d724f9f473def19","ssdeep":"384:pRLF+p03tqJ9CMVckEWu73VRfjxdk7hllIjdlbng45YeBWK:9+m969pNEWu7FRr/k7HlQg4yeBW","tlshash":"ee82d0b63909725ed2450ce8f4146243fb95faa914391ced34afc1a32c77a64ae2384b","first_seen":"2025-09-24T09:47:29.003621Z","last_seen":"2026-05-18T18:12:32.940732Z","times_seen":23,"resource_available":false,"data":null}},"time_used":215,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":214,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/tb/iozh28com/iozh28comhz1.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:14.563Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/tb/iozh28com/iozh28comhz1.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3402\r\nlast-modified: Mon, 12 Jan 2026 17:04:28 GMT\r\netag: \"6965299c-d4a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3402,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 220x220, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"382b88a53cdd5ac90780b566d5e936c9","sha1":"15b31e67313bafd2655436574869c0eed00a37e4","sha256":"84e482a04a4cf1ea1187517fee3e446556a002b7c3a483c332a950b144dfb1f0","sha512":"704af5eac69fc7d883e154d323a0f3113e304286b92e9a3a30b9a2b946a8ce5ff1008332bb77dec5b3ce7a26f04fab1626dd2ecae1915b8efc9d88465ba6d72f","ssdeep":"","tlshash":"40616b795c3dcece05d60478858a038d8af059b0c5455b99846abb630e3b700d8a9add","first_seen":"2026-01-14T15:07:41.517278Z","last_seen":"2026-01-14T15:07:41.517278Z","times_seen":1,"resource_available":false,"data":null}},"time_used":879,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":879,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/img/9gamebn.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.678Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/9gamebn.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:15 GMT\r\ncontent-type: image/webp\r\ncontent-length: 27892\r\nlast-modified: Sun, 07 Sep 2025 09:33:44 GMT\r\netag: \"68bd5178-6cf4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27892,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ce77c899674f0fbbb251da4359cd697f","sha1":"235c35f6f643584a20bfa71157129284a4088e8a","sha256":"6b12d808aa923bd5b8fd72fa6448aca5b15b7b0a04cb7c47b35dcaca0801f57d","sha512":"dfcdfb85450ad4dcd889893901416e4935e95fc88c7e1856d1103771e30ea8e381b1256798da33fe5bb1648fb71479594339d8c9fbf19ba243c1399b9766a978","ssdeep":"384:zjT/vsXC1mmPYGjSiM2FZrYKjFUb8mLg9vf44pgGDC7eqsyYyFWWby4zVZJH10/l:wy1myiiDUbzx4LO7tsjyFWWZvqE","tlshash":"86c2e187bf5cb40888b4b2cfb93ef9e6028446bc6f871175c428859a0d5b5c776d30ba","first_seen":"2025-09-24T09:47:29.014809Z","last_seen":"2026-05-18T18:12:32.950317Z","times_seen":23,"resource_available":false,"data":null}},"time_used":231,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":228,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/img/ag-66.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.923Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/ag-66.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 33604\r\nlast-modified: Sun, 07 Sep 2025 10:09:28 GMT\r\netag: \"68bd59d8-8344\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":33604,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e92b11204749525f981459967df19ab7","sha1":"f515e14ebfe3c0b9861f5af195ce60124a2d2982","sha256":"a841caa2ae77d709aa75182c640051f701e8397c7dd0b1c0ff9504f8b6f8e50a","sha512":"e2e11799713df02f0453f39172651bdc1e7f95004f3bff06c5994928f66f67f4ff03eb101ed71941483555486403f8660c8268d7bc3e7aad43cc2598dbc6c5ca","ssdeep":"768:HfDRTz7L+b1oFmVe/hqyqjSnx92h9hJ8oFaYPpQo7q3:LRrfmVqhkjCxkFjpQo4","tlshash":"0ae2f1b2e022c5f4bef18d4929c634d8596b74814cbac957bec048c39c595fb53b8a4b","first_seen":"2025-09-24T09:47:29.016414Z","last_seen":"2026-05-18T18:12:32.937739Z","times_seen":23,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":214,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/font/iconfont.599951c1.woff2","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.956Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/font/iconfont.599951c1.woff2 HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:16 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 31460\r\nlast-modified: Sun, 07 Sep 2025 09:00:14 GMT\r\netag: \"68bd499e-7ae4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31460,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 31460, version 1.0","md5":"b0530b23615e0bdd80af2c1d798dfa67","sha1":"5b81dde90f5c33b9281dde774eb34fec622a3630","sha256":"407a95e9d3f3d987e7f5d7a73e7cb743c3f4525260ae3b00acff310aa719e0dd","sha512":"581639e8a210142ca9e71eeaa0ba00d4e6bdd968b80062d651d6bb04fc2c9b336b4dd39422a74f493675adcb485f70fade26a788260151379a5bc93c0bc65cd8","ssdeep":"768:cIcVR2hPAcTmEgVT9BZlkrnOQZS19fRKf:Y0hPYxxBZ66QZS1JRKf","tlshash":"87e2f147c0397083eeb52629450793e9ddbf2a91be0c5b20061b613f95ee495c3a772b","first_seen":"2023-05-18T07:54:03Z","last_seen":"2026-07-26T11:38:26.146063Z","times_seen":1048,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":214,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/iozh28com/css/swiper-bundle.min.css","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.452Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /iozh28com/css/swiper-bundle.min.css HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:31 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d23-46be\"\r\nexpires: Thu, 15 Jan 2026 03:07:13 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18110,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (17812)","md5":"2a13e867e0e15a535d1b1d6394b2a4e2","sha1":"e3ad5ecb5eb2fbb3c5b773a0835c2f7236e9b244","sha256":"3863649a0bae85f2a8cdd6277b04528afb64a763951c7a7960a75dab0d053bce","sha512":"c3575ec250dc691649983f5385525a42bdb874da685f2ac93f1b6c2e587db47caecd6a2d632c4a140a6a44a8e97d33f0a883c86d72c377238e6a7b1bf78c78cc","ssdeep":"192:TVmUJbiKne0JlXZHZ+Sme+jexS4nxep/a2GZb0Q5nfufKlAYfg5fyeesedOJ9A5Q:TgUbe0JdZHZ+W+SFnZ24tlWfF4XYz","tlshash":"618245a85340282753274f364b71cbb9dd7444d20f9389ae91c0ee48d7fadb9132f6a9","first_seen":"2026-01-14T15:07:41.521859Z","last_seen":"2026-01-14T15:07:41.521859Z","times_seen":1,"resource_available":false,"data":null}},"time_used":642,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":642,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/cover/iozh28com/iozh28comtx4-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.476Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/cover/iozh28com/iozh28comtx4-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 135854\r\nlast-modified: Mon, 12 Jan 2026 17:04:48 GMT\r\netag: \"696529b0-212ae\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":135854,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 656x656, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"724994a6ac4943f76d99530e40b242e5","sha1":"d139db09c493ff96be34caf293ccc4870c92b2b0","sha256":"02e3df1a252df05c89f742dffdd68e0d2659d54ef8a194e9614a6dacbb7f0a31","sha512":"f30e956cb0e1a21e70fda81d72671a275c799e29ae703f6635498c026a377e47bb0bc0dc1afdc806084ab2127fc7a7233c825052815739abe67071813fad18ce","ssdeep":"3072:rXXgLO8z67hDkaXkAPRoUcmZaEZZb6tX8tqMVuffZFdiEMOVuhF7:kPuPX5ZbZaEZZb8svmZFdiE5Ih5","tlshash":"6fd31212671a4ea5484747eba435436c6792d1ff62acdd2f3f0a90c2a3f9e334a49d4c","first_seen":"2026-01-14T15:07:41.52455Z","last_seen":"2026-01-14T15:07:41.52455Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1558,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":634,"receive":924,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tongji.kaiyunh5.cc/matomo.js","fqdn":"tongji.kaiyunh5.cc","domain":"kaiyunh5.cc","tld":"cc"},"ip":{"addr":"154.85.235.194","port":443,"asn":134175,"as":"UNIT A17,9F SILVERCORP INTL TOWER 707-713 NATHAN RD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:14.416Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tongji.kaiyunh5.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 10:00:50 GMT","end":"Sun, 05 Apr 2026 10:00:49 GMT"},"fingerprint":{"sha1":"EE:CC:71:C4:91:67:2F:88:E3:4E:4C:71:56:F8:74:AB:2B:90:EE:FD","sha256":"CD:BE:A5:E6:92:95:9A:C0:54:69:D8:53:C2:69:5D:E9:D7:D2:00:F4:4B:C2:06:6B:3D:B1:1F:C5:A4:67:71:51"}}},"request":{"raw":"GET /matomo.js HTTP/1.1\r\nHost: tongji.kaiyunh5.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:14 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Dec 2025 14:05:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69397e40-10984\"\r\nexpires: Thu, 15 Jan 2026 03:07:14 GMT\r\ncache-control: max-age=43200\r\nset-cookie: SITE_TOTAL_ID=ace4f420aa99f8c24dda482808e04d95; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":67972,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2923)","md5":"4b32d11120a738ec529e5d64979e9d10","sha1":"deedcd7014f47a999da6c19786713cd7a236040a","sha256":"1762dd6a64fcd59421610b68625258f9224a1f278159c4d99282adb631470465","sha512":"258a126ba730a9f57d0adef037bdf90f349265128ceb8d7d9e5c7754eb14751895dffb3220bc1da307021ea8c37c45b837064c89731313acf22a3245b3812452","ssdeep":"1536:ATgnSINAJrRJqerEKlFXhuXEjmbMNfwS9h2BLy1z71B8I6fJIKIQaFLa:AT+Z2fuqXYy1PGJ9d5","tlshash":"3963d8ce72c2753a4bcb6075a43f114ab27e9caa1448c4b4e62ac4f6383491d657bf7c","first_seen":"2025-09-25T22:45:46.07207Z","last_seen":"2026-07-28T06:19:33.810032Z","times_seen":17505,"resource_available":true,"data":null}},"time_used":1114,"timings":{"blocked":457,"dns":53,"connect":198,"send":0,"wait":198,"receive":0,"ssl":205},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/tb/iozh28com/iozh28comanquan4-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.483Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/tb/iozh28com/iozh28comanquan4-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 24774\r\nlast-modified: Mon, 12 Jan 2026 17:04:49 GMT\r\netag: \"696529b1-60c6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24774,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 512x512, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a0a6200fc387f1bc12d18ad402e32caa","sha1":"6043c3f5f92502ec456a763a32f21fe9fbcc34b4","sha256":"f66fb645db970ca8f2233439614153fcdc93c27531166bb95574d05f81eeb1f6","sha512":"9bbf5588f60ea1b03ef5f5383b55060fd1002f5e0dcca18cdb5c8d3e10ed9e14840ea29b78e7549682e80cee29dfde795a1e41f587e304edd7249d3a7c2fa85b","ssdeep":"384:dfy3hSBtli/c9CLAfBqAEHlVcQtk2LOKPC9XoINqt4XRiCJ2ZYlBzEdMqCntZlgA:hyxSNCLAfBqAEFVcssKa+E4rdEtTxHxN","tlshash":"e8b2e1366f352f53f0947747c94e09093af3819d0aa3584de29d0ebc1a997e7523835b","first_seen":"2026-01-14T15:07:41.527651Z","last_seen":"2026-01-14T15:07:41.527651Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1306,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":631,"receive":675,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/img/aiyouxi.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.679Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/aiyouxi.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:15 GMT\r\ncontent-type: image/webp\r\ncontent-length: 33678\r\nlast-modified: Sun, 07 Sep 2025 09:34:16 GMT\r\netag: \"68bd5198-838e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":33678,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"20d95f56875543e3db12628ba252f807","sha1":"1d138c27eb58239897fc831978d571fdf268e569","sha256":"1e1fbae436c1c4970035f09993b0c0a41f972933f7144b401972ee23ffdb544a","sha512":"5d86196f17a03aaf428125c66a135590de7ca468c939509732444e26dcb283df179ab2a6db3cb10c0d0b067006126e836b764b9d72fe798674f9cbb601d55880","ssdeep":"768:OvQR9vvZ3UFin5prrozg0wMNLzN0o9+v+P+2bT5+DIqz7bT:OYHuMrmw4zyYPFbgIw7bT","tlshash":"80e2f120dd91e3dfd92193864ed4a2a7ee07f015d49eb0901ab558106639f9ec32a39b","first_seen":"2025-09-24T09:47:29.020056Z","last_seen":"2026-05-18T18:12:32.951107Z","times_seen":23,"resource_available":false,"data":null}},"time_used":233,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":231,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/img/kaiyunlogo.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.926Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/kaiyunlogo.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 15156\r\nlast-modified: Sun, 07 Sep 2025 09:35:04 GMT\r\netag: \"68bd51c8-3b34\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15156,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"37226afe020294b82ec267fab103cdfd","sha1":"b8b307dde0f00251470672845a819a98205f7389","sha256":"1c9ac810fd7faf1ec1d23b474e580b0d2224e6beb51b5dd8fc8cc131217cccec","sha512":"54d150a734f51d59d8c85f1c158408747c96a28534caaf5f26e0c8d31263d350fe7207a3cddb3db02601f3f9ce4d6bf8a93ed37416e711cfc92ee6869ed5361f","ssdeep":"384:nbTn9tCbMpfXO9KiLsJaLNXAHXk080K40nvqqZNE:bTn9tCbMpfXOIGsJ+NX6Xkyz0ni1","tlshash":"4962d1c17fc81185fa2db77a2a58c2a0d388a90c5ed7c677bd2401d2c78ce14f2a9a1c","first_seen":"2025-09-24T09:47:29.021234Z","last_seen":"2026-05-18T18:12:32.934131Z","times_seen":23,"resource_available":false,"data":null}},"time_used":214,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":214,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/img/leyulogo.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.931Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/leyulogo.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11032\r\nlast-modified: Sun, 07 Sep 2025 09:35:07 GMT\r\netag: \"68bd51cb-2b18\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11032,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"10fb9b87015af763733ca7aae9f8fd72","sha1":"22b85d9ba6d73c7318b91797df836c6dfd4c9bb8","sha256":"005515860b53ba77db3f2b66788345c397fe73449f589f426864829442c1690e","sha512":"146449caad3ea28cf16b700248d77549bb925fd2f33db7a1d614530e8fb6d47d00d873c88d654fedc9068e2ac9e529943916ddb35817d135b0257ec4a3bf978b","ssdeep":"192:zIZCU4S/HrTYSbgrqGvXdxyT6Tl+Kib2fMSk9NpduGGbh1R7bPL8P:MKWkFvryT6Via0SsXGFX","tlshash":"fd32bfb636c0359ae0c49ab56dbfb440968a065e7cdad7e3b4bd0200146eb7b3b35d81","first_seen":"2025-09-24T09:47:29.01019Z","last_seen":"2026-05-18T18:12:32.968408Z","times_seen":23,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/tb/iozh28com/iozh28comanquan3-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.482Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/tb/iozh28com/iozh28comanquan3-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 19268\r\nlast-modified: Mon, 12 Jan 2026 17:04:49 GMT\r\netag: \"696529b1-4b44\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19268,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 512x512, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"769d019352c02d7f9a78108bb2fab33d","sha1":"e15f758f51d1bfbb52b49df7e9066d626dd911e4","sha256":"0a32fe7228578d21b8a38a9bbc7e2ed5db3ffc5c0345176f1639d53196364834","sha512":"0781034a799a3a5de43280d9841ce6a7a698c43d4e9eaae2eabf530ba6d76a2619197bbdc6e27d62b3bbdbcf24c9f74cd1aba83c3ea7f98a8be0fcddf2a1b248","ssdeep":"384:ihiVCEWYtXJ3WMOLv5hzKdlqDzLYFqNMbiCMDnJ73zK5So0+b2A4v:i/EW635Ki+zLYFq6iCcJjzsSd+s","tlshash":"0e82d00ceeee9047c8496db00309351aabdf51a70024bcd2f6f6b5259a7f7a43c994b4","first_seen":"2026-01-14T15:07:41.535348Z","last_seen":"2026-01-14T15:07:41.535348Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1303,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":632,"receive":671,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/tb/iozh28com/iozh28comhz2.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:14.565Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/tb/iozh28com/iozh28comhz2.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3898\r\nlast-modified: Mon, 12 Jan 2026 17:04:29 GMT\r\netag: \"6965299d-f3a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3898,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 220x220, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"254517bf070fb641143edb43aa322811","sha1":"6d23e794c3136cca3bde8da9d379b5bd61b9e78e","sha256":"b3dbfb16a8fac80b816c353ad501e11602fe9610801a05c5bf775e20d2e8a1ff","sha512":"f42e613e864599a474bcff9e57963e9c120ab34758df320de2f874dfa3e4d8f16fad3b8c48fc351fda13013b4c16d0496dbd8cd00b9da38528055971d2ab4f1e","ssdeep":"","tlshash":"36815c5ed1092222edcb3b44b6ef088bdf0d96855469185c7525c65b53e73e4f9af800","first_seen":"2026-01-14T15:07:41.539488Z","last_seen":"2026-01-14T15:07:41.539488Z","times_seen":1,"resource_available":false,"data":null}},"time_used":880,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":880,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/img/jiuyoulogo.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.928Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/jiuyoulogo.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 66022\r\nlast-modified: Sun, 07 Sep 2025 09:34:59 GMT\r\netag: \"68bd51c3-101e6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":66022,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f9d82754a0c7289017f556c85562cfb9","sha1":"e326e29943603a7c5d8d345f94a12a84603ab2ee","sha256":"dd566ef9d48ad26fef3383ffcd4eeaebccac502c3a43e97eeec29fc2be67f07c","sha512":"cfdfa4d68e6777dd373062444bdd0b51dcc06680227f205d9ab1fdf4598f2459dce7700c6fe8e2d3ae0dfd38facbb0bbf3a4d73e21885f554f27a3d5add87c7e","ssdeep":"1536:v2GQ+bJZjKVYf/iB8ycpoimjc0YKEO9dChPyFc:ugjK22jcp0oOShPye","tlshash":"ef53022e2218e893d053c560934705dcff9f550eecb0b92b04a4fb0cb9ea6455b45e8f","first_seen":"2025-09-24T09:47:29.022465Z","last_seen":"2026-05-18T18:12:32.939188Z","times_seen":23,"resource_available":false,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":215,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/cover/iozh28com/iozh28comtx1-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.472Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/cover/iozh28com/iozh28comtx1-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 115368\r\nlast-modified: Mon, 12 Jan 2026 17:04:45 GMT\r\netag: \"696529ad-1c2a8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":115368,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 688x688, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9d4281ade5e6781053a9114e36a214c7","sha1":"2ca81e1fbaee62b3225245ec174ac68f164e264b","sha256":"e70ae9f7c8450600cf9489305a324af4bc3a8a8d195883107300339e8e49d67a","sha512":"18ed48940ab8d53a93735ba1aef6da183047fb95d92252974c06b7bd5628edcd283a93946c7c991d3b10ede340661ae741dd9bd1d157452a960d84c9287fa1f9","ssdeep":"3072:iJPBhO36x9nS1116bYPsTv5qrY4/erzfAfIJbMGd9IHQQX0rHloisL:iD5x9nST18TvEr/ZIJbMn/Xyl8","tlshash":"0ab312d5876044e1f36f2d1cd06a8ce0ce6718fc2959d43aa0b8a5dc1dc2ae979e6d0f","first_seen":"2026-01-14T15:07:41.542757Z","last_seen":"2026-01-14T15:07:41.542757Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1498,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":635,"receive":863,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/logo/iozh28com/logo.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.485Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/logo/iozh28com/logo.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9140\r\nlast-modified: Mon, 12 Jan 2026 17:04:24 GMT\r\netag: \"69652998-23b4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9140,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 431x145, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"978d6149f44f2cc3a250bed035d53b75","sha1":"9cadd1e027f0f0e79cfc08fcb8216a9e59662695","sha256":"fe4ba0d9cdfa21e5abbf6c48fed04ad960cc4e3d15dc8a6467cae5dbd900dd7f","sha512":"53898c90ca69bd8ba9feb1a76cef0b2ee4349f2806cdf574fa024c2c096fa2e8927b2e275062a50116841923334aa2f4c22581ee68b7d704e940e122e8ea3ca8","ssdeep":"192:BcDnZFn5unwSO20p4Nbvx4Z0GCa0gUZMhb1:OF5un10p8jx4Z05a0hZEb1","tlshash":"b212bfa6ff3529f7f2f1ebb744e6badec24eba1434216f30e44295e16125002298c09d","first_seen":"2026-01-14T15:07:41.545145Z","last_seen":"2026-01-14T15:07:41.545145Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1311,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":631,"receive":680,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/iozh28com/css/gongyong.css","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.455Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /iozh28com/css/gongyong.css HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:31 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d23-8998a\"\r\nexpires: Thu, 15 Jan 2026 03:07:13 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":563594,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65491)","md5":"ff197144e50070418ae9e8e01bdee844","sha1":"28be7480ef094d43ebd2f135ee1b369dd01bf144","sha256":"93d34fc4d88cec62dc199eb338c39645bf41bd948e9450e9f5a1d555204936ac","sha512":"b5bfc1107bf3f8bc0f326fe98aceb74f7b71cf20a65ba8eaede54461a6b068b71518313c52241ac5b4a9b2e3601bb500903bd658c4b136b1699adc31d37329a7","ssdeep":"3072:F7F2yDDaYMCAMHQ5h8GM2fEN0A0VPhzPF6bqbguBNiPDwYWW0KYoE:VF2yvaYMjMRN0A0PhzPF6ubp0DwYzE","tlshash":"1dc4c6689200b03cfc1ff5a89b9887cf7151b412e81267eced86b225c5d76f326b5b49","first_seen":"2026-01-14T15:07:41.547194Z","last_seen":"2026-01-14T15:07:41.547194Z","times_seen":1,"resource_available":false,"data":null}},"time_used":641,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":641,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/iozh28com/js/bootstrap.bundle.min.js","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.486Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /iozh28com/js/bootstrap.bundle.min.js HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 11 Jan 2026 07:11:31 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d23-13bdf\"\r\nexpires: Thu, 15 Jan 2026 03:07:13 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":80863,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65257)","md5":"12b767b52298b7437b56d103d5c5bc50","sha1":"131d862a7a499870dd1822d2e8e4476b7d3172e0","sha256":"5317830fec028fc80cd947a083f872eced09b72731ca9b0ea77b593ed3f57b13","sha512":"094c93f390a1446554bcc3c7e8c40a656fee37267a94e5542c29f3bc687a799e676f1b58d8f74ac6de58d0d2c8e750a6016f3f1d11e08c3a45f1a56cdb8cb9a1","ssdeep":"1536:fSwJiEbnTl6R2t49CFliFCIg/yWszSraJd5qUFH9tZwcE+iYZMgZdj:awfs+SSO5q4tZwcEVYZFj","tlshash":"0783b5593244b8730ade85b68037430bf2265998b14b812cb57cadde2a7dcc67277f78","first_seen":"2026-01-14T15:07:41.548822Z","last_seen":"2026-01-14T15:07:41.548822Z","times_seen":1,"resource_available":true,"data":null}},"time_used":630,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":630,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/tb/iozh28com/iozh28comhz4.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:14.568Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/tb/iozh28com/iozh28comhz4.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5670\r\nlast-modified: Mon, 12 Jan 2026 17:04:30 GMT\r\netag: \"6965299e-1626\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5670,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 220x220, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d7dc07f44f8e6cef65b31b3e66416451","sha1":"032cd8178506bbadd0cd8a751ac9185bd152f7e6","sha256":"0f5f74e71150cd734f787dd4a7dff779b0922c3c75acd87964eb6431b3e6e466","sha512":"c29c3e5272cb5abb2c6ca229eaec765bdb87476efb3876de8f6070f05f0e9fcbe85b247482dac98d0eba5ad40dc04e70ef50382d0f8b8f40b27ca5ff003130c8","ssdeep":"96:ng99wWo4MWbGN68OWV8Y5WCQ3lZAv+N/0DqJGk8zO+h+5O+PWNlLytcbsxlkx:n+eWPzbGYASZABA6ze5HP2luUsbkx","tlshash":"dec18e6e30256de72b60238f09f96d4c1f6490e1a6381a6b21bc78f1f05b3f4f157621","first_seen":"2026-01-14T15:07:41.550766Z","last_seen":"2026-01-14T15:07:41.550766Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1086,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1086,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/favicon.svg","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:15.550Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:15 GMT\r\ncontent-type: image/svg+xml; charset=utf-8\r\nvary: Accept-Encoding\r\ncache-control: public, max-age=604800\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1651,"size_decoded":0,"mime_type":"image/svg+xml; charset=utf-8","magic":"SVG Scalable Vector Graphics image","md5":"fa73233a6f9d440a53bc13505466900c","sha1":"3d6e13fb3fc5e438cb7e52756449291b61df6bb3","sha256":"105ae95a3c29ba3babd48aa8d1ea32b416f0b4ee8deaf451873630d7f43f6fb0","sha512":"f2e4ea324d823dc60b45822cb65aca36e781c958189cf84b60152fe9e5f2881022cf8b6caa93c392f2d509e7721def7b5f0b7079f3530e555631da983bdfee10","ssdeep":"","tlshash":"0c31325dd99674fde8d5a8adcf30dde8f52e00ff9aa147b4c0050b0d20179ca2c0e198","first_seen":"2026-01-14T15:07:41.552397Z","last_seen":"2026-01-14T15:07:41.552397Z","times_seen":1,"resource_available":false,"data":null}},"time_used":215,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":215,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/css/main.css","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.670Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/css/main.css HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:15 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 08 Oct 2025 18:15:31 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68e6aa43-7af3\"\r\nexpires: Thu, 15 Jan 2026 03:07:15 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31475,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (31475), with no line terminators","md5":"1ea9b2c05a6abb63da00557d5cbe1de5","sha1":"c9a9df6e272943334ca12acde761d9f528b6e4aa","sha256":"137a20af221196335af9b436c05e0f37cb786532fb998b5cc91834884bc1b510","sha512":"f893782306d1ac52d319c96b2f4c4330521f55f339140e4091ce1f7867179d9a6f340cdf1d7d2aa8f6c03e30d66ac22b04533a685de9f0a67b106d16d6a160ae","ssdeep":"384:UwK6gPuYSi9lD5e115JwKUbeQuebD5YLXm3hKaJW/:w6W9lD5GabwLsJW/","tlshash":"cee2ea3c96a1503bb1778e7f61dd321d7c298813ce022799b26859ecf7c67a702a3752","first_seen":"2026-01-13T02:35:24.402443Z","last_seen":"2026-01-14T15:11:41.857902Z","times_seen":12,"resource_available":false,"data":null}},"time_used":214,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":214,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/img/huatihui.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.680Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/huatihui.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:15 GMT\r\ncontent-type: image/webp\r\ncontent-length: 38434\r\nlast-modified: Sun, 07 Sep 2025 09:34:49 GMT\r\netag: \"68bd51b9-9622\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38434,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f0d558526a340ef0a4ccd0b356468053","sha1":"d8c68232c6a01412dc710dc3c0a550a009abc3c9","sha256":"83f7a5c4d6e61fc0e54132461a188922075b494a18fb23208380894fe89a1823","sha512":"dd606c59a5ae84bb2252807c59941f37073b7cd8dad6bfb51140a7319041e5354353563a2f9632e0d10ca7a96dd7d83f355c8b2475355177df40ecc8a15c7f8c","ssdeep":"768:kZkA5GmGFqyNA4RaqIx0mSfl51sUCRPvFvuXT7frG+1j2:Gkz7FrNDaqIxGmr9u3frJ2","tlshash":"ca03010162c54baa8e6f6129f51abe77404409f2c87ef970d0d40fce1b9f983674c758","first_seen":"2025-09-24T09:47:29.027715Z","last_seen":"2026-05-18T18:12:32.933309Z","times_seen":23,"resource_available":false,"data":null}},"time_used":235,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":232,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/img/mk.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.930Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/mk.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2556\r\nlast-modified: Sun, 07 Sep 2025 09:35:15 GMT\r\netag: \"68bd51d3-9fc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2556,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"749ab1e814e220249ab6246cbdc05e68","sha1":"f002cda193dfd314b074b0c8fbe604e3e238c19f","sha256":"e4d2ef9496fedbf3fa99ff4dd0c8423fab07809830d2911b2ba3f27b25f8c6d0","sha512":"8cd6670382843930aaaf812d278e9c3645ae27c0de9c2de5cdac04c014ebac5971250b02b4e94c24f630c4f1ab5e34639b5ecbc92e7fa0797d1445726f31f420","ssdeep":"","tlshash":"80514c667118947bcbee53af81d6934602fb980257e8c4899ac30e26f012dd99fed705","first_seen":"2025-09-24T09:47:29.017519Z","last_seen":"2026-07-25T01:51:28.109192Z","times_seen":75,"resource_available":false,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":220,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/img/ayxlogo.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.933Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/ayxlogo.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9546\r\nlast-modified: Sun, 07 Sep 2025 09:34:22 GMT\r\netag: \"68bd519e-254a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9546,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"be5dcef31622cbfb260097a78d11dca4","sha1":"869ef9932a30393dfaa89d8ff0892f113a99ab1f","sha256":"40dd354a3543414ee6a058890017485b24e8c7265fc2d61f0ad4b708451a6bce","sha512":"27ee1e7f6d965882d58858d3f2f55da2ba1a870c46f911100acf65e975927c447e63cd5d3fab71b2534b9b3f2b5206841b6dc27737777ad945c651738104e138","ssdeep":"192:CpDUlXyfWmsSgh38yuGh8yNpyEOtS+3TnNb51fgYD92Ojg0ok:UYRmsS5yPtNhWS+jd51fB2OE5k","tlshash":"4112bfca34e67542158441259fa2178cd8c29c0654cf74b7ccee3eb71e6be6d1e38411","first_seen":"2025-09-24T09:47:29.024403Z","last_seen":"2026-05-18T18:12:32.943641Z","times_seen":23,"resource_available":false,"data":null}},"time_used":214,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":214,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/cover/iozh28com/iozh28combanner2-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:14.561Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/cover/iozh28com/iozh28combanner2-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 215426\r\nlast-modified: Mon, 12 Jan 2026 17:04:27 GMT\r\netag: \"6965299b-34982\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":215426,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 816x544, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b67d5152a329123874e8b26084e04103","sha1":"7afae136b926cc96ecf92f8ade8d732b7032e936","sha256":"19839c446e59221c256c49ae490f01dd9940572543ad211e33c8e37261fcabfb","sha512":"c8c3d1e1b9bdc02d16431eeeb13c8cb8cfebe47b608ed7b387f48a0542efa5014a310c3bee9311a7e95a6042ffda9545335fcbb34cf9a9d579bfea7552c686b4","ssdeep":"6144:mF1kvitYghjA0gnm2X78Gzlb4uRM3cmk4h:JiPhjmmm8Ux7yvdh","tlshash":"042412b10c43f90277572669ffe9660e6026aa17e831f183329bc4587b7d122edc974e","first_seen":"2026-01-14T15:07:41.55672Z","last_seen":"2026-01-14T15:07:41.55672Z","times_seen":1,"resource_available":false,"data":null}},"time_used":879,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":665,"receive":214,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/iozh28com/css/bootstrap.min.css","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.451Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /iozh28com/css/bootstrap.min.css HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:31 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d23-38a7e\"\r\nexpires: Thu, 15 Jan 2026 03:07:13 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":232062,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65298)","md5":"c7e1800fbcdb306e3079708e20fb5f99","sha1":"6a38a4d25b90463ae225741907430b0c26e0364c","sha256":"d2ad20bb8e3ad2e80bd4b9759587ec8724a7500d1f2c901f4dd75f81a580c864","sha512":"72be1f8c02406c127c4284f63a04f7d28a2908794b87078fb6e9ab354f8cf801362512187e290085a820a0a60d2a5cf23df4bbe4f2b7370cf37b4dddc430b523","ssdeep":"1536:Z9CnXGi9GfJkfvq5wlP7cQZDR9uvV982sYRElV6V6pz600I41r:unXp9GfrV98II6V6pz600I41r","tlshash":"ac3482d6f590317d9ca7c1499681fefd896fa985cb120aa6f003776807cabd30962dcc","first_seen":"2026-01-14T15:07:41.558061Z","last_seen":"2026-01-14T15:07:41.558061Z","times_seen":1,"resource_available":false,"data":null}},"time_used":642,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":642,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/cover/iozh28com/iozh28comabout1-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.462Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/cover/iozh28com/iozh28comabout1-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 163950\r\nlast-modified: Mon, 12 Jan 2026 17:04:36 GMT\r\netag: \"696529a4-2806e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":163950,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 789x535, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2568e60a55be01c488ee5ff5fc8965fa","sha1":"e13b270181cf90483b60cac81ad6fae5968925ec","sha256":"0708929181b706c267816d9556f8d798d63a4c3e4a1d58556172435bea568081","sha512":"1132fc12ca108b3b064b77e23dd9a5c03f9af82fd1c764e7d57d71aa34fde5129dfb0d5d45e21308fbacb8540faffa5682b3de1020a165dc4ef5619925333350","ssdeep":"3072:rlCrP8aXrGQDf0BO+TfgdOYBNIE1slfaa3d0RoyMUVHJTVZz78kfpsVTLJa6:jSQODnBe04fRd0RoyMU159fQ1a6","tlshash":"01f312a1f9f9979c7ec9c8ca88d733ca5d9e45f31a3c2d3548e54d35a7b205902b08d8","first_seen":"2026-01-14T15:07:41.559247Z","last_seen":"2026-01-14T15:07:41.559247Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1534,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":639,"receive":895,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/yu.php","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:14.422Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/yu.php HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:14 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=fotl55bq7vqua38uebn3cf27vk; path=/\njscheck=1; expires=Wed, 14-Jan-2026 16:07:14 GMT; Max-Age=3600; path=/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":35,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with no line terminators","md5":"b13b6064fca232801a7ed3ca059c449b","sha1":"75e40db5d556460f7721f00204b126399009979c","sha256":"697c72a2041e67629aafea6df1e44ee7d1ecc89c32fbed5e86905a744ac601c0","sha512":"a5e200304051241229c9d96f6aaa0fdfcfce8312c1f9b2aa2b6fe8edc85342adec29e274608752eb07511969072a5369171df2bce50f0124b3a3410ac56e5fe0","ssdeep":"","tlshash":"2c8000ca2f08e2000ac28c2a88b0f00c08b200cb082bf82220ca3002a8083fe0e2380a","first_seen":"2023-07-17T11:42:34Z","last_seen":"2026-06-06T02:24:29.581395Z","times_seen":69,"resource_available":false,"data":null}},"time_used":584,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":584,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/img/niubn.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.671Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/niubn.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:15 GMT\r\ncontent-type: image/webp\r\ncontent-length: 29966\r\nlast-modified: Sun, 07 Sep 2025 09:35:24 GMT\r\netag: \"68bd51dc-750e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29966,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"28945c9503b45b2eb3025544093bf6af","sha1":"2d6943e01038a2498ec7207d8ab0fc8357ecd44e","sha256":"1dd82145b81a3fa77ea6b01ac046589c5dbc29cbd453e631aa9456ff7d4be1e8","sha512":"1321ff8e699c208178d1a89631ac0dcf1869573be344372df610019ec21c0c83169ebfa8a5fdeea8a328ab7a2c731f1782d533b40c9ae45c905818fc674b45c3","ssdeep":"768:Q0f+OlvtP1RystngUGaprs4uD4uj1ACbBtl3/+o4:Q0mmtNkEBpVusIbBthG","tlshash":"8ed2e115beb2674b172530aea9cde0e8d20aafd4c96f8361d03bd523551f15ab30f923","first_seen":"2025-09-24T09:47:29.018607Z","last_seen":"2026-05-18T18:12:32.958213Z","times_seen":23,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":215,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/tb/iozh28com/iozh28comhz3.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:14.566Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/tb/iozh28com/iozh28comhz3.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3350\r\nlast-modified: Mon, 12 Jan 2026 17:04:29 GMT\r\netag: \"6965299d-d16\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3350,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 220x220, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b3b0be0ce8f983d8d9074025e9614ef7","sha1":"a1c9d357722539e48125940ab72978d50d7cd1b6","sha256":"bd300f803ba82887dcc966f6e7b0daa448256a8fdfa9f37ee7bcf7252a9ea663","sha512":"4a1883dad6a281a5ad0c526fb02cfb2daba673ac1cbac66df75c5a2492dfdf075266bad68dec66b45b6e81753667b17120d9a5638b4ed3776bbbb28c99927664","ssdeep":"","tlshash":"51614cefaa63fd7382e480bd7d9e0613385549aadcc0b424a1ed4e2022a4d8ba953d05","first_seen":"2026-01-14T15:07:41.561538Z","last_seen":"2026-01-14T15:07:41.561538Z","times_seen":1,"resource_available":false,"data":null}},"time_used":878,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":878,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/img/background.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.920Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/background.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 16850\r\nlast-modified: Sun, 07 Sep 2025 09:34:31 GMT\r\netag: \"68bd51a7-41d2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16850,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1920x1030, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0eb2c781e3ba5951441d8cedf9d387e6","sha1":"cbd29ba91f9502cf3757f8d92da29469e196ea2e","sha256":"9e0e142bbb79c40e4ec06b28175c4f2332e8d4e6bcf10db8270418c3c9ba96cf","sha512":"fea86fe00df6dc6de8ee742faf252c575c75e21ad06baf7b4cdf7c9dbe5f0b5c09db00bc637ce16cc4171061d11af4c3219f7abe62a9c2cfbf808de92561e2d0","ssdeep":"384:1a1+BrAsLbqXyH1JVGns2mAPxJErGRL/R1DevdACI1qB:1OfzE1JV4l5Td0VA5a","tlshash":"ee72e0c9c326e485921e09b0949212f871d7bfa6754da61c49f5bfec93a483be845c33","first_seen":"2025-09-24T09:47:29.008993Z","last_seen":"2026-05-18T18:12:32.964182Z","times_seen":24,"resource_available":false,"data":null}},"time_used":215,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":214,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/cover/iozh28com/iozh28comrongyu4-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.470Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/cover/iozh28com/iozh28comrongyu4-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 151406\r\nlast-modified: Mon, 12 Jan 2026 17:04:43 GMT\r\netag: \"696529ab-24f6e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":151406,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 647x453, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ba05422d34e55356da3235e589e9b33a","sha1":"b0b3a902b5fa29bb5217475fce07b8b2e2a6afad","sha256":"8c2ac7d29be844d57698a685835366804417dd6a3cc80a97f1fb36844da3f9a6","sha512":"8f2c2429ead78fdc2847a0e12bc255d5d8cfd3524f6c2fe275fdde582f4e3c0aa35625fd43c1fada03c72d84045cec9e9468d8b3922b169c73a7e7050011d65b","ssdeep":"3072:+X6bYAp1AqLqoRLtLSKB0sqWIivEw4/S9D8xx01uwWb6Pj9A:+q9uo7SKfqKvEw4GD87fwG6J","tlshash":"a3e323db5f266ed86559092eadacb7febec3139f02c6470085e301bb3b303c65845a59","first_seen":"2026-01-14T15:07:41.563336Z","last_seen":"2026-01-14T15:07:41.563336Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1543,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":636,"receive":907,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/cover/iozh28com/iozh28comrongyu1-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.464Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/cover/iozh28com/iozh28comrongyu1-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 202810\r\nlast-modified: Mon, 12 Jan 2026 17:04:39 GMT\r\netag: \"696529a7-3183a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":202810,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 716x477, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c481aa41a771390d3adc03bfce32fe6d","sha1":"6e3f4ece9d6c0f01276be6b1f8377d9fc3b0c7e6","sha256":"41e89ec26b976215cba818cf99508f7d90f2ccf3f4fe64bd752b0fac433c47f0","sha512":"4f25a9bbd93f2711845b713b73ded4330b909152c767a5ad2c7cc97cc74830dcda4f16b7e17750cabba8889aa5a4fda94d4e1810c4923e716fb40642e589e424","ssdeep":"3072:/SrgXYqS8c5US7lo1bVksSckfNxigwpQhm0Ap9e1uhGnrxchj+lwJgQYE+Fj4w:/1olPG157gulT0Ap9euSrq+lwJgLXFx","tlshash":"68141345f86fa378211e4bc39ec7ff57826625bb103962dc8224214f45b64a4de3ab1f","first_seen":"2026-01-14T15:07:41.564532Z","last_seen":"2026-01-14T15:07:41.564532Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1567,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":638,"receive":929,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/e/dongpo/tz/yu/img/jiuyou.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:07:15.674Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/jiuyou.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758; PHPSESSID=fotl55bq7vqua38uebn3cf27vk; jscheck=1; _pk_id.17.0898=a4d8d8ffe628365e.1768403235.; _pk_ses.17.0898=1; _pk_id.7.0898=dd40ea56d5acfa6b.1768403235.; _pk_ses.7.0898=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:15 GMT\r\ncontent-type: image/webp\r\ncontent-length: 33260\r\nlast-modified: Sun, 07 Sep 2025 09:34:56 GMT\r\netag: \"68bd51c0-81ec\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":33260,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c8ad931b675f5d8c537b832427535d0f","sha1":"d7a18d16c4a38f97151ad1c02b5c8fbdf3d20f76","sha256":"50bdc8a37b133205854e3d80c490b0f63e4b02837fea30067398075b7e49642d","sha512":"7c55286e0b35a724f116f030b9049857b1d4241aa98597a2e8523bb91a5491f2eb90a375fd4429c3d6ef09c839ff51e95c6efb765440fdbf29ea45b9d4acf195","ssdeep":"768:JONQcgYSNbhjgP6b3vCixS1LHWr9hx7u4ev4SID1z/oX3:INQ4SNBgP6dxS1z4vi4ev4S2zgH","tlshash":"dbe2f1017f06bc3828690d529a1e550d3246dfc61793eef5c5b8374df539724065b4c2","first_seen":"2025-09-24T09:47:29.013234Z","last_seen":"2026-05-18T18:12:32.966501Z","times_seen":23,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":218,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/iozh28com/css/zhibo.css","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.457Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /iozh28com/css/zhibo.css HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:31 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d23-6260e\"\r\nexpires: Thu, 15 Jan 2026 03:07:13 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":402958,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65491)","md5":"d3b7ac84d3d496091e42b8e38ad56737","sha1":"1bc46f7397cfc322f3efca3f69e0e89e456f4ff6","sha256":"0be0b06b1bc7054224ae991d499ea42afa9387309140c67ed243656ab5032182","sha512":"6928d65a87e1b75e4f603331292004c81fc9215167377d29b5d4cd59c931b9aa30abbc3d0d3df8ad64a680b92bb5c4b4a40e609051abaefe4a3de1509304833c","ssdeep":"1536:+By1YRODkZqdC+c2NnRLRCPlzXAV8hDGcDsl6mcwm7VU/doDk02XLFa7b1f8FMHS:Ky1RRPNm722XMYUtSWEBKVN","tlshash":"2a841fb6f1f52175eb1af4df110c7a9e39e069afd0115ebdd8c3a326c4c3aa3026454a","first_seen":"2026-01-14T15:07:41.566761Z","last_seen":"2026-01-14T15:07:41.566761Z","times_seen":1,"resource_available":false,"data":null}},"time_used":641,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":641,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/cover/iozh28com/iozh28comfuwu1-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/cover/iozh28com/iozh28comfuwu1-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 143876\r\nlast-modified: Mon, 12 Jan 2026 17:04:33 GMT\r\netag: \"696529a1-23204\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":143876,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 704x469, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"677e725b02594e2508c1628092f65750","sha1":"b80d334d979e09915f8e1dc24eccf4352999ba2d","sha256":"19fb4dbf64613bfc028265eeb7b814b06c52fc4d245dd1575be253613ac629c1","sha512":"4d88c9ecbfb5eff7ed872a8f3828c01eb9701db9af03e082d7f386a7fd734829255843339807bf6b1be7a3beafcd48f91b8f0da860dd39a8aedcd22ca848e23b","ssdeep":"3072:zW3XoMBmn/1uKqazkZDvpsJLx81A5WmFUJRsytZh:WC1/k3sv5WmFwsO","tlshash":"d9e3135acaa273b78818ab5d889f94bc0035d81352fcf9e43b1a6456dd9cc1e2cdec24","first_seen":"2026-01-14T15:07:41.567913Z","last_seen":"2026-01-14T15:07:41.567913Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1532,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":640,"receive":892,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/cover/iozh28com/iozh28comrongyu2-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.465Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/cover/iozh28com/iozh28comrongyu2-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 192372\r\nlast-modified: Mon, 12 Jan 2026 17:04:41 GMT\r\netag: \"696529a9-2ef74\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":192372,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 769x512, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"8ee8629300a8cd846f2ec09fdff71489","sha1":"b92df8618d66036c94d832b635b5df431ecac182","sha256":"d9acb601b45e46c4847dd77ce597b3995eb1aac2823028efd1bb3884930bbc97","sha512":"b3ce8e5d557185449d50cfe71ccec94a83f02d9e59750df083bccb83e7e8e2708ad90cc438bef38216becfcf7d99c2929de1e5a219971a7cda8a37aedffdfc58","ssdeep":"3072:mViZl6f++V6FlO6t5R/jJqwufDQnIQvkrLQUrCm+I3JJdQmpu4SOKT0le+:mXm+XORtHQ9QqCm+I3JJamLle+","tlshash":"8e1412b9437a62bc56d9549fd0ea6633d5c83a3867ce32c0476ec243d9181f6b58b8c2","first_seen":"2026-01-14T15:07:41.569206Z","last_seen":"2026-01-14T15:07:41.569206Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1543,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":638,"receive":905,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-zh-28.com/skin/cover/iozh28com/iozh28comyoushi1-231.webp","fqdn":"io-zh-28.com","domain":"io-zh-28.com","tld":"com"},"ip":{"addr":"38.238.25.49","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-zh-28.com/","date":"2026-01-14T15:07:13.471Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ratio2-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 16:36:03 GMT","end":"Sun, 12 Apr 2026 16:36:02 GMT"},"fingerprint":{"sha1":"58:C6:A7:FA:13:E8:3D:C7:72:71:86:F3:4B:4F:69:1A:D7:71:85:82","sha256":"09:39:6F:3C:B0:14:A5:64:5E:B9:0B:D8:D7:3E:BF:FB:63:62:76:60:42:42:E6:69:1E:39:00:25:3D:CE:43:89"}}},"request":{"raw":"GET /skin/cover/iozh28com/iozh28comyoushi1-231.webp HTTP/1.1\r\nHost: io-zh-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-zh-28.com/\r\nCookie: SITE_TOTAL_ID=9c975bc9107b959bcf49ca255d182758\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:07:13 GMT\r\ncontent-type: image/webp\r\ncontent-length: 178956\r\nlast-modified: Mon, 12 Jan 2026 17:04:44 GMT\r\netag: \"696529ac-2bb0c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":178956,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 758x508, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3e1b42701fb4750ac9c2b059890e4ce0","sha1":"e9f6fad00648845159c010452099c38c33d063b2","sha256":"a12e8bcaae25b66bbdbf3c57ae4a121e37bb2c216c44a8d9cf46f2073e168eb4","sha512":"34000e3ac3f1d080c55744e3aa5dcd793838ec4ee2a14e64ee95347df3aa1c8b8377002bf0dcf1fbc4fde416c774a22b1f99d5d3597df09937180ab9d464c9b6","ssdeep":"3072:PV4J1fGwuJ6k0u6FitgDuzRJ6Yca2/Oh4MhzjJefhsXNEjxlkDqe2G646:PmJ1eDZeDaRJT2a/ztrExlat646","tlshash":"cc041215403b48e91a158273387c9dd8ee315e9e72c96c988ffcc837e1789da118f92a","first_seen":"2026-01-14T15:07:41.57075Z","last_seen":"2026-01-14T15:07:41.57075Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1547,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":636,"receive":911,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-zh-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}