{"report_id":"256d22bd-570c-419e-8699-0c894f682a6e","version":6,"status":"done","tags":[],"date":"2025-12-03T01:32:49Z","url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.146","port":0,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"title":"welcome-BET365","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T02:04:44.628897Z","times_seen":17911053,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.146","port":0,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-07T01:32:49Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"y108p.xyz","ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-11-12","domain_rank":0,"first_seen":"2025-11-20T14:42:26.729884Z","last_seen":"2025-11-28T15:22:21.289863Z","alert_count":436,"request_count":109,"received_data":12883280,"sent_data":55764,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"photo.365live88.com","ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"domain_registered":"2022-08-16","domain_rank":0,"first_seen":"2025-11-02T03:06:46.95373Z","last_seen":"2025-12-01T03:41:44.469089Z","alert_count":0,"request_count":42,"received_data":1799753,"sent_data":20118,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"y108p.xyz/js/home.1756903329400.bfa8c420.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"caeef6f42deb46a855ccb60a2ed5b445","sha1":"13594059c305a13f3f001270017ab9aaa21443c2","sha256":"ede9bdf96f357afd7f61662fc1654334932bdf9d3e0ad7e9581a792bf2912530","sha512":"0f28cdf6693505cf9c674caa54a226cb16de87aead1b75244f3c6e68ee5d206b133b3e5f081aa9a1db2b285e8ac607f1a1a289401afb0b6404b3e2865d0d9d03","ssdeep":"3072:f1E8oNSIMrtwsAFJBuokQvFUqlGSBJZhxffj7TEOiGRA3:f1E8oNSIMrtwsANKUFHzffjAGa3","tlshash":"c3040880b5f0e275575fd2bbd7371024b22b1686d0ccac60e1f66b187e18799b236db8","size":186713,"data":"","first_seen":"2025-09-04T00:49:32.93504Z","last_seen":"2025-12-29T13:58:57.964054Z","times_seen":424,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/17600.1756903329400.89772027.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"537a1190cc025f0707bbb2a736630283","sha1":"1ac2e221c5e4e26737c6e1b7fddf2d363e4b65c3","sha256":"296f9d35557dc9588e8c6bed7134ca0e3055473306531756660582a6886bfedb","sha512":"3202114c8afb764ea0c4cd32bd78e7ad51295face85601b71b7316535d8fc29ecfb314bc1ace4ff0f54ef46a2016d09e764078ea1d7bd08ae75077ad6eab2341","ssdeep":"1536:+D5AxGst7xILpT0iiRs1vE/yKLJdLI065veGiHjLFIEfma5/xY8SbF9JiNp/QQbU:+DqxNfns1v4yKMpBesDz7+I1ou","tlshash":"d8e32a94b380717887a743b5b21f5196d22a08601098bca4f26eed94bf749ddf63ecdc","size":152171,"data":"","first_seen":"2025-09-04T00:49:32.979776Z","last_seen":"2025-12-29T13:58:58.065817Z","times_seen":421,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/31098.1756903329400.4108b3dd.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"215815c091a19829f9fd6e5f28039f0a","sha1":"8ff2707b0ab4498bfd2bb7f99674b5a245ecceee","sha256":"06371440853645a0532df5edbbfd5c9e9661bec969aabc25b3353297c6f6574a","sha512":"34933b0388cddca0826af79fdd0f82c31c1264e87f004cd921360b19dc83a0ff188ac52a4de89427cc1c09f2785179fdf4d0ff7526d4a74a55f7971fa2738e9c","ssdeep":"1536:Ow+0YvC9jlTKAUSseG1SY46DCdlBBo3AgXOG9AsqCfCXsvCfCXsLCfCXsyCfCXsf:O/KK5sY4brG7O3SnLJNpL","tlshash":"1574b6f4c248c6fdea04ce0a7e7d6f2d50723783f2ec96c446aaf8865e91857245c4da","size":352758,"data":"","first_seen":"2025-09-04T00:49:32.813984Z","last_seen":"2025-12-29T13:58:58.029423Z","times_seen":409,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/13575.1756903329400.cda1d494.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"60a85822cef01147878bbad7876a1fe8","sha1":"94563a78fcb76c76cce769d2fc4021baf782c844","sha256":"5b0a33a268e1507f5e758833c854e3cda700d19c35357e4a2098263a80da8892","sha512":"c23f2184349d611d1c54c379a0aa29d9564ea4b76b44c049647f0caf9e5b9dfd809c87eb9fa94c58377df9a9540580d0920802784fe9f485380985f36eaa4a5b","ssdeep":"3072:z7jHoKRKphCnDgJoec+IDWIzls+7Xr0X7:sKRBgUPDWCW7","tlshash":"42141a84764170b8c396a165322f601ae22f789650dd9c24f3789ba47f7470df26fabc","size":194924,"data":"","first_seen":"2025-09-04T00:49:32.754298Z","last_seen":"2025-12-29T13:58:57.972807Z","times_seen":438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/theme.config.a0ea1565.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"81c0ad2c8936f5f90cc4ba2b2e53366e","sha1":"8abbe251b908b7d81c73d8537d9d144d3ded3ff7","sha256":"61e7b259016e16c5f842da901c3b2f8202b73db878acb4366eccc217a4dc0b58","sha512":"f295e613097c68b8cb8d0a2530d07c3e883ffc75fdf6d0cd35c23040f1bb182401671c0f70781b64c97db7a37fe9d6d8163de658aef95ce9327ae0068afec7f8","ssdeep":"1536:D2JREob3mtlIRM4Sb2mc42mnzyJog9Cc0hM:qStlGu1pnz45HX","tlshash":"a1a3bb7ee20c963a6177a9bfb46ce111c12e9c0cab1d5fdef13e10a25710669c831de9","size":106213,"data":"","first_seen":"2025-09-04T00:49:32.985127Z","last_seen":"2025-12-29T13:58:58.024831Z","times_seen":440,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/52388.1756903329400.521cb32f.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"cdd31eb0b7ccfc1eafcead314123dfda","sha1":"2bd4708c1e30cebc08cdada8ef890baec6ef8622","sha256":"669b207d5cf11b0e229699f6e54104836b252c5398e20c4bb564b89b2525f0a2","sha512":"9c48059df23c4a9632eed22a28d883786e40c593fe3ffddb9144fbca21a45322121e36580084fc642e9058f086d3657d819f5d2b9528a91633aeb2085cd5ff06","ssdeep":"768:f9Vl3u/ffsp3aNWchZ4IIATAJ016fkmD19mprq2xd7QjDv1gyT8CpYCVc5WsNiU:8308O1cq2TlW0","tlshash":"84c20a80d6b4f5fd636ec9ab8a3a8464602637c5b0c8ace095ec6e8c3d4475774788fc","size":27418,"data":"","first_seen":"2025-08-29T11:05:53.257205Z","last_seen":"2025-12-29T13:58:57.988641Z","times_seen":422,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"9c81c3beaf90f98ca844465a7002e3f9","sha1":"6ddbbdc0cd6b49c92e369b53a70c0ce79e64e086","sha256":"36b56b4bb4fa9bad85b500d256518422d24b33749d33d98e70faae4026d27cd8","sha512":"a8a005f93401fd5cf3728852fff090519833c71539000aa3e63732878b6daf16ad01ae2a4eb5a1e1dae7afde4af219abbfdac27710c2d972d8a5640c56f2f71c","ssdeep":"","tlshash":"24217b195ee698211033703a1b5bf3443435c01b719dde013b5cc394af2896ba972ad5","size":1203,"data":"","first_seen":"2025-08-09T20:01:20.302285Z","last_seen":"2025-12-29T13:58:58.092967Z","times_seen":726,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/45540.1756903329400.c33043f4.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"000be9e193b9b0e7a8e7e2fc6a908605","sha1":"1f04ee0d0816dcb4a310f1bf9053f36c15561922","sha256":"0968ff07195a9aad5c3f080a919c803c162ccb3bb176330b762c1e4e884e75d0","sha512":"d05ca2e4dbd262beab20be9f7872c1faf4d88129b59234fb2009c9ecc7114341558d7813d701cc5aa54dfa4ec028ab007eeff864ac6bed87a4ed8d42499954cf","ssdeep":"6144:rYD4wFsYiSGfKnCKPP6Xm9sm3MCln1OSgpozfEe5a:rYD4wFsYiSAKNH3TY5","tlshash":"2b24e894f294f1be075fc1f1d23b501af35b5e6120cc9ca0d296e6942e20b49da77eac","size":229352,"data":"","first_seen":"2025-09-04T00:49:32.837166Z","last_seen":"2025-12-29T13:58:58.015173Z","times_seen":439,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/config/initGeetest4.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"4b773fe272ef2f3dc7c7e443cd8a0e98","sha1":"8f81f38f03c362533ba34d119215bf83b7574ed1","sha256":"9bb8b869af3ceacb9261dc2cb9165d2716b150bc35ba9da63dd23674fe0773b0","sha512":"e0539af0bc1ad92c1799b6f5c0c759a68537b8063730bd0577aec9f7cf620d34cd166bd5a15c25d89cad49d80f51938b6072c4aa27d07f010e6aaa83ce6e3c5d","ssdeep":"192:hN3ar8HuCDoNu5dq+ExNiqc4K25MB5VsaiQxta4SScQVy8QRHIqaawzjTki59r8Q:fJe61XHlii5aI2PG4lyUIVKQTwwPlB","tlshash":"2562200d68f750a35553b43c8b9f6014b5388a93041cde41be9ce394af9843d9bbabdc","size":14854,"data":"","first_seen":"2023-12-16T04:09:07Z","last_seen":"2026-07-06T04:48:18.66713Z","times_seen":2858,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"5281f83487c386b7836c0a61310eee71","sha1":"b69aa5eb7750fa2d18540f7a8f28dab10d4b2631","sha256":"5c4f27503b020517fa4d8a831ce6ea7c9b425cbda5603e8e6ce9119aa406cea4","sha512":"4d7ca7094121bc51fd7e24de7f2b9218624f1c7c2b5949e25ad2be53f4b1babc0ac6265a9e20acd2d51fec4e844baebdd7d1aa300a7f52f3b360bf36a8979ca2","ssdeep":"","tlshash":"5c8004047d5d50540000503014740c0d5c133c57403f0314340dcc013fd5c401447441","size":36,"data":"","first_seen":"2025-03-03T20:54:16.013922Z","last_seen":"2026-06-23T09:11:58.933356Z","times_seen":2969,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/chunk-svg.1756903329400.5bf5ebac.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"7f3450cde65c4d0964dcc6d243a1656e","sha1":"ad5b362b491b71dff95398219d8e190c80650865","sha256":"924472178572d451953cbf73efcf577a697b3102176fc17d9ab8c379b6b37bee","sha512":"e8f2350a17821376b71a040626a3d5c58cf5744b22d512fbef45b3246558b0f7001ca4d48d32e34831ec7750e40008f7aef529b4e618c6770bb5e72e4c028cd2","ssdeep":"3072:38nz2uaLZSZvx6Q/sIPrekK+m36Ua94sRZI7gbpU:38nz2uasNxpXPrekK+m36UHsE4pU","tlshash":"7aa4fcb4c190f4edf704ce196e7c9e1c50321688e0a9e9e52da9fe0d9e85d6b241cdec","size":461002,"data":"","first_seen":"2025-09-04T00:49:32.781171Z","last_seen":"2025-12-29T13:58:58.073596Z","times_seen":441,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/chunk-common.1756903329400.8e9f70b3.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"1b35e779a9012cf73988d1d4b0d9e5f2","sha1":"c139c75aed4b303657e5a48a1fb036d7fcec6533","sha256":"9231e7c73c53eeebd2a055dc9c7402342f21053dbbbdd257be62eaf29c98fafa","sha512":"53ab4c8aaf4fb2bd81c55c7356348b96d509ee4f2a91869043061c8b6ffac404ce76a6ca57caddd47e94dfa5e821a3e6a85c969cc94675fe8625cf44d689c05d","ssdeep":"1536:6ZVB2bNNcdWUc2UTC6oryXHuLmbErF/G7D1dMI5MHLui7TAN/voVG5glVbGD3tFZ:6ZVBM/TC6yjFecHLui7T4/voVG5agD3t","tlshash":"73f3e8c5b3a0f07e9a1ed53779331499b12f758274c87c60f1a1ada6bf19708a436ca8","size":159516,"data":"","first_seen":"2025-09-04T00:49:32.82259Z","last_seen":"2025-12-29T13:58:58.058135Z","times_seen":438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/21954.1756903329400.57c97863.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e2c9f0777c63b333fc66af020ed0ef8e","sha1":"72714b7bdf899cc87c7399253e37aaa2a2f4487e","sha256":"0a2a1939d88947975b56974be20cb84a9c00f3c94cae6e057836b39aaf6b8c41","sha512":"fc02eb76f16f16c8a7346f72e7ac7ef4a68bca53cc7a5bb9f1e00b43f1bb002ca7847e2804be7d6bfe0713c3466210038acc4d5794bea5bec8f0190135f3e7e0","ssdeep":"768:DBPsaSfmzKrMdvf0eMQ/96loumY1PI1yBK9LudEz+yUy51y9y0yk6Dio+ILqpTeY:DP81R6Ipyk6o","tlshash":"0a132088fac2b06dd3eb7330857f505ae66a1dc0668c5438e260d6917e7198dc1fb9f8","size":41968,"data":"","first_seen":"2025-09-04T00:49:32.704767Z","last_seen":"2025-12-29T13:58:58.045079Z","times_seen":433,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/64906.1756903329400.e9e9ec75.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"18789db02e1943b9b6e2a4bc1db4cc9e","sha1":"ab3db8b123be3580e4d5198c5ca7b99e0cd00d4a","sha256":"381bb6518856ad825c2e3fa1ec233fefa0ef52a11dd2a2dbca840381687dedb3","sha512":"6895a97c1c487d492779c4d0166bcdf0599a8634c8af8c051b573d84f001b730738eb8194f5edb5ca5eebff733289c293cd9889ea0b373330a3d9860cea872ca","ssdeep":"6144:9MhEyLkbLniyyeBHlBfb08rzZAncbtiTisXuLCoSltnIwb/mmtMDj0Rts:9MhEyLk3niyy0HlBfb08rFAncbtiTisY","tlshash":"3b241b94b690b17883bf85ff7224a164e24e1f9860cc9de4d26e2b407f12706b8775ed","size":217749,"data":"","first_seen":"2025-09-04T00:49:32.707517Z","last_seen":"2025-12-29T13:58:58.048456Z","times_seen":418,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"49bea4e1330b9d3f17c1c143ce23cb3e","sha1":"3a8874032b5979ba1fadfe141c0ebf28baa32fc7","sha256":"07f2a8f457d336c5a0cb2267f53a4be2676d30140da225305675f4b3957eb68c","sha512":"9cf0ea9cec23fb496db40aae14fe1df1a305d4a847e23a724645052c742a5995250f9d7f3f0584d3226aa17c6af04201f72cf7fca01bf4c788df2ab4cf488ad0","ssdeep":"","tlshash":"b580040cdc5544570000501014500cc57c170417453f435f750c04451fd34700007c40","size":36,"data":"","first_seen":"2023-03-08T15:23:49Z","last_seen":"2026-06-23T09:11:58.930085Z","times_seen":3036,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/64369.1756903329400.27cb8135.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"ce99014ab42559bc99f808a69bf596c2","sha1":"adf52a59aba8080dae7b97585e346f5aa782141f","sha256":"39076e64a0e5facd6f6f3d4db7f7fa71039c87d4a6250298dd4bd3059bfd9863","sha512":"ede23f1e36658737f40782ab61a166f1a2a6f61957524beefc283035c39337325c487d6236975bd97cf44aa91b31ed6985a3416ef561edd5b977ff02fb6b1b54","ssdeep":"3072:cHW7tB4Vgj5tNlxyU5YegxYffj7TEOiG1Zl+DJVkzEcx1nKR:cHW7tBwgttXxyUtffjAG1T+DJVkzEcxE","tlshash":"6cf31bd4f2c070f6475f45f2a22b1075b26f4d92318c98b0e15ba6597f21a48c7abeec","size":158174,"data":"","first_seen":"2025-09-04T00:49:32.946075Z","last_seen":"2025-12-29T13:58:58.086406Z","times_seen":434,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"0ce02dcf11f1634908b4afc4e1bcc632","sha1":"f8911bd806c6ddd3daab7f3eba10081d7af38f74","sha256":"46c7be5f428c72dac25551dbcf74f494989a3cf773ff04f9e115e15ad7dc2893","sha512":"c4f56e0a143f096a106956d55a60f07405a2418d8eec9917a027d0ede74e7119884002051c598445519ff87ad5526d035c221bbcfc65ce817539e6162f157ac3","ssdeep":"","tlshash":"1901735d483748107b2225bd537f5045f1a2516f9e87cc103c1e5b00eff48a72591bd9","size":750,"data":"","first_seen":"2025-08-16T16:35:14.594808Z","last_seen":"2026-06-23T09:11:58.933867Z","times_seen":2561,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"bc8a294899b949ca9677d96ab1c49745","sha1":"983c5ec164a83ee42e930da5b41946e6b0884dc6","sha256":"1f235d2a99775c3e5208abb2a05db1d9b6da61997a61ca5f7acb6ecb63caab29","sha512":"544b86acb0f595a5b12b887d5270444b63e23af877db68c8bce9ee5c66b37de75648eb9ea0757f899dba25f6376013beb278c9c8f801674f8886ae4368264e6f","ssdeep":"","tlshash":"4551b16d856684711db3346d2b5fb34835b340a36149de113d4d8f802f6895e82a6bea","size":2590,"data":"","first_seen":"2025-08-16T16:35:14.597318Z","last_seen":"2026-04-26T06:01:10.157524Z","times_seen":1785,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"3d053d2da6a5968d7b648d3f7360092a","sha1":"32ae5713edeb00288a3f8f3c02462a5d0ca9dbb3","sha256":"8896d194e4c39e87f52924073dd2d56b4aaab46fc9f7c56a57534545eef1d7f3","sha512":"01f9b63cd24ab6e0e097637341b78cda657192f98e37a39f0f75548f8fe0180418a86594df76858aee7d514282ac4dfb8263e1729ff325035897b841d09206a3","ssdeep":"","tlshash":"82f0a00e0ee548131963707a4c0f9201203b2513414eea08bffe9bb24f92a688a679cc","size":550,"data":"","first_seen":"2025-03-03T20:54:16.018132Z","last_seen":"2026-06-23T09:11:58.931662Z","times_seen":3033,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/index-399e2569.1756903329400.c784c4ca.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"6117cdb5accd41ccb0125c70452306f1","sha1":"80f85cd8a495c476087fa382198b2a06f5d309ae","sha256":"794e522144c7d6885ba07f4654bbf62f0b06f1b985a897645092cdf029afcfea","sha512":"1737016527bd862c7804e4dd164e109c7f3a087b5c0a751764c22f8b2fa9a10f4fddb8f98234d4da33eaf7a314648d28eed89c0750dabf2006ee105b6f8a2cc8","ssdeep":"384:EZSANHLDaxKalO7PT/Wy4QfHhwrxrjgIhK47ZyQQvXTcdw5F3oWf0Af/nqxtU8X:HYDaxKUO7LZ4QvhwVEMKUZpe5FYxAfPQ","tlshash":"c6b2c6e63392bda4c24f9276f33a58ecc53f9241c30fc4f8d265bdd47da8644a992684","size":23421,"data":"","first_seen":"2025-09-04T00:49:32.717031Z","last_seen":"2025-12-29T13:58:58.089613Z","times_seen":434,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"2558541837b83dea0f1c8ac757de88d1","sha1":"73dc5d3a5d36b0d2f64662712b98ed67d38fa7eb","sha256":"c39e91ac138a222cb7b8c2cdd75880822c57543218803e85847fbc402cd58aef","sha512":"6bc2837169d8c2a6fc06110969305fa31b87bbc31cc683d0e95ab2eec28606e623d1e07114f031e73419231c41bee11bd93dc8673f5b548a711aa28921fd9177","ssdeep":"192:KQFwqx5Cvtib5XOQRzlaECoXZTAoV51nsPhwzvBa/id3+36a/E/97g6I52MdobsN:K2VwiYwJvSoVXsp+pa/iZcVk97g6nMu6","tlshash":"1c322a69a6b71bba24673036277f301889b080630319fd957c0ff61e4fe54256297be3","size":11820,"data":"","first_seen":"2025-07-24T23:59:52.586926Z","last_seen":"2025-12-29T13:58:58.105973Z","times_seen":599,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/index-a3dad144.1756903329400.268893b8.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e70d98f5d06556fb2df3ec9ecd519e37","sha1":"f15f33973e2498e949a62791b8fa6c7ff03c7a98","sha256":"7c6448354a71dab7081c1a9083e1ef15f7c59ff568fb924930620b4758169df2","sha512":"d225d0cca1709f789e457dd14df16ceda4bf4118d6c8f9db25bb9cbd5f30151e6b23d497ba51761a0eba97686323b0393dcfe43652e832dbaecc97b69bccf802","ssdeep":"6144:G4InKyBbhFOuyKO0VPoJBR58n3inyHpZolRlY1z9f7ZwTl0A+:izc90VPoJBR58n3inyHpH1z9ftM+","tlshash":"d7743b94f76cf1bd874e55be793290a4902c1b41b0c89d58d29e2944ff6b385eeb08bc","size":348653,"data":"","first_seen":"2025-09-04T00:49:32.964012Z","last_seen":"2025-12-29T13:58:57.98751Z","times_seen":435,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/65246.1756903329400.c090be2c.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"9695de283c01f0fadf4795c612b010e2","sha1":"9e9b20c41d8eac731f465f87713f570eee532180","sha256":"82d3d78a522caa25376deb145964490b699e6d2c976ae6cdad15f2c4e57cfc7e","sha512":"5f583070eebf753cebbbad1720360c270ec09391ef530c0efb982a92e03b1a10689136cbb74c005fa386f20111b32a602557c0fdf5e2d716062da09d942e2f6e","ssdeep":"1536:r2+iDvYvNjx4Uyao0L8oDNzAuMMsTAQ0mqt2pXYzA4dANV1:i+iDYvPo0L8oZzAuMMsTA7mqt9zA4dA1","tlshash":"c773a501f78272384fa7e290220f2026e16d191505ac5bd8f179ffb93ef4954aa7d7b4","size":73516,"data":"","first_seen":"2025-09-04T00:49:32.778143Z","last_seen":"2025-12-29T13:58:58.019409Z","times_seen":420,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/chunk-init.1756903329400.f53cb96a.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"daffbf99400a4f119f452d48a10ea62a","sha1":"0ae2d45d2befd0f11ae9373195c409f491a511d9","sha256":"1dcfbbb596d333e200aa1b0e4e282c296f29bfafdee19ff4014fad30a394ae45","sha512":"8e39ce35d7f18deb579cf03330a935e18308541617b1a265e4d7f88480b4d29608598e6d2be86328106fa64c4d707e608f333319bd1e7627df53a0170de079fa","ssdeep":"3072:etwqhOIKENB85doKa/x5wc0dB5/J+UUknCqdnr4QMA/C:HENm5ox2Br+2nCjXz","tlshash":"ea441b98b3d171b846cb53e5622b1035f6ba1ca33098e4f0d219ea547f3168dd52eeec","size":273064,"data":"","first_seen":"2025-09-04T00:49:32.986263Z","last_seen":"2025-12-29T13:58:58.044472Z","times_seen":443,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"37cda9c8bd90ed9eff421ef541ce8c9b","sha1":"10e30e7f37c9d3f9047b454674e5bbd39325c17f","sha256":"141be120131ffc192dd677c685472431beaa361d4dd03539f79d814cf1434cbd","sha512":"02044fab2c82a7e34f9c9cd65fec0c8f4dda3b52170d846bb908d40cbc34d719d33b1586be421dbdaf4085c442760a8f1f0db93a5e0a9d3ae7d38d5b8072d106","ssdeep":"","tlshash":"fa11cc5a59e28132aa5b302735bd43887728a023d144cf423dcca955bfa8da5cabf6c4","size":923,"data":"","first_seen":"2025-07-08T00:41:53.041569Z","last_seen":"2025-12-29T13:58:58.107019Z","times_seen":628,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/configPage.js?v=9/3/2025,%2020:46:11","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e6aa74bb352ef198ba3e1c9a4b01b014","sha1":"2ea8bd6b5045475a36432f7665a129728e822d9e","sha256":"73828e873c0b6e847b37d78941ca436247471dfc90a12f743964f869f75abd5c","sha512":"2faaf24fdf1e4da637af8e9f82d1778bf061b00752dfca0c8f73432ba236a7b69410a7ad2a73727bc83e6cd631fd6555c3cc0d9d3a5d8a7f81818dd66566011f","ssdeep":"","tlshash":"be117aaf57444dffcf1d7e00a08b0a5ea8bc61d261889d4da8e9cf29e1c99002378978","size":949,"data":"","first_seen":"2025-09-04T00:49:32.949926Z","last_seen":"2026-08-15T19:18:34.487984Z","times_seen":2888,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-16T02:03:09.849193Z","times_seen":744138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/home","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-16T01:31:51.372Z","times_seen":92052,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-16T00:25:50.625989Z","times_seen":237799,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/45734.1756903329400.46beea1c.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e5f34b5441b6b582d6d469c537f6f97a","sha1":"defd5aad4e0d066131c97173b21b7b3442cdb951","sha256":"44db08eec9e6d649f62d7d208bce223e33424ebc58c21098181a90ae5a1c6437","sha512":"4096ae8bc07709597c8411157950bea75aba46cee36964fe1e280a31a2c2c9d4a8d5821c3e8a4cca552919511930bc9f834e2054580c452acc17c1011d1e6168","ssdeep":"6144:F/EFTU8Ra90Jjytg7DiQPkcsz1h84faSDWidmVHrqZL:9y/jytgPJP484fa5VHryL","tlshash":"2a441c84b291f0b4879b42f7922b4055a17f48a130ccacb4e2a5ed90be7555c927fbfc","size":277026,"data":"","first_seen":"2025-09-04T00:49:32.926111Z","last_seen":"2025-12-29T13:58:58.062377Z","times_seen":438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"y108p.xyz/js/21954.1756903329400.57c97863.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:27.360Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/21954.1756903329400.57c97863.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:27 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-a3f0\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725547=ZeBRC80LTJHPPI7+oQOCUenUy6TYZ+KmFrw1JR0Iyyn8PAFS0kApFMnQKAyo59yPniskPq2Lp+EsfxmzuOlqtRplgWv8rGdhxZn46bK9M3+DE3/dryCYhCjyAiWHjoVeSJa831Y7QVBSZDFuG3DPWuN+XIeSJ0XS1R/EL72IF40w40mrTtjwo5ru860rvzzS\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: E2C0E8E1-AEC2-4CEC-9F07-D5617D462DEF\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41968,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (41968), with no line terminators","md5":"e2c9f0777c63b333fc66af020ed0ef8e","sha1":"72714b7bdf899cc87c7399253e37aaa2a2f4487e","sha256":"0a2a1939d88947975b56974be20cb84a9c00f3c94cae6e057836b39aaf6b8c41","sha512":"fc02eb76f16f16c8a7346f72e7ac7ef4a68bca53cc7a5bb9f1e00b43f1bb002ca7847e2804be7d6bfe0713c3466210038acc4d5794bea5bec8f0190135f3e7e0","ssdeep":"768:DBPsaSfmzKrMdvf0eMQ/96loumY1PI1yBK9LudEz+yUy51y9y0yk6Dio+ILqpTeY:DP81R6Ipyk6o","tlshash":"0a132088fac2b06dd3eb7330857f505ae66a1dc0668c5438e260d6917e7198dc1fb9f8","first_seen":"2025-09-04T00:49:32.704767Z","last_seen":"2025-12-29T13:58:58.045079Z","times_seen":433,"resource_available":true,"data":null}},"time_used":615,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":614,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/css/home.1756903329400.edf3cc73.css","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:27.398Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /css/home.1756903329400.edf3cc73.css HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:27 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-13930\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725547=ZeBRC80LTJHPPI7+oQOCUenUy6TYZ+KmFrw1JR0Iyyn8PAFS0kApFMnQKAyo59yPniskPq2Lp+EsfxmzuOlqtRplgWv8rGdhxZn46bK9M3+DE3/dryCYhCjyAiWHjoVeSJa831Y7QVBSZDFuG3DPWuN+XIeSJ0XS1R/EL72IF40w40mrTtjwo5ru860rvzzS\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: B20DF196-B58D-4C3E-9C84-146CC40BC1BC\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":80176,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65528), with no line terminators","md5":"2e29065a1a5515643e2fd444bf8a6276","sha1":"fca2b112876cca0762e522356083c0b8649f0520","sha256":"f77a87b9e81ebb2473ae09a9dcbb13e383ca95151a71a6aa85bfa51d6223f6ed","sha512":"0549da8eb6c9e2dbe1f6ec23b197491230176fb5952835cbed1e0650f680db8333bd65e3b4b026804c94d48229b8c6974427978bf83c88cac162db9511ead377","ssdeep":"1536:yzOcRM7jufawS2d3a8WiLKbzGhbKpXdNCg9khb+TJ/:PtuSJwLUK0Eg9khb+N/","tlshash":"25732b7aa610253db437da72b9f05bd8b524c846d7634a3df2537a25cbc72e213323a4","first_seen":"2025-09-04T00:49:32.974291Z","last_seen":"2025-12-29T13:58:58.075129Z","times_seen":426,"resource_available":false,"data":null}},"time_used":498,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":497,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/kc523-1/sponsor/sponsor_web_3.png?1756903280095","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_3.png?1756903280095 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 40879\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-9faf\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725549=/hVpQNHfLaAcoXjZCNTD3ZDnYR8cYfq+YoSlktnj8vjV4yYEoNmYY0sKl65CWk9dh56Dl85PFjG7mrhMoZDvByy/GLY83hGvAKTjFaBL1ZoH+ejqwiyveU9JUw8qyMDteBKPL4KYudk6vsBAmQXX3V32d2e2abScXG4NnkM2M65b7NYaok48/b3a97O06i5p\r\nAge: 1109460\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: EE4CE5FD-5C6B-40DD-8251-D091D3A5E190\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40879,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"c26161f438986f6e2d677c34d653285e","sha1":"faf6c47a013a9944bb8cac197688908422992039","sha256":"58d11e173550b3420b35c4e4be3eeb76b59ac790d9fb59b535ffe55d3b470fa9","sha512":"97649de556447ef6aa6cdd7d0bec46837cfb328335daa3b862cbaa5e23ca5a8f2af296703c9e961cbad02bb797ebf1f99ced2d1d245fbbb3a428e39d26428c76","ssdeep":"768:ub+4OMIuYE3McXMuDR64Q7sRFKJdsCA1Hunj5tyKxGGTVtkDGlT2oTO:uS4OMXYODNDR6XsRFisCAk39t6oi","tlshash":"db03f108254f2d4466ec90bbc7a1e0f7ee1d103dddb7e30c35a685163e46ca559fa0e6","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-14T18:21:23.299015Z","times_seen":2348,"resource_available":false,"data":null}},"time_used":1479,"timings":{"blocked":898,"dns":0,"connect":0,"send":0,"wait":291,"receive":290,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/ecb/8f8306425cb6740e78b2802ff5047afa96a8ae096bee393c421cac4924db741c4a080b3f3ed2f2822673f3118bd3bae081df46a59bfce8","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:29.006Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /ecb/8f8306425cb6740e78b2802ff5047afa96a8ae096bee393c421cac4924db741c4a080b3f3ed2f2822673f3118bd3bae081df46a59bfce8 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://y108p.xyz\r\nXign: m/vU1QwM/NQnQHPDTn2RYi3fxqgY1VlTdAnt9TzNK2MzYGoJ0+5ZzQ5OByuLSkccO9lNdm+jv3J1TsGSFSDb+zlcft1fkLDS1+3rhZHuWxvVBzZvkpL3s5FlP6y5JzBcXlCaqfS6roBxzsZX2xy/R9uZsbToy5oRrwecDPZiCH8=\r\ntimestamp: 1764725548983\r\nsign: 06k3l481i3s1r2hl\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: rEfAYkDGbEEF5yTzpkNZQfYMBdt5bAF3\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:30 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Wed, 03 Dec 2025 01:35:30 GMT\r\nCache-Control: public, max-age=180, s-maxage=180, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725550=EnwJxt5GEWZDoy2zM7O5VXjcyuKd9QeUQschlibf8N338Aywly3eO288QFLQVHJlDyo0pDjxpxgKkpZBHYec+tXMDURhFCbrUPeFgavax+z0IHuK0xhcuNPttVS5GyOXCrGmvQfb7udRo95bcQln5pJocaMrGFQivBnHGp5AthjDtr2jbX9R+GmiXuhzQg6n\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 898680BB-BAC3-4CFE-BC19-1809CA910C99\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":60,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"aa1fe36cc499baa3fbdc7ab9bda7432f","sha1":"201b0fc1c4c699f3538c8e3992ec08ecd2f3acb3","sha256":"d509d9e26b3c3a371856286d14bcdd4f17125a10d8ee40e119fdecaf964fb478","sha512":"2dff3b34740cc9d3690f596673675516493472f5ad4bbd3536b5b1b18922543771be73e01051874bc7039aef9461cedb841f0cbe4945118bdea5773a4b3f7a55","ssdeep":"","tlshash":"03b012a2d5a309ed9644713104305c414be022ccc9bcf858c7bc4d2b45650210494105","first_seen":"2025-08-09T20:01:46.169117Z","last_seen":"2026-08-02T09:02:15.066072Z","times_seen":1564,"resource_available":false,"data":null}},"time_used":1441,"timings":{"blocked":995,"dns":0,"connect":0,"send":0,"wait":445,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/bb495c4e4f7349f4b102c4258d0fa991?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.434Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/bb495c4e4f7349f4b102c4258d0fa991?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 4946\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 5886\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"bb495c4e4f7349f4b102c4258d0fa991\"; filename*=utf-8''bb495c4e4f7349f4b102c4258d0fa991\r\ncontent-md5: usBKGTOk438rEEx6rdUrJQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FoaZYrGJPbr2fEaBNfGA0Zi6hPSy\"\r\nlast-modified: Wed, 26 Nov 2025 20:07:45 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: cF7wRagVI\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: ATsAAADlRIAvi30Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":4946,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"bac04a1933a4e37f2b104c7aadd52b25","sha1":"869962b1893dbaf67c468135f180d198ba84f4b2","sha256":"1ed711dd0c6f665c5d8f2981ed07d05b7f3b98c0b820024ea9b3379c79846ed8","sha512":"b032f23bf9d4d1b619014dd3585f365282920001a86388d812854eea7157ffaf9b1809d88259c5b16edd260f6d9d169bdff37e0921e556a5c672b89bd2e03ea5","ssdeep":"96:oGq3nootyGwMTxQLBAFUZQN71jtBi0XiWmlcWEp/uhv4ur4K:oGq3noJGwmBi0Xi1cPI4c","tlshash":"d0a17fa067f1e43c3d970bdccb77932ab5162119002857fea0277c1714e4386ea65397","first_seen":"2025-04-19T22:34:55.323122Z","last_seen":"2026-07-22T00:13:26.823387Z","times_seen":29,"resource_available":false,"data":null}},"time_used":3670,"timings":{"blocked":1123,"dns":559,"connect":248,"send":0,"wait":1297,"receive":133,"ssl":307},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/94b45b50f6254cef8cf4c457ace4e425?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.497Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/94b45b50f6254cef8cf4c457ace4e425?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 90571\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 27130\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"94b45b50f6254cef8cf4c457ace4e425\"; filename*=utf-8''94b45b50f6254cef8cf4c457ace4e425\r\ncontent-md5: R7ov5cqjdwz6LpncS35yzQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Ftu7VDafAZLzrWUQgMaIw_uJ1-CL\"\r\nlast-modified: Thu, 27 Nov 2025 20:08:09 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: 1nY1RrNjM\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: SF0AAABer1fdd30Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":90571,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"47ba2fe5caa3770cfa2e99dc4b7e72cd","sha1":"dbbb54369f0192f3ad651080c688c3fb89d7e08b","sha256":"e6aaafd14a190bdf9fd0b145865c3cfd90fcdf997bed53a492f8ed2c01083b17","sha512":"5337e4f027d7a770f6f440eac70a6da77e7eaec4743451d52c8d526a3421a33fffdcc9dd163dea846dfdfb097572b6c646e620e782926fa73e7a335b375bad42","ssdeep":"1536:0Z1AEq2OsVMxufd25eukFKBDjyrc+q5Xqyz/4dBNzdRHNLuRh1b0GXuClbKtJHEy:0ZK9jGabEcDjyrcNsyIBpNLu51+QKtJx","tlshash":"fe931281010996753ebdcea6c747a4a738c9aa4b4095140f1dfec9307abffdc4984f61","first_seen":"2024-12-26T20:26:09.846026Z","last_seen":"2026-07-28T17:41:01.577266Z","times_seen":190,"resource_available":false,"data":null}},"time_used":2829,"timings":{"blocked":1045,"dns":0,"connect":0,"send":0,"wait":1286,"receive":498,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/kc523-1/sponsor/sponsor.json?1756903280095","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.116Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor.json?1756903280095 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:28 GMT\r\nContent-Type: application/json\r\nContent-Length: 646\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-286\"\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764725548=wdtO4M5R3pyBXDSDlSB9FD5ieOJLpGjZdfC4za9oCAyN1n8vLsGZ+z8auR/Dh4ykS+PCyBfoKyAMuN0NuIOnM6NbqsNDb1di2mTV1gji9F+K2Iou2dNtgjOROSr+yzTqg8c7tnLTv6/yv2kgFzbOjVLWKxGxOEpbx/MH0+yEv5fPjuQbFYc97dxvwU8Cbcw6\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 8939B2C7-DDED-4F15-ABBD-EE23051E2DD7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":646,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"10d2161de8cf99c474812f4c43645a26","sha1":"71884ef7281cdcb5084088f16d4550ce8790e634","sha256":"bb02fd7438bb49dd4decb6f76a71f11e93355332fd9f965d6f9f13bb8175aeca","sha512":"bf0fd1232309fcc5582d5c42644e1c7b4b8d235b1066e988ff55e0dd94a956f89742401f00c2d904359041c8e0c2bac8e9316252fab60db5eb0a3b4c935172f0","ssdeep":"","tlshash":"d8f0f44ad8b25b93211fb57c58cd050470294a8f0eccaac4baac987c4f598ddd1e839e","first_seen":"2023-06-16T04:51:50Z","last_seen":"2026-08-15T19:18:34.464911Z","times_seen":2855,"resource_available":false,"data":null}},"time_used":456,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":456,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/pay.8f35ebe1.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.167Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/pay.8f35ebe1.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:33 GMT\r\nContent-Type: image/png\r\nContent-Length: 5453\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-154d\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725553=FS6tYjKh1M+gSmmjCJc7Z5ItrAI5uLtwq1ey+8G7hLKPEt2q0r/meEfJ/8cV8j9e63TaT2ebLNzsT2vLgNVjhogT5H32RN5gJMZnna7ohuq71psenX2MCWWvVWWDwpqniEmr0zYChgtCACgnZEUzjgk1DDYgAenPeOBM1Y+Fa3resLtB1I3RbJPLpvzCgg7d\r\nAge: 1109458\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 835F6CBD-470A-4C0A-9C92-017DDC918240\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5453,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 492 x 132, 4-bit colormap, non-interlaced","md5":"05d444b76263f6958a37ac82e45daa67","sha1":"a067d3a654da1ec4c51d8f049aabaa112183e355","sha256":"49166910b376f5487f30174e60fcf13aaaca9620ef1aa58cfb2c94a8c111ea8d","sha512":"7d276d57b068ec4a0125512e0781c501a96bf6c30b30304d247251190c6421a9ed7a03ec208a590d19d9a1183e3837b06d141bddd99abb7b0ee4e2a1ba28b28b","ssdeep":"96:u9g9Yof8+keuD1Kai/MXG5BHMsDiCNPFH/qX4iWXnqvcIzDRHSVyl07TrOKCm0R4:u9g9rJuYai//7FiSXnqvNYGmrOKcPwzp","tlshash":"74b18e749d6efb2a26b315c30d7499c21ea45c9e0d94f1c2244776963c732de3270985","first_seen":"2025-08-29T11:05:53.301829Z","last_seen":"2026-08-15T19:18:34.445928Z","times_seen":2457,"resource_available":false,"data":null}},"time_used":5406,"timings":{"blocked":5100,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/ESPORT.4f4b51d4.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.110Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/ESPORT.4f4b51d4.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 65968\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-101b0\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725551=Tl57i2AA5msYKmQD6D9b96oj05vzNG1l1CRjWQNFDIl0/XOB91wmnNIuwbzcvYLLX/+8PfesGrw5GUIZPSgoLImPW3qb6JVtL/D3VFmUZJ2JOKFTQEmo6Emj7kqSzJVgZ3YR6VcZAjkG+nzNcBKE087eIDc4XsCyYhU4Om61Apb3ZxYss03gNL9y0YZ3YnNG\r\nAge: 1109445\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: E38A844B-62CA-4DE3-B5C3-360BABC374A7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65968,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"29610094acb703084f79c42c17547a7c","sha1":"3c824ba387e36bcce1a5f1d0d14b513fb278db9d","sha256":"8c3dc9ee49224eff4a37ec488ff0a413f3150ec7a62640a466a802750a573146","sha512":"db986acc62bb0d35583a1c298b468e1fa7869269c738eadc82b944b1a8f9b2c0723087db8a065d60495938e834337e72e3c438089d1d02ff90f4983e0d6461fb","ssdeep":"1536:ObUUUNbT8bJcHe4DyC8KLT/KKeRfm4AH7XAlzS7M2Z:rbgNcHwE/eshbE/2Z","tlshash":"b25302e1df60cb022efe65ca89acf12ae204a0a61476453f7a231d6f3744016af973c4","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-14T18:21:23.236117Z","times_seen":2366,"resource_available":false,"data":null}},"time_used":1939,"timings":{"blocked":1325,"dns":0,"connect":0,"send":0,"wait":307,"receive":307,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/abf3d220395744918a3f017c782ef34e?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.557Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/abf3d220395744918a3f017c782ef34e?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 6900\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 3722\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"abf3d220395744918a3f017c782ef34e\"; filename*=utf-8''abf3d220395744918a3f017c782ef34e\r\ncontent-md5: 8L4tkhVwaue4Im/ZOyXwkw==\r\ncontent-transfer-encoding: binary\r\netag: \"FvbRs1XCprVjMNQmY_Ud3gxiYhW7\"\r\nlast-modified: Thu, 27 Nov 2025 20:11:10 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: uDyIa0bRT\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: ceMAAACpj1knjX0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":6900,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 84 x 97, 8-bit/color RGBA, non-interlaced","md5":"f0be2d9215706ae7b8226fd93b25f093","sha1":"f6d1b355c2a6b56330d42663f51dde0c626215bb","sha256":"be614921600d694cb821847f174986b3416fc494a1ba35f5781fa7833e9525ab","sha512":"6231ae180811457d5eb6f5f1f44e4f49ad1d380fd49918836e7ff30f174ca1136d7839905d821e01d9b91c73db00229f56c47c2a6aeac9a2ebefcf99071f4e5f","ssdeep":"96:Yx1us78Jt8UAf+KoqCJNcb7MP/AVEijzIqUt0Rel5/FchbgOvmkQLhZOXqr90uQQ:KIJt8UAf+KHCDEQXesXmbgUmOy9ZQ2j","tlshash":"eae1ae344df66dfaca601ec63183438dd3f9a1c3a02230bb7ac65327bd20b210c89c95","first_seen":"2025-03-16T19:56:39.558569Z","last_seen":"2026-08-09T22:07:19.633355Z","times_seen":247,"resource_available":false,"data":null}},"time_used":2648,"timings":{"blocked":988,"dns":0,"connect":0,"send":0,"wait":1307,"receive":353,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/3ce652c0-55c8-48f5-a72d-a300accd6573.jpg","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:32.369Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/3ce652c0-55c8-48f5-a72d-a300accd6573.jpg HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:34 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2%2FuoQ2a%2BREs%2FhpspcO9fCrruI8u38jxz%2F%2B61yFxfrrEGLb8wErCGwvkr%2BWJerLHdiz7uG3fVZSfHAWpB4AMUFBK1rWZ7uucECqJRBaGqKhy%2BmjeRz1WTHQNA0pBv\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"87d1015ff2e14a1f6f7b2b57571ca887\"\r\nLast-Modified: Tue, 26 Aug 2025 07:00:51 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 9539\r\ncf-cache-status: HIT\r\nCF-RAY: 9a7f4f999a8d07a9-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725554=9tILU5qlmfKwryxioowcE+FLXcwgmpYyFhaH7HXP07KNzQUcHECW0Mz2zbfqluseaatlMoYan5rIo0uSjiQuscGqKxMlLZDD2UE2MiPCskAPBjr0nABeZ7TfUQCz6gsoD7VTyiGOgjv1f1cRAwukP348YK+0Xd5CGVhKiy6WIT/Qd5yWJV7V9zTShTPM7A+G\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: BA1E8B0F-8776-4F08-B6ED-357F71DE8CBC\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73462,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 1280x294, components 3","md5":"87d1015ff2e14a1f6f7b2b57571ca887","sha1":"630c6eb19b1145667fe91baf84895decf0d0d345","sha256":"139b3629229801138f790ec1592df247b8ea52b64260f0303c0a1a0931578de4","sha512":"7ac7fc84e76e24ca7fc132734f1a16b3bfd476bb9234a73673d104b28c1ea1637ad53f68958bcfd59a4f6d7358595d66e9f0e569c084fbd5d98ef37a2c539072","ssdeep":"1536:TNU9iSoOFwtZ7MTOwbD5vjre3CDYP9B7/+wbU5yMNg7Rlbpecj:hU9vm77MTOwP57mCDY1cwQslocj","tlshash":"367302ca87e1f2c32e756ce211751dad416066763fbef6262ceaacb187604d54a04327","first_seen":"2025-08-29T11:05:53.280437Z","last_seen":"2025-12-29T13:58:57.995004Z","times_seen":359,"resource_available":false,"data":null}},"time_used":2068,"timings":{"blocked":1511,"dns":0,"connect":0,"send":0,"wait":493,"receive":64,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_b1b5acd8-3851-4b06-8e10-d549f7f09d1b.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.951Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_b1b5acd8-3851-4b06-8e10-d549f7f09d1b.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:38 GMT\r\nContent-Type: image/png\r\nContent-Length: 24809\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zfA1Lje8gYTEZql9ryTVvTwwc33viT8G8ErX2fdffsqAzuB82VG9ID3TLucKH7ilsIpY61MWJQHySykpIK6n2K7Dewlqo16fJLeMx6N6baQiSA5PhW6Y6rBl%2FzoQ\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"2b3edde7d1ee1537bcd21108631e215c\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:40 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109439\r\ncf-cache-status: HIT\r\nCF-RAY: 9a1581c7eeda04cd-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725558=CqU/qJIsoXMX7Gvi171YHqR2CQBtd5s+x9S73uNZlw2A3tlbc9+spA/CvW4Gm6DHJ1dMf2zTE8k58Rhrl70ihx3AV1eZaITtST6ZQhVQZ3ghB6qZz+vzHVTtt0vWUxKAvALFWrFGl0r/jxJMUvTXlSY9LSeq7ejV6cKXEUguF279zmB10apsNqAYt5NztE7E\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 9F6EE71D-588F-4AD9-A3C0-449B1C9996EE\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24809,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"2b3edde7d1ee1537bcd21108631e215c","sha1":"508e10bba0af8a922c6b1dc55839f2b4e590bfe4","sha256":"a1dc3fc36a388e88c88e99bb41f92d5788ab004390b06623899ef890cd1937c9","sha512":"972baf5313b036ed8e4c8a948873700a01f7d811488c26a36d85fc084bb20046c2f801dbe96f92b1136c864599bdfa0fc78026e124273e6ca30c31e7d1733034","ssdeep":"768:ZihR2n5VYKYE3FXL9jWZCKlXw224GKbQZuBw:ZEnKYkjWZtF6K5Bw","tlshash":"f4b2f1796b7f0d31e24a4ef3a350b9c36b67986bcecd2996e001a5c00ab3d3e414d083","first_seen":"2025-08-29T11:05:53.246096Z","last_seen":"2025-12-29T13:58:58.059579Z","times_seen":294,"resource_available":false,"data":null}},"time_used":4584,"timings":{"blocked":4272,"dns":0,"connect":0,"send":0,"wait":311,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_1d28b817-0c00-4339-b666-213943a7b1d3.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.958Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_1d28b817-0c00-4339-b666-213943a7b1d3.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:38 GMT\r\nContent-Type: image/png\r\nContent-Length: 169448\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3CcHNPlcdQ3v1sLLyIFEJCJNY7b%2FmHu2MvPnpbUMhgyqXZmry1WSAyMxRYExmSU8iXrjTQKftvjefHrgbixfToR0sdl4yE6qrzKK1qTnbrIVsH9M3QRfNB41HvVp\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"8bdfc70c7f82ce44daf0fa05ad3eeaa4\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:08 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109448\r\ncf-cache-status: HIT\r\nCF-RAY: 9a15819048e004c4-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725558=CqU/qJIsoXMX7Gvi171YHqR2CQBtd5s+x9S73uNZlw2A3tlbc9+spA/CvW4Gm6DHJ1dMf2zTE8k58Rhrl70ihx3AV1eZaITtST6ZQhVQZ3ghB6qZz+vzHVTtt0vWUxKAvALFWrFGl0r/jxJMUvTXlSY9LSeq7ejV6cKXEUguF279zmB10apsNqAYt5NztE7E\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: C730A529-0628-4C76-920D-E5F25136B8F9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":169448,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"8bdfc70c7f82ce44daf0fa05ad3eeaa4","sha1":"28324ebfd2786e353a9d8fcaccc4f0ac799d7298","sha256":"4a6a0f4743ce7322265461bcf5513b75300ee02a0e0fa99c6ed52504257ab386","sha512":"c42e0688880255c76f533517731cf5e26c7804903f62d67dd3bde71534051930144edd77cf3cd25bac6c7b5ccca482a824f3e949b75d7e1ef933673b39bfa9eb","ssdeep":"3072:vWQAl+XOeoZ6HUR1uhhITVjmrDOukWh0CX6zcAds080pWiCOM2aWLS:OYOeoZTR8UTutkVCX6zddVzMFWO","tlshash":"73f312c591b38ed687632d78cb44a2860133ef127968d9ed412c84bdc9ed2127cf48fa","first_seen":"2025-08-29T11:05:53.114202Z","last_seen":"2025-12-29T13:58:57.992421Z","times_seen":294,"resource_available":false,"data":null}},"time_used":5953,"timings":{"blocked":4788,"dns":0,"connect":0,"send":0,"wait":292,"receive":873,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_465faf5d-2f6d-44ba-896b-8d6bffead8bd.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.972Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_465faf5d-2f6d-44ba-896b-8d6bffead8bd.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:39 GMT\r\nContent-Type: image/png\r\nContent-Length: 69399\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1J7rVLrEyui1bDiYjnealDUzhvfaZKE1Cc%2FRD5muey%2F%2ByvAZmtB2Yt5bu1LRlkwAfX0XBqnfJ6S6yT6gT6bRhSsUcD4pzexr7%2FumPugLIJy1YDmTJ2NpCcmT88ty\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"ba923e968e806ec3cc5e0ca4f15b6754\"\r\nLast-Modified: Mon, 08 Sep 2025 20:50:58 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109441\r\ncf-cache-status: HIT\r\nCF-RAY: 9a1581c4093e0952-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725559=cskfHawHGVxhGeXXtbZRur3v20bZg50TtEUYGl4CB3C2tLar2sd3hOaapB8duFFbayAPc/WKHjrnWYjhmntPkR89gmB2hPvJg7C+Ys/l49+TrCan2VyPmluK6mFY2NTBpy4qDTfI53ZS4vX72F7xV7pl/xWHuH+W7Jtxy/IML4gnutunucRYTNGKiRUz1AJp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: BBC39102-56F2-44EF-A555-FC8087110706\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":69399,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"ba923e968e806ec3cc5e0ca4f15b6754","sha1":"6781e3cbf0cad47c0b41a379dd13754885427315","sha256":"191dda4470e82101bad4bd8363aee40e44c864056a114f213b56992d0ce6b744","sha512":"03d50e9e07273a54a7e264b8d66ff08c569f0eaab85fb9a87f90ff6b85cc421107dff11e8f5faf59051f9df26d22c8abe380aec5ea0960756dc392faafee9d8e","ssdeep":"1536:XUBrKrVeCYIB7URpEFD7UjVAP5mq68QB8siQSwFoySA5mjCTDz:w6VLQo0xXl/JwwFoyrEePz","tlshash":"79630255364b0a6eedcf6115da6378213889b3a9ecd8a5f429bc0d4206c2dc297f7326","first_seen":"2025-08-29T11:05:53.275096Z","last_seen":"2025-12-29T08:12:31.374845Z","times_seen":292,"resource_available":false,"data":null}},"time_used":5829,"timings":{"blocked":5515,"dns":0,"connect":0,"send":0,"wait":311,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/appdown.6e7c9177.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.164Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/appdown.6e7c9177.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://y108p.xyz/css/index-399e2569.1756903329400.f2d3fd45.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 10111\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-277f\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725551=Tl57i2AA5msYKmQD6D9b96oj05vzNG1l1CRjWQNFDIl0/XOB91wmnNIuwbzcvYLLX/+8PfesGrw5GUIZPSgoLImPW3qb6JVtL/D3VFmUZJ2JOKFTQEmo6Emj7kqSzJVgZ3YR6VcZAjkG+nzNcBKE087eIDc4XsCyYhU4Om61Apb3ZxYss03gNL9y0YZ3YnNG\r\nAge: 1109460\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 9C7FBC9C-D55A-46C0-BAE1-D8252E892501\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10111,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"716d097b193628397635cfac41b561fa","sha1":"545d1876219bed15fe850a499a08322de6a26866","sha256":"50276d87fae9c1e30a32c32b4e90dcc2e227cabb4e3bb1d60ecb22fb50c5f2ff","sha512":"47ea5928e921bec4ce4d9c807ee921f6115a6dd27af6fa7325e6d988058d22cf36c03693ebc56665203809cfd6d008cd410380e688e90b36d7eeec18ce6aa92f","ssdeep":"192:cALsiDRih/bWKl4Hq2BHZE6+3paMeCsuTvB6hi6tswYmd:lBEv2Hq2BHS1ZaMJtB+tsud","tlshash":"4622d047a584327b826ec79c8fe98c112470ad1ce6f04d5ac44e711128e8df3503baf2","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-08-15T19:18:34.439711Z","times_seen":2570,"resource_available":false,"data":null}},"time_used":3262,"timings":{"blocked":2955,"dns":0,"connect":0,"send":0,"wait":306,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/13f4530b1e064535b9606f611320b701?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.503Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/13f4530b1e064535b9606f611320b701?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 50848\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 21722\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"13f4530b1e064535b9606f611320b701\"; filename*=utf-8''13f4530b1e064535b9606f611320b701\r\ncontent-md5: V1mTLKJRLGcB2G371YOApw==\r\ncontent-transfer-encoding: binary\r\netag: \"FpZX0a6I0803O1Myx1M3RKCXIOzR\"\r\nlast-modified: Thu, 27 Nov 2025 20:08:28 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: rN0mPofis\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: j2wAAAB-eHHIfH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":50848,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"5759932ca2512c6701d86dfbd58380a7","sha1":"9657d1ae88d3cd373b5332c7533744a09720ecd1","sha256":"d579be522e09c45738b602c467dcba4b7a56b9031a9fac481063c155e0539abf","sha512":"0a75664e49aa87da6e864efed8761e8f05af7d27e69929e8cc994505279ea942bcb91cda768f165c60e2c0ca0f6725a33de1ef822c446ffbed819c031a23ca24","ssdeep":"1536:UPHs8ijoHKQvvgKTlalfCmcWUrFCRBtdMd5:sHs8iM2jwr8BdMd5","tlshash":"bf33f183de15f99e99b4c7a0d277dc46177a6099763d00b0b78a81fbb18e0229e7b4c1","first_seen":"2025-04-01T11:41:17.725Z","last_seen":"2026-08-14T18:21:23.213017Z","times_seen":287,"resource_available":false,"data":null}},"time_used":2766,"timings":{"blocked":1040,"dns":0,"connect":0,"send":0,"wait":1287,"receive":439,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_b0506ddf-52e0-4b2d-8f59-16f795505312.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.937Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_b0506ddf-52e0-4b2d-8f59-16f795505312.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:37 GMT\r\nContent-Type: image/png\r\nContent-Length: 473762\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ATNX5MJWVpUDLJAmS98BeN0NlU5zvP61iPuB7OYFxJdwqqpPkAhelGPIpYK%2FRZ6DH1w2DiVfCPUDRNf4MdhgqnL%2B6iO%2FO4GBe6fIPM9RSe0qZ3Mh50mckHvdvsvL\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"cc5f88340212cac674500954aead1456\"\r\nLast-Modified: Mon, 08 Sep 2025 20:42:18 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1115061\r\ncf-cache-status: HIT\r\nCF-RAY: 9a14f8809b0f0982-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725557=scDVPKsbbAvx99LhIgALuOPSdX6xYY3HutBVudy+Q6HpGDBo5Z8Q2MjTgtiiiMRdMqGW7aug6JpNd55oNOni2BSumL5UI/LYwxuuMVJR3+2BO5rdD/DWiwrepZlKKf4ZjTsDUmRXj9vcCn+dNQYwChw2JyHAehyMDmkgxABV5TLoR6AGNQqjIYRKXNMCVGfp\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: 017234C4-3ECC-4F51-9734-477B2CC6C803\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":473762,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"cc5f88340212cac674500954aead1456","sha1":"f90402519324070fe5387747aa568406615353b9","sha256":"eddd66a7205f52d67435b916c2fffea6024a6ecffdf74627cec55c7e4aa9f1fc","sha512":"fd5276c4c317e70b7c660edc9b4f71fb45c690d159a5ecaef28f9f9bb077225eda071915b2a5a6bdd28a525517e6ef38881b1d76201fecfe84f2093dce47a7dc","ssdeep":"12288:eY/dfPbc6XDpHO8KH4+h1+CNA93hMXHov7REUn+cBw5n+HtH:93b1SHQZhM3NABBw5GH","tlshash":"75a433612695f7273775ebf0cd7311ea3181e500a3ea64a7df6bc11a41e68a0b4ec31a","first_seen":"2025-08-29T11:05:53.308158Z","last_seen":"2025-12-29T08:12:31.3923Z","times_seen":284,"resource_available":false,"data":null}},"time_used":4947,"timings":{"blocked":3127,"dns":0,"connect":0,"send":0,"wait":303,"receive":1517,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/css/index-399e2569.1756903329400.f2d3fd45.css","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:21.484Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /css/index-399e2569.1756903329400.f2d3fd45.css HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:24 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-e0fa\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725544=qUQEP8SNYPTGOqrcZx6Dtd4Jed1q+9haGbuQqFtaJYiTmhLqOkXAcWFVmV4rrX1x9NTL2pweDaExL8o8r0aif/AN3jKc6T1Gs9EWk9625NhGGo5IUCcgEH+baY4vQXKFuWHAEjloy/Ka5vmsirI3m3axmdakL2OX9yVI469rp3IUqp3QDYkavuef+a8JHKvR\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 90588176-7C68-42DB-982F-8B3775B3583F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":57594,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (57594), with no line terminators","md5":"0bef4e7c4e84f6239d22f4203413192b","sha1":"f78cb75a974a7ef4ad6fb57d114c15a9b01e7fa7","sha256":"5b262fc0f9fc795ec63fd0e9afc4330757a5084ada12fd0163e40db339faf636","sha512":"65794dd7ecf908684da4c74a3360c5ddb3f51d12288d394002038de44677de9de92284164a288ca328fdaf3e15ea9aa6f16f750431488c0f3e87d68c6df6eae4","ssdeep":"768:E0ouj7X8vtr9UL5srs7hAqpLe20TCKiNkZICSA2ohGyHukQ9aaV+TJtU+WQZLq:Hop9isrQAqVe6KekWRlkQ9hf+Pe","tlshash":"6d436c2526e435ade27ba715ec91ea49312b8701f127725afb03322bc1c32f5c677b41","first_seen":"2025-08-29T11:05:53.260224Z","last_seen":"2025-12-29T13:58:58.036511Z","times_seen":443,"resource_available":false,"data":null}},"time_used":6560,"timings":{"blocked":2494,"dns":1,"connect":311,"send":0,"wait":929,"receive":620,"ssl":2201},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/index-399e2569.1756903329400.c784c4ca.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:21.498Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/index-399e2569.1756903329400.c784c4ca.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:24 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-5b7d\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725544=qUQEP8SNYPTGOqrcZx6Dtd4Jed1q+9haGbuQqFtaJYiTmhLqOkXAcWFVmV4rrX1x9NTL2pweDaExL8o8r0aif/AN3jKc6T1Gs9EWk9625NhGGo5IUCcgEH+baY4vQXKFuWHAEjloy/Ka5vmsirI3m3axmdakL2OX9yVI469rp3IUqp3QDYkavuef+a8JHKvR\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: B600CE39-E2E0-46F0-8D04-B6009AA7A350\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23421,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (23421), with no line terminators","md5":"6117cdb5accd41ccb0125c70452306f1","sha1":"80f85cd8a495c476087fa382198b2a06f5d309ae","sha256":"794e522144c7d6885ba07f4654bbf62f0b06f1b985a897645092cdf029afcfea","sha512":"1737016527bd862c7804e4dd164e109c7f3a087b5c0a751764c22f8b2fa9a10f4fddb8f98234d4da33eaf7a314648d28eed89c0750dabf2006ee105b6f8a2cc8","ssdeep":"384:EZSANHLDaxKalO7PT/Wy4QfHhwrxrjgIhK47ZyQQvXTcdw5F3oWf0Af/nqxtU8X:HYDaxKUO7LZ4QvhwVEMKUZpe5FYxAfPQ","tlshash":"c6b2c6e63392bda4c24f9276f33a58ecc53f9241c30fc4f8d265bdd47da8644a992684","first_seen":"2025-09-04T00:49:32.717031Z","last_seen":"2025-12-29T13:58:58.089613Z","times_seen":434,"resource_available":true,"data":null}},"time_used":3557,"timings":{"blocked":3068,"dns":0,"connect":0,"send":0,"wait":488,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/kc523-1/logo/logoWhite.png?1756903280095","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.009Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /kc523-1/logo/logoWhite.png?1756903280095 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 6364\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-18dc\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725552=+hxA24sti7lqYYqupQnW9OdDveGHfM+yVXFNWLeNWVHbkZszbu4mHTohUTANLRNSQpC+on1scArJrHSuZR0EnNfSuCrQewLq1ZciobqdoGYLlt4BzR9bC9ZqEJokSjjy7X1RgRKhXeWPUwgVQIwdg9fSdElkJRYx7lyRsFydDCX7EZgGx0tbjXSJRf5EvAaZ\r\nAge: 1109460\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 6939C6A3-7E8C-40DE-8A84-BBD4575A5185\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6364,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 318 x 144, 8-bit/color RGBA, non-interlaced","md5":"45c781dc22fa33ee3af4b9611b40208f","sha1":"85005a42a66ac2755af868d974cef7a96b3f7732","sha256":"992d312ebba7a4f7559af9b559b803b6de8be4577a26366c29066d98bb382428","sha512":"63a95d0d966dd41d636bcbedda1763579f8126b7ae5448c3f8f350aba06b05dbe81d9f615833f0bbff34bfe341c6f206a89e145ada9acb28945131c816ca8094","ssdeep":"96:T/iMk0vyTGRwuNomrrhXoC4P9IdsLM1hhpMUWBg+TM42IGWUp9PXtQJ1mTdAcsor:TqMkud+wWC4VNyhhpL/+yzV9QJM+4","tlshash":"d5d19e4301c5b55102d0521645ba005b6dfb6be0bedcc40aa497ef0609313e6fef75d9","first_seen":"2025-08-29T11:05:53.141975Z","last_seen":"2026-03-22T22:11:35.376909Z","times_seen":1124,"resource_available":false,"data":null}},"time_used":4416,"timings":{"blocked":4124,"dns":0,"connect":0,"send":0,"wait":291,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_79864bfb-d71a-4513-a524-8823b86ee01d.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.945Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_79864bfb-d71a-4513-a524-8823b86ee01d.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:38 GMT\r\nContent-Type: image/png\r\nContent-Length: 87818\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GJugqxxOSfo6WIu%2BqDAmGaCmyVcfEo1Fh6wUNQIR0kC7VkG5SFIvDsZjGJ0eGDcbAsPFDt72sA3i7ZEXH0CZIkGDdaUDgcA6m%2FucWN0CjFsE4meoELk%2Bus2UwUnF\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"aa6fecf1d92393ed340d8ecf5eb30180\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:10 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109441\r\ncf-cache-status: HIT\r\nCF-RAY: 9a1581bbeee8e8cb-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725558=CqU/qJIsoXMX7Gvi171YHqR2CQBtd5s+x9S73uNZlw2A3tlbc9+spA/CvW4Gm6DHJ1dMf2zTE8k58Rhrl70ihx3AV1eZaITtST6ZQhVQZ3ghB6qZz+vzHVTtt0vWUxKAvALFWrFGl0r/jxJMUvTXlSY9LSeq7ejV6cKXEUguF279zmB10apsNqAYt5NztE7E\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: E0AD3112-FA5B-40AA-8F61-B9B5EC8C230F\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":87818,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"aa6fecf1d92393ed340d8ecf5eb30180","sha1":"c253c4066e99708b3af4c91c8cb87f5500b9e14a","sha256":"802eb202e21b02b88c529fcfab0745795ed573a9d1a623f06c64730ef1424bec","sha512":"a2bf6e88728516abb6b6bc3c7b8475ffad41d7f8a1a3420bd00a853256faab18f42b8e358feb7194a7d5f4e327753943edd2d784ad489a3f6464ba3dfaaf8a7d","ssdeep":"1536:kBPumsnGpw4JOOR/fiF4kRtopUtzjHjt/UEqVo0xrQiGkw88TpGwB3EVchMbYi+D:k9AmJOyHOqUt/XWoErQi/wywB3miDz1d","tlshash":"bd83121fd6c96f65d8d871fd28e8734298add1835ed12e43a001a7e88f498f0a027ee5","first_seen":"2025-08-29T11:05:53.090923Z","last_seen":"2025-12-29T12:28:25.260601Z","times_seen":296,"resource_available":false,"data":null}},"time_used":4612,"timings":{"blocked":3997,"dns":0,"connect":0,"send":0,"wait":307,"receive":308,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/theme.config.a0ea1565.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:21.486Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /theme.config.a0ea1565.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:23 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-19ee5\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725543=61dmuydCWjCzLQU2zCyJxGo2a3J+yabvxh1wEcdz1uVIb3ct2y5Grk6xFzIZ4BcICGVwXzubEd7bpcqUIllxGgVZszq3wkQqeZZA9cbwHg8FJbA3rVT+nLWfIchJ7Ophsi3H5yrbVneU4KpjYpVRIIrNzxqyrfyuQ9/+U0Zdqa7EcU1GDjMlPzHLGc5y8IhR\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 5F507552-5423-4E3D-863A-C2EA5FE7AAE7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":106213,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (38260)","md5":"81c0ad2c8936f5f90cc4ba2b2e53366e","sha1":"8abbe251b908b7d81c73d8537d9d144d3ded3ff7","sha256":"61e7b259016e16c5f842da901c3b2f8202b73db878acb4366eccc217a4dc0b58","sha512":"f295e613097c68b8cb8d0a2530d07c3e883ffc75fdf6d0cd35c23040f1bb182401671c0f70781b64c97db7a37fe9d6d8163de658aef95ce9327ae0068afec7f8","ssdeep":"1536:D2JREob3mtlIRM4Sb2mc42mnzyJog9Cc0hM:qStlGu1pnz45HX","tlshash":"a1a3bb7ee20c963a6177a9bfb46ce111c12e9c0cab1d5fdef13e10a25710669c831de9","first_seen":"2025-09-04T00:49:32.985127Z","last_seen":"2025-12-29T13:58:58.024831Z","times_seen":440,"resource_available":true,"data":null}},"time_used":4565,"timings":{"blocked":1879,"dns":1,"connect":308,"send":0,"wait":784,"receive":1,"ssl":1585},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/bj.ada43481.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.162Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/bj.ada43481.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://y108p.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 439504\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-6b4d0\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725550=EnwJxt5GEWZDoy2zM7O5VXjcyuKd9QeUQschlibf8N338Aywly3eO288QFLQVHJlDyo0pDjxpxgKkpZBHYec+tXMDURhFCbrUPeFgavax+z0IHuK0xhcuNPttVS5GyOXCrGmvQfb7udRo95bcQln5pJocaMrGFQivBnHGp5AthjDtr2jbX9R+GmiXuhzQg6n\r\nAge: 1109463\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 6C326CBB-6C83-4D26-89C7-8F099AA617DD\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":439504,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 927, 8-bit colormap, non-interlaced","md5":"2c55f8fcc8edb773be5014d8deb72c4e","sha1":"e7e55505bf22de833ec6b82a229e70bdba93b58f","sha256":"21c44535cffd825752bf9a535001b4b605147e3434cf2906fc2c8fcdcd992c1a","sha512":"bab93e8eb191df623bd7e238ae8d5cf7feae73e2a768d7b591d4dd8b7aafc199fce7c34066a272fc9137959a78a6bcd9fb388f39d4a0938f5674aaee815a3cf7","ssdeep":"12288:K+TyFzCVXhEu0hvb3kkjOO9FNkh4k6yvwUKA4AuJiT9h+:tTyFGjENkkyOWh87UK/JiT9h+","tlshash":"739423b1df0b89c858a39043dc74f99263e8d0a6bdc40ab80bf14b9176709dbbbf5116","first_seen":"2023-08-17T12:39:32Z","last_seen":"2026-08-15T19:18:34.455631Z","times_seen":2513,"resource_available":false,"data":null}},"time_used":6312,"timings":{"blocked":2584,"dns":0,"connect":0,"send":0,"wait":311,"receive":3417,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/help.4e3cf897.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.163Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/help.4e3cf897.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://y108p.xyz/css/index-399e2569.1756903329400.f2d3fd45.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 10322\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-2852\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725550=EnwJxt5GEWZDoy2zM7O5VXjcyuKd9QeUQschlibf8N338Aywly3eO288QFLQVHJlDyo0pDjxpxgKkpZBHYec+tXMDURhFCbrUPeFgavax+z0IHuK0xhcuNPttVS5GyOXCrGmvQfb7udRo95bcQln5pJocaMrGFQivBnHGp5AthjDtr2jbX9R+GmiXuhzQg6n\r\nAge: 1109460\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 214EA7BC-48BF-4530-AC32-B9E6D1B8EFB6\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10322,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"6dd52a6a4d07f2786b1926fac1b4b06a","sha1":"9c9908204401fbe65d33cf7df8881639d6aea37d","sha256":"e02471f47b506ab510d0e0dc4224cffc03c34f950b649ce347ccd71af0bcf0ab","sha512":"fdd52f532e5c2e2c182db20e2053eee0ca8c26cec51ff75e1bc341b01911461ac72fa75887fa3114188ba32aa6341c0974d81d071fc42b605e72f73dfb87ab9c","ssdeep":"192:x0C+pMwjX2XZ456BAJu+1KzdjCfDrRq6wUPlJyh2h4PAmWP5yQSkHxfYX32H5TRm:EjGXZau+1MjCrrRLlqGOnWcQSkRQX3IG","tlshash":"3822c054370836084f737a4362ac4e837a06040ffdf9b7919a6372659a5b94e44cfb66","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-08-15T19:18:34.460318Z","times_seen":2610,"resource_available":false,"data":null}},"time_used":2957,"timings":{"blocked":2649,"dns":0,"connect":0,"send":0,"wait":307,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/ecb/8f8306425ab46d0221b2c56ef50f72e487d5bb0255ee7333091abb7c08c465094a574c3c12d0e1812241fe43c0d5f0ea88d857f698a4fd081b","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:29.001Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /ecb/8f8306425ab46d0221b2c56ef50f72e487d5bb0255ee7333091abb7c08c465094a574c3c12d0e1812241fe43c0d5f0ea88d857f698a4fd081b HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://y108p.xyz\r\nXign: FgviltQAQSZSpYj3lZA1Nf3PEPoseahz1bJfTVWZ4l9iNCTa8aJzSdesOhqpsqpeVqeI9Dk3WCf1hoKtMeUNo1ge5wuR6b5+G+JXlnwuQ9YoUJgb4QK2q9GY4TjubxSNmHWBMTCfFtKB8qieWbfh5OJFzsuIAFuUeffxoIsHNac=\r\ntimestamp: 1764725548982\r\nsign: q4u6m4g5sr5n5a13\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: rEfAYkDGbEEF5yTzpkNZQfYMBdt5bAF3\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:29 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Wed, 03 Dec 2025 01:37:29 GMT\r\nCache-Control: public, max-age=300, s-maxage=300, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725549=/hVpQNHfLaAcoXjZCNTD3ZDnYR8cYfq+YoSlktnj8vjV4yYEoNmYY0sKl65CWk9dh56Dl85PFjG7mrhMoZDvByy/GLY83hGvAKTjFaBL1ZoH+ejqwiyveU9JUw8qyMDteBKPL4KYudk6vsBAmQXX3V32d2e2abScXG4NnkM2M65b7NYaok48/b3a97O06i5p\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 33139B2B-A199-47AF-B4DF-9C1C50EB2D40\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":34366,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"37ea0d10682505afe72e8e7b620507bd","sha1":"1f3fac52663830b0632a1830b49014649438e664","sha256":"5d3f2b6722f2da467239b83fea68dfc7c8dc614a98da22e21ca8b2f71f1e0534","sha512":"b66b987f6c742bf37544871c630eceed99f16fb8750e9b2349d1b6ec2c765b772455e3ae4b4dc6dfa8a39df44515f24311b04b49785ed797252abe59061977b7","ssdeep":"768:OMLM2PanHhhz0KJfnnJNQLMJeNDH4vOk8VYUiAt09Fp6YFkoBk9AIoE:OMLMLYOxeMJgL425eUzi9H6YFkWk9T","tlshash":"6333e0195560f37096ab16ee600370ecc26d0ad9ebdebd24c268d2611e9703c5ecfce5","first_seen":"2025-12-03T01:33:08.734355Z","last_seen":"2025-12-03T01:33:08.734355Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1000,"timings":{"blocked":511,"dns":0,"connect":0,"send":0,"wait":488,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/05c90d7898a2427cb1aa1a53d7773169?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.443Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/05c90d7898a2427cb1aa1a53d7773169?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 7801\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 4925\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"05c90d7898a2427cb1aa1a53d7773169\"; filename*=utf-8''05c90d7898a2427cb1aa1a53d7773169\r\ncontent-md5: IKw05EWD8CrdMNysPUgVBg==\r\ncontent-transfer-encoding: binary\r\netag: \"FsevN1KhA3Ct0wVtusUa1XW4bIBr\"\r\nlast-modified: Wed, 26 Nov 2025 20:07:47 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: aO9SPK6WT\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 73AAAADX6GoPjH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":7801,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 99 x 99, 8-bit/color RGBA, non-interlaced","md5":"20ac34e44583f02add30dcac3d481506","sha1":"c7af3752a10370add3056dbac51ad575b86c806b","sha256":"2dac949dc826d6241dafd7a4214f13a1b1ae6bd29232e1f711a57dc76bf6b4aa","sha512":"c5a0878d046cdfa2c086ca76b12e55d65b9a85f69896e90339ba30f287a04098a01882b8979048265c110100aaf85888029fcaa803228b5b5340db672779eb07","ssdeep":"192:yd7FP3Lcy7eYh5KWqtvcwCHdoruj21SPaozkWdAbAv3gBDMS:yBFvIy7eYJqtU19orXooMAEfgCS","tlshash":"24f1aee6884d6d318734053a84fba0caea2b2a6deb246a1344717b2d38db4315259b4c","first_seen":"2025-09-27T21:37:30.345395Z","last_seen":"2026-04-19T23:36:55.777999Z","times_seen":34,"resource_available":false,"data":null}},"time_used":2467,"timings":{"blocked":1099,"dns":553,"connect":250,"send":0,"wait":271,"receive":1,"ssl":285},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/4d2865dc6c7a406d853e08f9224709c7?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.486Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/4d2865dc6c7a406d853e08f9224709c7?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 14674\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 12738\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"4d2865dc6c7a406d853e08f9224709c7\"; filename*=utf-8''4d2865dc6c7a406d853e08f9224709c7\r\ncontent-md5: w4OnaSgoi8EsdKqCb3goyw==\r\ncontent-transfer-encoding: binary\r\netag: \"Fll54oRBEvoRgJ9oOVtZ_VAs5ezs\"\r\nlast-modified: Thu, 27 Nov 2025 20:11:02 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: mZpDYUWoZ\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: YzEAAADCS1D0hH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":14674,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"c383a76928288bc12c74aa826f7828cb","sha1":"5979e2844112fa11809f68395b59fd502ce5ecec","sha256":"0559cd498aa30949cdc3a8a1e0b42a9e1b1c8d8d4f7660acb4040ea3b61aaef7","sha512":"618127c0f46785268f264d49491ff60cb31d6b8fdf73c9e90ee71b8f24e4bd10ee8e46ef40c5695f9b6620d90175f8d65265ce6e6d5688028a1206bf4fb44ce7","ssdeep":"384:CUCsyr1CuVqYvJug9ziSQSxfrxwGqfAKTY8LYe7nlh4n:Ase1NdziSQSxfrxw5AKTY87nY","tlshash":"fc62e09303a52c842ce533fe5187826487b578b06336ecbb0b4367b07d1c970b25ea57","first_seen":"2025-08-03T21:40:07.445967Z","last_seen":"2026-08-10T00:01:39.741424Z","times_seen":252,"resource_available":false,"data":null}},"time_used":2261,"timings":{"blocked":1056,"dns":0,"connect":0,"send":0,"wait":1078,"receive":127,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/296aa5377b154d8296a88a81cda8796a?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.561Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/296aa5377b154d8296a88a81cda8796a?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 20901\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1948\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"296aa5377b154d8296a88a81cda8796a\"; filename*=utf-8''296aa5377b154d8296a88a81cda8796a\r\ncontent-md5: UcjjCkyXW82B79w0+4GNUA==\r\ncontent-transfer-encoding: binary\r\netag: \"Fq2ut6F_DIUwxO_DcdKarQiq2gtT\"\r\nlast-modified: Mon, 01 Dec 2025 12:41:43 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: ztmw0ds7j\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: HtQAAADHC37Ejn0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20901,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"51c8e30a4c975bcd81efdc34fb818d50","sha1":"adaeb7a17f0c8530c4efc371d29aad08aada0b53","sha256":"d7eef2a96da73395164d8554a2ada4e5418f730c763147dc3ba2b3f6a0d87889","sha512":"07727066ea69993cf4d84931bded0dd55ab9c9e072a43685a37a6006c5e9cd165b2c9fb884354585bdb718913d9522df423995a698695458b22252afc2ef4155","ssdeep":"384:79u/INL4d1MJJPuv+2G6GJ4CPpXnWW47Dgh0ZXoK7ymda58nl/lfQuYH+HhmCv:7nLq1oE+x6GFxXb47seZJ458nldffHnv","tlshash":"f392e12b209581a8366bdbd6f39599328cfa4986291e317fc605dcb3cfd845f005bc9e","first_seen":"2025-04-01T11:41:18.037862Z","last_seen":"2026-08-08T01:43:15.336947Z","times_seen":426,"resource_available":false,"data":null}},"time_used":2644,"timings":{"blocked":985,"dns":0,"connect":0,"send":0,"wait":1306,"receive":353,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/b2d7347938a949368a7b6035a0aa51fd?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.562Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/b2d7347938a949368a7b6035a0aa51fd?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 9998\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 87\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"b2d7347938a949368a7b6035a0aa51fd\"; filename*=utf-8''b2d7347938a949368a7b6035a0aa51fd\r\ncontent-md5: 7+ntnRTEaYGsJQMrKfXgow==\r\ncontent-transfer-encoding: binary\r\netag: \"FhnDP4kPSfBezoGAAH0IYObj8vDr\"\r\nlast-modified: Wed, 03 Dec 2025 01:29:04 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: 1PAtIHFx7\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 68oAAAB6gNN1kH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":9998,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"efe9ed9d14c46981ac25032b29f5e0a3","sha1":"19c33f890f49f05ece8180007d0860e6e3f2f0eb","sha256":"633555bfc5aef6a1c1942cab168ab9a3d8e71f0908aec865b64c3df46fca3fc6","sha512":"55bf0ac6a504f44d06368f86b9ed7c68b740fac56ed0db63b40362c20fc4be434f1a645a129dc5f107130bf614eeec586bdd551a376f7fc7d5c04c4a6abdc2a7","ssdeep":"192:cICImwjOHeoP51cMxC02Hql0X+25HY2RQXQKegqwdRWjr0r4JTUAZ9JptvjatAam:cRImwyHe251cMxCRJX+2542RE9dEH06v","tlshash":"4522cf3cbce48c5c4311e14b92d6fd436dd88b5219f232aea04e5029bdb94337bdd66a","first_seen":"2025-03-28T02:30:49.290977Z","last_seen":"2025-12-03T01:37:40.755657Z","times_seen":10,"resource_available":false,"data":null}},"time_used":2665,"timings":{"blocked":984,"dns":0,"connect":0,"send":0,"wait":1307,"receive":374,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/css/64906.1756903329400.0ab0fca2.css","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:27.960Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /css/64906.1756903329400.0ab0fca2.css HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:28 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-1439\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725548=wdtO4M5R3pyBXDSDlSB9FD5ieOJLpGjZdfC4za9oCAyN1n8vLsGZ+z8auR/Dh4ykS+PCyBfoKyAMuN0NuIOnM6NbqsNDb1di2mTV1gji9F+K2Iou2dNtgjOROSr+yzTqg8c7tnLTv6/yv2kgFzbOjVLWKxGxOEpbx/MH0+yEv5fPjuQbFYc97dxvwU8Cbcw6\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: F3507123-CC06-436C-B853-09BAABFA0B5E\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5177,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (5177), with no line terminators","md5":"a0ef4268641ef0b005737ce8cc0c4b44","sha1":"9bb50b9000a419e7a701392b0d7d6c992cf585bb","sha256":"f64c7a7e6ecd620d1c7f8cc67e1eda83a0a115a8d86f3954efdaba3c09d62e66","sha512":"07605ebd7e16aef28f0ad5ed406f29ea9b77e8ba6b2079c810aacf8faf0b4a8d18d4f7775c62860cbf6d4379729a60076103a4daa833c860ddebeee3793ccbe2","ssdeep":"48:ZSPkOO2s2L5Pukasq+nArLkrL4QuQKhUjUkM5P6CdRDRWURcWaTHR/:iOvyP2r4rEDFP61LR/","tlshash":"d1b1412f01703349641bad6807dc67098325d8b399eb37da259d2a0dcbc3f861eb718b","first_seen":"2025-06-26T16:31:28.933081Z","last_seen":"2026-08-15T19:18:34.486765Z","times_seen":3749,"resource_available":false,"data":null}},"time_used":471,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":471,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/64906.1756903329400.e9e9ec75.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:27.961Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/64906.1756903329400.e9e9ec75.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:28 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-35295\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725548=wdtO4M5R3pyBXDSDlSB9FD5ieOJLpGjZdfC4za9oCAyN1n8vLsGZ+z8auR/Dh4ykS+PCyBfoKyAMuN0NuIOnM6NbqsNDb1di2mTV1gji9F+K2Iou2dNtgjOROSr+yzTqg8c7tnLTv6/yv2kgFzbOjVLWKxGxOEpbx/MH0+yEv5fPjuQbFYc97dxvwU8Cbcw6\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: 57A402B6-0193-457A-B6A6-98C0C847062C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":217749,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64884), with no line terminators","md5":"18789db02e1943b9b6e2a4bc1db4cc9e","sha1":"ab3db8b123be3580e4d5198c5ca7b99e0cd00d4a","sha256":"381bb6518856ad825c2e3fa1ec233fefa0ef52a11dd2a2dbca840381687dedb3","sha512":"6895a97c1c487d492779c4d0166bcdf0599a8634c8af8c051b573d84f001b730738eb8194f5edb5ca5eebff733289c293cd9889ea0b373330a3d9860cea872ca","ssdeep":"6144:9MhEyLkbLniyyeBHlBfb08rzZAncbtiTisXuLCoSltnIwb/mmtMDj0Rts:9MhEyLk3niyy0HlBfb08rFAncbtiTisY","tlshash":"3b241b94b690b17883bf85ff7224a164e24e1f9860cc9de4d26e2b407f12706b8775ed","first_seen":"2025-09-04T00:49:32.707517Z","last_seen":"2025-12-29T13:58:58.048456Z","times_seen":418,"resource_available":true,"data":null}},"time_used":2445,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":514,"receive":1931,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/ecb/8f8306425fb46e096ba9db3ab31b67b681fbb31575ff397b0117","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:29.002Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /ecb/8f8306425fb46e096ba9db3ab31b67b681fbb31575ff397b0117 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://y108p.xyz\r\nXign: eQGRS3kGqqp7CVR3zrJnvl4QV2pwLPlZ191v12dfrmObmAqZ9SyLxKeB+1aDB7Gitl3LbtVb9XXNAooJEckGspOAjelDlNEiRtGvRVygPJpEyqyDvQQ/vrp4MNlqKpgWVQB6BLvAQbiJDdPvsw6oHw/q0umyfpXV6LcESo0aRyY=\r\ntimestamp: 1764725548982\r\nsign: 87g6vq7m321q2m3b\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: rEfAYkDGbEEF5yTzpkNZQfYMBdt5bAF3\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:29 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Wed, 03 Dec 2025 01:42:29 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725549=/hVpQNHfLaAcoXjZCNTD3ZDnYR8cYfq+YoSlktnj8vjV4yYEoNmYY0sKl65CWk9dh56Dl85PFjG7mrhMoZDvByy/GLY83hGvAKTjFaBL1ZoH+ejqwiyveU9JUw8qyMDteBKPL4KYudk6vsBAmQXX3V32d2e2abScXG4NnkM2M65b7NYaok48/b3a97O06i5p\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 89310E08-615F-4C3F-9B96-4781BBB2ADCC\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1947,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"78d3a9a122b4e152eb852b6f6e6b156b","sha1":"618b939f7a8dc251673b04bdeff49b0b7d397fe1","sha256":"b022c931e6e875d7be7d01d27cfcf1b382873bc74c1a1beb58392078d0c89e04","sha512":"2d6d53b7082f1aa2de86af9c2ae15c7292f8cb8c5e1c18ee01409ab006051a26df6837350b6475314bebe82612c30a8855a973abfc9a26dd701def886a7e4886","ssdeep":"","tlshash":"f8512b678edf3744794819b7eca502b1ef8a6e07e90ee988c0f8080dfca4879175dc56","first_seen":"2025-11-20T14:42:56.01316Z","last_seen":"2025-12-03T01:33:08.744514Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1103,"timings":{"blocked":648,"dns":0,"connect":0,"send":0,"wait":455,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/SPORT.aab253e7.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.104Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/SPORT.aab253e7.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 55380\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-d854\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725551=Tl57i2AA5msYKmQD6D9b96oj05vzNG1l1CRjWQNFDIl0/XOB91wmnNIuwbzcvYLLX/+8PfesGrw5GUIZPSgoLImPW3qb6JVtL/D3VFmUZJ2JOKFTQEmo6Emj7kqSzJVgZ3YR6VcZAjkG+nzNcBKE087eIDc4XsCyYhU4Om61Apb3ZxYss03gNL9y0YZ3YnNG\r\nAge: 1109446\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 40860EC0-3960-43FC-9FCD-B8EE09F70758\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55380,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"3990a0dcf110f100c97ab413079e969e","sha1":"8087b72a149b71f4f5fc43b0f8bc07b89b621583","sha256":"6ddc189e7780b1313933d4903be9fbf6644b6a590e9aba83a6e4e50fdafb170e","sha512":"6b092584d42ec1423ecb94383907f29571e93308944813286d6e74b10f6eccb27536924220780f9a080dc259a095718a33f0757fc0adb04d737c83a6fa1647e5","ssdeep":"768:aEivx5zbZ4L0zze87wWbuKu4YIsZdCPX4ueh17yEs7NsGJSLsBQ1MDAaYHKJTbYC:aEi3eL0za8xbw4UmXI1VfJIRDYqz6W","tlshash":"bc43022944944c242384f1a6ac778dbc6dffa348a5f38f639a842bec7dcd84d95f4811","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-14T18:21:23.257389Z","times_seen":2400,"resource_available":false,"data":null}},"time_used":1329,"timings":{"blocked":1020,"dns":0,"connect":0,"send":0,"wait":307,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/bdc4803425464cb88be01199c5bed9f2?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.556Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/bdc4803425464cb88be01199c5bed9f2?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 269934\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 9130\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"bdc4803425464cb88be01199c5bed9f2\"; filename*=utf-8''bdc4803425464cb88be01199c5bed9f2\r\ncontent-md5: WGit5HCFFwcEHcv18/DR7w==\r\ncontent-transfer-encoding: binary\r\netag: \"FoF1NgxiJ2epGlLkoW_bpEs7pAe4\"\r\nlast-modified: Thu, 27 Nov 2025 20:11:07 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: u40br4L09\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: D-IAAABYC1M8iH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":269934,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 1200, 8-bit/color RGBA, non-interlaced","md5":"5868ade470851707041dcbf5f3f0d1ef","sha1":"8175360c622767a91a52e4a16fdba44b3ba407b8","sha256":"39111bf999865c4c1e758592cff810b0338632f26b43935d66cce08dc3eb3c4b","sha512":"b6bf4a882095f1913bcbe6df01b139127019caa812d7a7de8c6e09627f706cd8b6ae8cd53c7d6d90963fa611014975a92457ec2f030b8a7287886cffcbbe5a3a","ssdeep":"6144:KoxRKuqoxf9WkLDXVCgse6QqI3rnYREPyZg8:KoCPS9nLf6PMsRuYg8","tlshash":"0d4423c8b4a1d1a654db1d67402e68a34f8616b94fb7c191488c36817e8ef7836cfbdc","first_seen":"2025-03-16T19:56:39.321899Z","last_seen":"2026-08-09T17:07:42.948849Z","times_seen":244,"resource_available":false,"data":null}},"time_used":2965,"timings":{"blocked":990,"dns":0,"connect":0,"send":0,"wait":1307,"receive":668,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_2a74177b-d024-4ea3-8b58-fce53f91051b.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.952Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_2a74177b-d024-4ea3-8b58-fce53f91051b.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:38 GMT\r\nContent-Type: image/png\r\nContent-Length: 483349\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Y1YeFTvzcW3N1vJb%2Bya1BtOw6pheM2UCiOCTvByq1nVYbC1WP0zYiHjawqPH6TthlxOYbcrqmx0kxDDQYCShpkBeOqLp2KsSco1NHbgKumpPv5dn7LYqKhaohnl2\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"20cb497720893e4fbb1e23f7820720b8\"\r\nLast-Modified: Mon, 08 Sep 2025 20:42:28 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109439\r\ncf-cache-status: HIT\r\nCF-RAY: 9a1581cae874c3e8-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725558=CqU/qJIsoXMX7Gvi171YHqR2CQBtd5s+x9S73uNZlw2A3tlbc9+spA/CvW4Gm6DHJ1dMf2zTE8k58Rhrl70ihx3AV1eZaITtST6ZQhVQZ3ghB6qZz+vzHVTtt0vWUxKAvALFWrFGl0r/jxJMUvTXlSY9LSeq7ejV6cKXEUguF279zmB10apsNqAYt5NztE7E\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: EF3C78AE-8CDE-4991-82DF-450E04149CCA\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":483349,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"20cb497720893e4fbb1e23f7820720b8","sha1":"c28199286ab1779fe69337d7e544caea3e1bfcf9","sha256":"e53e2e36299deb515827b23a503a4385192ad394c3c1cef219ad0615a941ec87","sha512":"afbc4206f4ddb37ff5cad057c7e0c5c79ac9cb49269f462a864fc177fcb5831f7c5b7facab8d3e82e3462514f2e886524759016e3bbe4265997b5b11b7a090f9","ssdeep":"12288:sZs0q1JCpNZTUEAee80UoTUaaDy8Vcn/QeRXXAiR4KZVTH:sZsV1QpNNUHt8wQjkoOgiLZJH","tlshash":"0ca423a8c90ff46632a7733eae2f1b981d112b44d0ebb75c805fad815d5ff7250a8849","first_seen":"2025-08-29T11:05:53.318971Z","last_seen":"2025-12-29T12:28:25.247491Z","times_seen":286,"resource_available":false,"data":null}},"time_used":6522,"timings":{"blocked":4374,"dns":0,"connect":0,"send":0,"wait":307,"receive":1841,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/chunk-svg.1756903329400.5bf5ebac.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:21.488Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/chunk-svg.1756903329400.5bf5ebac.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:22 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-708ca\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725542=loAbgkj7GWx6iuZXUN8803wwHCF2tcMiMPh1K7jiPjw2nzUlPXgFYYntt8C+o4c+kP/Y4dl7q9hVWiVkghxclK2NAsYhlm3zqfjmYBpmPvKu4hGiLNJj950jQhd14O3ngI/kl/k50Yt97j9KKa34EbrRrMuA+on1Hbi/xHiRzaWydUSjJaRMKnKVKJhV4Try\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: DE16D485-FA57-438B-9575-84D4833F2A6B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":461002,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65532), with no line terminators","md5":"7f3450cde65c4d0964dcc6d243a1656e","sha1":"ad5b362b491b71dff95398219d8e190c80650865","sha256":"924472178572d451953cbf73efcf577a697b3102176fc17d9ab8c379b6b37bee","sha512":"e8f2350a17821376b71a040626a3d5c58cf5744b22d512fbef45b3246558b0f7001ca4d48d32e34831ec7750e40008f7aef529b4e618c6770bb5e72e4c028cd2","ssdeep":"3072:38nz2uaLZSZvx6Q/sIPrekK+m36Ua94sRZI7gbpU:38nz2uasNxpXPrekK+m36UHsE4pU","tlshash":"7aa4fcb4c190f4edf704ce196e7c9e1c50321688e0a9e9e52da9fe0d9e85d6b241cdec","first_seen":"2025-09-04T00:49:32.781171Z","last_seen":"2025-12-29T13:58:58.073596Z","times_seen":441,"resource_available":true,"data":null}},"time_used":2496,"timings":{"blocked":414,"dns":0,"connect":0,"send":0,"wait":832,"receive":1250,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/assets/logo/favicon.ico","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:26.733Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /assets/logo/favicon.ico HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:27 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 58278\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-e3a6\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764725547=ZeBRC80LTJHPPI7+oQOCUenUy6TYZ+KmFrw1JR0Iyyn8PAFS0kApFMnQKAyo59yPniskPq2Lp+EsfxmzuOlqtRplgWv8rGdhxZn46bK9M3+DE3/dryCYhCjyAiWHjoVeSJa831Y7QVBSZDFuG3DPWuN+XIeSJ0XS1R/EL72IF40w40mrTtjwo5ru860rvzzS\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 12BE7F41-3950-4477-99DF-26A2B22D5A4F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58278,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"7fb9203f2701deec1371d2fd0ddd079a","sha1":"a7d4ea5f1c3d103aaa3c078bf540b56404aec0e1","sha256":"2a342dd0f9977afb12227889cf13ff008d4cf1e9a4ca07fb4131d14af05978d0","sha512":"964cf7794a7b72bb9515927efe748563b6d46fe122b35baa4c7f57fafb09ea759e5e759a3000d385872218cdd08383a58a2b66feb9a712e6f3e9a06cc87e43b5","ssdeep":"1536:e7V6OVB39Hdm34GeF4KERayBlZ3WgaOlblY4+:e7V6OV7034GeFERd3WgaOlbGN","tlshash":"af43f10a258e86c73047c3921b2dc09b70d12c776b8daef9e6bc4a5816d54731bbd1ae","first_seen":"2025-08-29T11:05:53.165834Z","last_seen":"2026-03-18T12:35:38.966648Z","times_seen":1201,"resource_available":false,"data":null}},"time_used":504,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":471,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/kc523-1/sponsor/sponsor_nav_web_2.png?1756903280095","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.139Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_2.png?1756903280095 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 6434\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1922\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725552=+hxA24sti7lqYYqupQnW9OdDveGHfM+yVXFNWLeNWVHbkZszbu4mHTohUTANLRNSQpC+on1scArJrHSuZR0EnNfSuCrQewLq1ZciobqdoGYLlt4BzR9bC9ZqEJokSjjy7X1RgRKhXeWPUwgVQIwdg9fSdElkJRYx7lyRsFydDCX7EZgGx0tbjXSJRf5EvAaZ\r\nAge: 1109460\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 2B99EDEF-8E74-4D49-A1BB-19E0B20ACD81\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6434,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"e31cb9f70abcc458288bb53868031352","sha1":"965f7cb9aaf0d166c21b8681b0671d17e019c74e","sha256":"33295ad776e1fde54dace5b0343c9aab9a2d70cfa8848e5cbd09065c340e294f","sha512":"acd328b1f4cb6e1c7267696487f637ea5ae4b724f7ab32516632a3eb2c8b4e374fa472ab77120230258fb49a23f54ba3988b155004b46e69519fe3ef57ee79c9","ssdeep":"192:RYc0QiGWn0WG2WmjNJMjOluoj/xrASMJmoJESULHT:RYc0QiGlHmjOo1j/xPMAG2Lz","tlshash":"c9d18ea6ea2a4a52cf8d0d633efc5b0671508e582f390826809a1d1d57767fa24a13e7","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-14T18:21:23.333527Z","times_seen":2232,"resource_available":false,"data":null}},"time_used":4821,"timings":{"blocked":4515,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/8fe89870-1081-42db-97b7-f8272ac29ae0.jpg","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:32.373Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/8fe89870-1081-42db-97b7-f8272ac29ae0.jpg HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:34 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hSYaeVQ08ak0CEdzxV8OBNrU5ycY8CXS1cCTqunWWJ%2Fg6VwZY%2FC1NnHcswyuWS9YH6ypcmnK0LtjVI0Lq8oIqHNFwbDxdBLMDFrXA4t3EV4BnMjIvCYIo23F%2Ffsq\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"d04176a6c26e72c117b0f85d0eba80c1\"\r\nLast-Modified: Mon, 25 Aug 2025 06:53:37 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 16159\r\ncf-cache-status: HIT\r\nCF-RAY: 9a7f4f9d2ee80540-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725554=9tILU5qlmfKwryxioowcE+FLXcwgmpYyFhaH7HXP07KNzQUcHECW0Mz2zbfqluseaatlMoYan5rIo0uSjiQuscGqKxMlLZDD2UE2MiPCskAPBjr0nABeZ7TfUQCz6gsoD7VTyiGOgjv1f1cRAwukP348YK+0Xd5CGVhKiy6WIT/Qd5yWJV7V9zTShTPM7A+G\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: A364E170-A677-407B-B9C0-678285C2D505\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":344312,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"d04176a6c26e72c117b0f85d0eba80c1","sha1":"7d91bf688b4db4aa7840e7363e4b6477af75a7be","sha256":"e9229d385904201a79e88ec20831ab928bb126770dbb4cfcb1869d0d086083d0","sha512":"7f2d4db766ad2cd9f7b56750aff6bc621d478e79004b13e6c9dd41672d2215f2a817c43ec2ffe7cf46227d92c8b73fc94319be24edc93433c7ccac535e6295d2","ssdeep":"6144:QLznFRjZ8DkK4VAJw9ZFDPGVuiuRpBK9ZnAEpTLpzuJt1wfb1iaPH2kUM:g3Wo3PYuz3q/zqwzdHdb","tlshash":"6b7422e83513ca884b2f8f7b14c42a4d6a8d2e10dceeb5e9b479bd475ec280c867d494","first_seen":"2025-08-29T11:05:53.255926Z","last_seen":"2025-12-29T12:28:25.270141Z","times_seen":343,"resource_available":false,"data":null}},"time_used":4111,"timings":{"blocked":2065,"dns":0,"connect":0,"send":0,"wait":511,"receive":1535,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/kc523-1/sponsor/sponsor_web_2.png?1756903280095","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.031Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_2.png?1756903280095 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 41033\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-a049\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725549=/hVpQNHfLaAcoXjZCNTD3ZDnYR8cYfq+YoSlktnj8vjV4yYEoNmYY0sKl65CWk9dh56Dl85PFjG7mrhMoZDvByy/GLY83hGvAKTjFaBL1ZoH+ejqwiyveU9JUw8qyMDteBKPL4KYudk6vsBAmQXX3V32d2e2abScXG4NnkM2M65b7NYaok48/b3a97O06i5p\r\nAge: 1109460\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: F837AF55-2F0D-4A59-983C-CE47602F02F8\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41033,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"66036fddf71ff69f45c146ca63883070","sha1":"4b3076a271d5042ef1b6cffc2ff49f421a819f08","sha256":"93c59a52fe04b0050dd4552a135177533afbe2dec54f10c516610b0dee857e0c","sha512":"29c2fc65e144e5d13c011e4897e0bdf771c7b4c249875eca4fa25589625696c71ec015e7e8ef3a5ee45f2a6ae9df3663da0bb736a6fb13c9628f0d0957827c71","ssdeep":"768:6eyNeN9huVfPKv0KhazApErcA6cFKSkS+pbTCx81TxUqIUgYWxDHc9wZGbYGniRl:6eXXh8KcQakywKK++tTCi6xD89HbxiD","tlshash":"b003f15c4c413e7777f19baae00ac84224d11fd4fdd5e3e61a8bc659a843a68bc2540e","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-14T18:21:22.942704Z","times_seen":2363,"resource_available":false,"data":null}},"time_used":1805,"timings":{"blocked":880,"dns":0,"connect":0,"send":0,"wait":309,"receive":616,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.996Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://y108p.xyz\r\nXign: Fzm/YqW/yC0n7NSUvr74dHrLwVwpYER1aQ1pT6w8cl8EJJAHLFxM7P5NsfzEkVWrPnDpVtNFYDbv0j7RWHIZWtzZF2IDywXY74B8oP6hOaaMNoH9zZoYw19XYos2p7V/iL8PDH/a+xGLyIaJgL6JvzT/WlCri9sp5SyCceqa7U0=\r\ntimestamp: 1764725548982\r\nsign: h59577g4172e5715\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: rEfAYkDGbEEF5yTzpkNZQfYMBdt5bAF3\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:29 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Wed, 03 Dec 2025 01:42:29 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725549=/hVpQNHfLaAcoXjZCNTD3ZDnYR8cYfq+YoSlktnj8vjV4yYEoNmYY0sKl65CWk9dh56Dl85PFjG7mrhMoZDvByy/GLY83hGvAKTjFaBL1ZoH+ejqwiyveU9JUw8qyMDteBKPL4KYudk6vsBAmQXX3V32d2e2abScXG4NnkM2M65b7NYaok48/b3a97O06i5p\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: C65AFA20-F96B-4DB3-A7DB-C2CC32021CAB\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6563,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"218a324fb8ba6b37b464afa09f7fdd87","sha1":"5c42ad3e84a8035b0ce17d95945fe7e7d6f31e1c","sha256":"4000a1d104faa165e34ecf2775eed6f541eca50901d02f40b62b0373287f477b","sha512":"637e1a72aaec60eb0fc86fa51cf4fe8f00844b1786333c76cabf19aac67e2873abc09f793d7aff19c75a5da517240121146263ecace66ac28fc84797b10206d8","ssdeep":"192:VW74MX5sJUN+HmDZQzX2020pUZfRza+yPFVNbmmvYh4aVNma/9HLVooM:cUMXAUoSe2kUZFxyPFVNVvy4ajmglVoD","tlshash":"66129f134204f782a1b7cab7ec2148c4358967f6bad6499eca94e7f60537242d70d4ce","first_seen":"2025-11-20T14:42:55.95119Z","last_seen":"2025-12-03T01:33:08.758011Z","times_seen":4,"resource_available":false,"data":null}},"time_used":746,"timings":{"blocked":299,"dns":0,"connect":0,"send":0,"wait":446,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/248c44a76208443caaf80ad51c42062f?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.435Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/248c44a76208443caaf80ad51c42062f?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 6908\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 5886\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"248c44a76208443caaf80ad51c42062f\"; filename*=utf-8''248c44a76208443caaf80ad51c42062f\r\ncontent-md5: cXkiCSlZVwFGt66f2/u9IQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FpJglywTthHf1zcUZyIgDRgD8Jv7\"\r\nlast-modified: Wed, 26 Nov 2025 20:07:45 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: tTzFV6nyC\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: EFkAAACnN4Avi30Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6908,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit colormap, non-interlaced","md5":"717922092959570146b7ae9fdbfbbd21","sha1":"9260972c13b611dfd737146722200d1803f09bfb","sha256":"5e20190673c49fce5c6797a0b33453f5680420415c2fb50c5dbd8b26b543e60b","sha512":"9607e7bd0f9bdbfc2f181ecb6200322a885d9c9a112944fd419b49bc3ffcaacc9ffb38bfa0cc29a794e9ee666fe2541625ad1dcf5538ea04df20420a25b9e7b0","ssdeep":"192:Bf9AMl9VwUaG8ce/2gDS1n4weCOvY8qf34:Bf9T9Vw1G8cGlW7hEYDfI","tlshash":"26e18e9c227f6cd8f2c81ab03fa1c5360121ed905599d7539ba6b6cf0dbef2e0262456","first_seen":"2025-02-26T15:38:27.678603Z","last_seen":"2026-04-26T00:17:34.090304Z","times_seen":15,"resource_available":false,"data":null}},"time_used":3673,"timings":{"blocked":1117,"dns":567,"connect":252,"send":0,"wait":1302,"receive":133,"ssl":300},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/a7e49dbc-140a-4c02-81cf-e55cd0108e5d.jpg","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.679Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/a7e49dbc-140a-4c02-81cf-e55cd0108e5d.jpg HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:32 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=StkqUmUc8UEsFAj27CmHhSsXfPnuGytU4mPe2RV%2BuoN2d2NuXOI%2FVFQIyrr%2FCAISmf2QwvShOXcJjDD5MXxiqE4YMu8xJYFUUo92I4qFsXCx0cyKnMayBFV87IOo\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"f42e0fcaaf4b3dd132c5b52a7fa29773\"\r\nLast-Modified: Mon, 25 Aug 2025 10:01:09 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 15976\r\ncf-cache-status: HIT\r\nCF-RAY: 9a7f4f90599709f0-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725552=+hxA24sti7lqYYqupQnW9OdDveGHfM+yVXFNWLeNWVHbkZszbu4mHTohUTANLRNSQpC+on1scArJrHSuZR0EnNfSuCrQewLq1ZciobqdoGYLlt4BzR9bC9ZqEJokSjjy7X1RgRKhXeWPUwgVQIwdg9fSdElkJRYx7lyRsFydDCX7EZgGx0tbjXSJRf5EvAaZ\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: A1700859-1B9B-4F1A-BF9F-A431618200DD\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":221858,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 540x650, components 3","md5":"f42e0fcaaf4b3dd132c5b52a7fa29773","sha1":"23412150020e5af9888e58038f823dba9073027d","sha256":"1f0221df43cc57f4baa91484c6d4d1eb8374623bb21dafd74c526f95942153f5","sha512":"716a4b79708b5efc807da4f3f4554531c044db894cab68e14b5854fdf342d363fa588fa4fbb045b3b729b06e7f8df9a1619183277f6f90228c2419ab7f48c9a8","ssdeep":"6144:DtRn09SU2N018YMl2/LwukXqlZU06QX3H0x:D09SXN01XN+ql+0pUx","tlshash":"8a24129423536cd1fcaedae079d87a0b3a5626fc90fff44386144a81635ebbc618171e","first_seen":"2025-08-29T11:05:53.340749Z","last_seen":"2026-03-18T12:35:39.054225Z","times_seen":1134,"resource_available":false,"data":null}},"time_used":3227,"timings":{"blocked":1679,"dns":0,"connect":0,"send":0,"wait":543,"receive":1005,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/left.34013cd8.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.157Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/left.34013cd8.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://y108p.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 237\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nETag: \"68b83893-ed\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725550=EnwJxt5GEWZDoy2zM7O5VXjcyuKd9QeUQschlibf8N338Aywly3eO288QFLQVHJlDyo0pDjxpxgKkpZBHYec+tXMDURhFCbrUPeFgavax+z0IHuK0xhcuNPttVS5GyOXCrGmvQfb7udRo95bcQln5pJocaMrGFQivBnHGp5AthjDtr2jbX9R+GmiXuhzQg6n\r\nAge: 1109457\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: E8795182-5AAD-4CC6-A001-1A4D85DD251C\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":237,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 14 x 44, 8-bit colormap, non-interlaced","md5":"5ecca260da6fc5e2843405c20ac69817","sha1":"3918cfad7493b6860ded9e259ba90bc6a853f1b1","sha256":"078a4aac39c49a33cbabf23cda7579fa7b76e875e6b6d24d16cfcbf9f8b250df","sha512":"b76a870a79a87a450e5d30a218d75093b57415c563e64a8ffd6839a31b36379dbc08398698b9c1368ecda671d65045d5cfebe3363b98d746d89dcaad15bcd8ce","ssdeep":"","tlshash":"6dd0a99be2076faed1c70bb3732e0ca18a8124e892944b088042c622ca663a1dd82042","first_seen":"2025-08-29T11:05:53.221032Z","last_seen":"2026-08-15T19:18:34.48162Z","times_seen":2640,"resource_available":false,"data":null}},"time_used":2589,"timings":{"blocked":2278,"dns":0,"connect":0,"send":0,"wait":311,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/license.ea57c78d.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.165Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/license.ea57c78d.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:33 GMT\r\nContent-Type: image/png\r\nContent-Length: 1976\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-7b8\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725553=FS6tYjKh1M+gSmmjCJc7Z5ItrAI5uLtwq1ey+8G7hLKPEt2q0r/meEfJ/8cV8j9e63TaT2ebLNzsT2vLgNVjhogT5H32RN5gJMZnna7ohuq71psenX2MCWWvVWWDwpqniEmr0zYChgtCACgnZEUzjgk1DDYgAenPeOBM1Y+Fa3resLtB1I3RbJPLpvzCgg7d\r\nAge: 1109459\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 09B861A2-5D9F-4386-9CAC-A46C915C6073\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1976,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 161 x 52, 4-bit colormap, non-interlaced","md5":"60a2c7c150b01809fbb7b97932684b5b","sha1":"67fc9647c452a17b519c6a51dc8c38daa23755f9","sha256":"c5ce31558a1f979ae78c7779d2f312b196750375541e9c147b73d6e44d47c276","sha512":"2328442fa1c74e47c6eff4adab55920c7e7738e7ae51bd2b222fb696bbcf8201a14805089a33baa80c28a40db47061048d817c384bd72735b2e0c0116ff63c6f","ssdeep":"","tlshash":"b3412a6266729beced1a8c47592c7df1d8338ca1a200e1c150ed761f1bf8e1060e7a94","first_seen":"2025-08-29T11:05:53.23289Z","last_seen":"2026-08-15T19:18:34.464298Z","times_seen":2502,"resource_available":false,"data":null}},"time_used":5101,"timings":{"blocked":4795,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/kc523-1/noData/cms_moren.png?1756903280095","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.185Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /kc523-1/noData/cms_moren.png?1756903280095 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 19732\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-4d14\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725552=+hxA24sti7lqYYqupQnW9OdDveGHfM+yVXFNWLeNWVHbkZszbu4mHTohUTANLRNSQpC+on1scArJrHSuZR0EnNfSuCrQewLq1ZciobqdoGYLlt4BzR9bC9ZqEJokSjjy7X1RgRKhXeWPUwgVQIwdg9fSdElkJRYx7lyRsFydDCX7EZgGx0tbjXSJRf5EvAaZ\r\nAge: 1109459\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 743794CB-E933-4E6E-9601-1254CCE4E491\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19732,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 215 x 214, 8-bit/color RGBA, non-interlaced","md5":"f3c825751a70d4aad8da2ce57f76acf6","sha1":"732da443668abb03a79a70df2d0ea8d801158655","sha256":"c395f4c1941459ef620f6df95fabd39f9ac98e03f6a389886bf224157557ce41","sha512":"a3b3fa2a216c10d331fea4771b916825d0605b94e21ac242d152d7c5e4b984cf3baad7a3fd071dde3432162037514d756cce1a0f699baf3dc98eaf75483c91b0","ssdeep":"384:64pTwcIHFqFpIlD8SqhwFLW/na2PvyQXSOKvOi58KUezsTT5ZOon:67XlROe8WvOAPHQv","tlshash":"a592d0d8abcb6705bb132b43b941a3558e0dfd6a130b9bb131782805ee16151e8d7e3f","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-14T18:21:23.247137Z","times_seen":2276,"resource_available":false,"data":null}},"time_used":4469,"timings":{"blocked":4162,"dns":0,"connect":0,"send":0,"wait":306,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-03T01:32:19.716Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:21 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: public, s-maxage=600, max-age=0\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725541=pk0PFKpmbawWeBIbVoOKDDMrvldrlsez23xI//cP2jgBEbj6KUadRpCa8sronA+fpZpdrYEU9iyTjQ+G7WXxUkwQmGdrLu87cTyaDtvF0R/Offv+fejO3sIM11Ua8nb7MgxWgzAZ0a3px9OFJVmNd71TcQRGzzLbX2CxcaJeXtXITTo0QmDUzfYy7w0RFJkq\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: 032B0397-4A98-484F-8FA7-D1F29FC1AEEC\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23624,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5777)","md5":"87588e90bb24e209460bdbf1bcbcc074","sha1":"f3c57be16a0eaf6879f3469c6a2db7720a699832","sha256":"61ed38427305a473065294efb15ef101340cf9d3e19be35a6c6c86083698c328","sha512":"160c240e67f56096c7c519eeb5b11bd9fcac971ffbdaecd231be6aaba4f98a1dbf5f44a22c0edfbe64860e3039a11eba5be0eb13802c82e7033543d7891a8e51","ssdeep":"384:kR7B3v2VwiYwJvSoVXsp+pa/iZcVk97g6nMusplliz:kRdviNYiKop/E6wkpcu2lUz","tlshash":"9eb2292e8df349762523703a2bbfb208797180134309ed803e4de7584fd59aa46e7bd6","first_seen":"2025-09-04T00:49:32.720758Z","last_seen":"2025-12-29T13:58:58.052747Z","times_seen":445,"resource_available":false,"data":null}},"time_used":2578,"timings":{"blocked":984,"dns":373,"connect":302,"send":0,"wait":455,"receive":148,"ssl":313},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/css/61540.1756903329400.030a612e.css","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:21.481Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /css/61540.1756903329400.030a612e.css HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:22 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-59bbc\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725542=loAbgkj7GWx6iuZXUN8803wwHCF2tcMiMPh1K7jiPjw2nzUlPXgFYYntt8C+o4c+kP/Y4dl7q9hVWiVkghxclK2NAsYhlm3zqfjmYBpmPvKu4hGiLNJj950jQhd14O3ngI/kl/k50Yt97j9KKa34EbrRrMuA+on1Hbi/xHiRzaWydUSjJaRMKnKVKJhV4Try\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 0374BF1D-C0E2-4947-827D-567CFABAF11C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":367548,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"ab44c516a5aa84faae3bbf2852ebc655","sha1":"ef60c256d0028ecec909ffd9895ea2e63c1d1f1b","sha256":"456781f16fd25de012286211ad4b06e5ce32d9dfc9fb28a2364d80f76a2994ea","sha512":"4e214b9fc84d1e3b914c9bd025947162323db0251c704c668fafbbf226e604899d9d8d21e2f8b3b401ddb966981ba0edc97cc87c6ddd3eef29aab80010446656","ssdeep":"6144:z4+4r0H8Tu4+4r5cRlGuEQUQ929scKGnpTPIlyJ:z4+4ZTu4+4FKLlyJ","tlshash":"de74fa7caf1030ae15a7cb27b660f5589c36a443f9bfde9af3a53d580789a510623c13","first_seen":"2025-08-16T16:35:14.576567Z","last_seen":"2025-12-29T13:58:58.009689Z","times_seen":607,"resource_available":false,"data":null}},"time_used":3930,"timings":{"blocked":607,"dns":1,"connect":305,"send":0,"wait":610,"receive":2089,"ssl":315},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/chunk-init.1756903329400.f53cb96a.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:21.489Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/chunk-init.1756903329400.f53cb96a.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:22 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-42aa8\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725542=loAbgkj7GWx6iuZXUN8803wwHCF2tcMiMPh1K7jiPjw2nzUlPXgFYYntt8C+o4c+kP/Y4dl7q9hVWiVkghxclK2NAsYhlm3zqfjmYBpmPvKu4hGiLNJj950jQhd14O3ngI/kl/k50Yt97j9KKa34EbrRrMuA+on1Hbi/xHiRzaWydUSjJaRMKnKVKJhV4Try\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: 9D96B9DB-AA81-4661-BB57-CF8805B9546E\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":273064,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (44101)","md5":"daffbf99400a4f119f452d48a10ea62a","sha1":"0ae2d45d2befd0f11ae9373195c409f491a511d9","sha256":"1dcfbbb596d333e200aa1b0e4e282c296f29bfafdee19ff4014fad30a394ae45","sha512":"8e39ce35d7f18deb579cf03330a935e18308541617b1a265e4d7f88480b4d29608598e6d2be86328106fa64c4d707e608f333319bd1e7627df53a0170de079fa","ssdeep":"3072:etwqhOIKENB85doKa/x5wc0dB5/J+UUknCqdnr4QMA/C:HENm5ox2Br+2nCjXz","tlshash":"ea441b98b3d171b846cb53e5622b1035f6ba1ca33098e4f0d219ea547f3168dd52eeec","first_seen":"2025-09-04T00:49:32.986263Z","last_seen":"2025-12-29T13:58:58.044472Z","times_seen":443,"resource_available":true,"data":null}},"time_used":1293,"timings":{"blocked":415,"dns":0,"connect":0,"send":0,"wait":573,"receive":305,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/index-a3dad144.1756903329400.268893b8.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:21.497Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/index-a3dad144.1756903329400.268893b8.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:24 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-551ed\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725544=qUQEP8SNYPTGOqrcZx6Dtd4Jed1q+9haGbuQqFtaJYiTmhLqOkXAcWFVmV4rrX1x9NTL2pweDaExL8o8r0aif/AN3jKc6T1Gs9EWk9625NhGGo5IUCcgEH+baY4vQXKFuWHAEjloy/Ka5vmsirI3m3axmdakL2OX9yVI469rp3IUqp3QDYkavuef+a8JHKvR\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: F21EC6AF-DACE-47C9-821A-AFA877E5768F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":348653,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64496), with no line terminators","md5":"48f61a636d7f79d9ade92c74c95d6dc9","sha1":"b28e5dfd9ae56db9a9e09cd911318e54cf6358f8","sha256":"e2722fd1fdfe28bcbb6351cbdef04bd13957f1f02bf95aa6a3ecbf8a70538ade","sha512":"fcb76e78abe18d032e1d374c81854731d95a3beaf98ed39bb9f528b6a2992b571f3aa325c4cb455e2d876d2aa4f9ebb863d8a1e8797ecaa0f89bb4f8d693590c","ssdeep":"6144:G4InKyBbhFOuyKO0VPoJBR58n3inyHpZolRlM1z9f7ZwTl0A+:izc90VPoJBR58n3inyHpV1z9ftM+","tlshash":"7f743b94f76cf1bd874e55fe793290a4902c1b41a0c89d58d29e2944ff6b385eeb08bc","first_seen":"2025-10-01T19:35:49.983914Z","last_seen":"2025-12-03T01:33:08.768223Z","times_seen":2,"resource_available":false,"data":null}},"time_used":5616,"timings":{"blocked":2654,"dns":0,"connect":0,"send":0,"wait":807,"receive":2155,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/kc523-1/noData/cms_game_noimg.png?1756903280095","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.261Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /kc523-1/noData/cms_game_noimg.png?1756903280095 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:33 GMT\r\nContent-Type: image/png\r\nContent-Length: 4977\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1371\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725553=FS6tYjKh1M+gSmmjCJc7Z5ItrAI5uLtwq1ey+8G7hLKPEt2q0r/meEfJ/8cV8j9e63TaT2ebLNzsT2vLgNVjhogT5H32RN5gJMZnna7ohuq71psenX2MCWWvVWWDwpqniEmr0zYChgtCACgnZEUzjgk1DDYgAenPeOBM1Y+Fa3resLtB1I3RbJPLpvzCgg7d\r\nAge: 1109451\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: B8EA8143-FA23-4801-902F-BACBF57010DE\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4977,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 750 x 590, 8-bit/color RGBA, non-interlaced","md5":"84170735ffce6fe0e70a3136a36b8ef6","sha1":"5b2dcf1d5d92d786f1e58dc65de3dab1f35d7278","sha256":"581435520cde2b0026b4e7244a85b6eef0be740cb18c43690c420d1ec326d0b4","sha512":"bb0fc1b267c99db65ff3b9414576d3f4c0c9016e5309f2806a9f4d51c8c63383e9279c3a04daa5feda5489eb231a846b60040c71e5fa2798ca141b36ae0241f6","ssdeep":"96:nKdKn+AFdoSfrmrMDpdXd8nbZDH3mC+b2A:KYn+QK+pdXd8nbZ73mC1A","tlshash":"99a14be32b5d4badfe1e9a76a5549760ea632aff482c8c0e6887c955048b2144f640d2","first_seen":"2023-05-01T02:34:20Z","last_seen":"2026-08-02T09:02:15.179219Z","times_seen":2038,"resource_available":false,"data":null}},"time_used":3619,"timings":{"blocked":3313,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/sports.60212fd6.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.153Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/sports.60212fd6.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 116532\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-1c734\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725550=EnwJxt5GEWZDoy2zM7O5VXjcyuKd9QeUQschlibf8N338Aywly3eO288QFLQVHJlDyo0pDjxpxgKkpZBHYec+tXMDURhFCbrUPeFgavax+z0IHuK0xhcuNPttVS5GyOXCrGmvQfb7udRo95bcQln5pJocaMrGFQivBnHGp5AthjDtr2jbX9R+GmiXuhzQg6n\r\nAge: 1115074\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: 918AF29C-F6AF-4C6C-A0C0-0CCB98873B62\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":116532,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 666 x 541, 8-bit colormap, non-interlaced","md5":"fc82aa907334f929011fc2a6ec906f55","sha1":"f76bd75b9d1235807c70c7d763a1865d7c3f8d4e","sha256":"2ae1d61176960d7ddfddcb30a69d22b9da893687370d8cd26f4917d129a1bf3b","sha512":"12ef7a828d7d4228596b0db0ad77b200e8ffcfe2457d12821a4e9778b62668ebeef075c2bc79076e36291e3015afbfe276a2ca230ead018b38e2d3fd803dd31f","ssdeep":"3072:/ZEgiWqpGRwEyiwX0wgOZzbKoSxNiSvrUeO4h:/ZLf/R2iVwgAKoSPiSvVOy","tlshash":"76b3021c79775a2083c6bcb40b583aeae09b3dc19d169808d68b7791993df43c970bed","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-15T19:18:34.448995Z","times_seen":2727,"resource_available":false,"data":null}},"time_used":2859,"timings":{"blocked":2251,"dns":0,"connect":0,"send":0,"wait":303,"receive":305,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/adea5196b2ec46419e3cecb019e6bfc4?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.560Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/adea5196b2ec46419e3cecb019e6bfc4?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 20930\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1948\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"adea5196b2ec46419e3cecb019e6bfc4\"; filename*=utf-8''adea5196b2ec46419e3cecb019e6bfc4\r\ncontent-md5: GRW2vq/G4Yvjui4XH6HV+Q==\r\ncontent-transfer-encoding: binary\r\netag: \"FrIvx8BTengQrZWGlmvBBdpQwW2j\"\r\nlast-modified: Mon, 01 Dec 2025 12:41:43 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: qkUhwbMZI\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: -gMAAADZgn3Ejn0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20930,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"1915b6beafc6e18be3ba2e171fa1d5f9","sha1":"b22fc7c0537a7810ad9586966bc105da50c16da3","sha256":"05bd6425b657ad0327b886c680918756e47981141220cdd082eaff31adb32881","sha512":"b86130366a1a1b800b410ec90994a2827cd5a98564137e6bf6040fc86545dd203998770295c3bde6c5ef66733b072f18470cbb472c5d312074cc236bb1e4b0a0","ssdeep":"384:g2Cysq6ZvgvI7IMsSXNR42b2LZUcuqSI7INnA6Pwv2oK:pMh7bZdR4q2ac/SIMNnA6PW2T","tlshash":"ae92e1694114f0d00abe87bbb90e2340763adc5c1bfe4e532ad06db5161ca5b54e1fec","first_seen":"2025-02-04T17:13:01.023819Z","last_seen":"2026-08-10T01:11:53.649476Z","times_seen":356,"resource_available":false,"data":null}},"time_used":2661,"timings":{"blocked":986,"dns":0,"connect":0,"send":0,"wait":1307,"receive":368,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/e3545262b5924064bcdad18fbb327565?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.563Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/e3545262b5924064bcdad18fbb327565?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 11243\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 87\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"e3545262b5924064bcdad18fbb327565\"; filename*=utf-8''e3545262b5924064bcdad18fbb327565\r\ncontent-md5: ZQn5EEDCv9elJKuH2fg2iA==\r\ncontent-transfer-encoding: binary\r\netag: \"FvdNIH8a9mz5LMLKYyf-gypt1v_4\"\r\nlast-modified: Wed, 03 Dec 2025 01:29:05 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: EQRu8K965\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: T4IAAABsl9N1kH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11243,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3","md5":"6509f91040c2bfd7a524ab87d9f83688","sha1":"f74d207f1af66cf92cc2ca6327fe832a6dd6fff8","sha256":"3d87eed18e60efcebdcb7290bc23c601d387b5e3c8f34e74a1e84f5ca0558ffd","sha512":"b377eddf76403b8d18088f83b71d7d395ac66131a1c1f6dcb46cff493c43f28127fd776404e0a6b48e8dad0206464c49ea2e523f9431c3ec0a573afdcfd3fb23","ssdeep":"192:5Mpk3+zNbq1WitF5PgrEc9EUjbR8x1lca3iZr3JSv5Iu7YgamjyOFB5EsdIJ:5MpD1k+gGR8RcQiZbIRIo/FBbdE","tlshash":"58328c295e667e4cdf0fd52390ebd375f291093a7134e102698c29cb2e706dbaaad314","first_seen":"2025-12-03T01:33:08.774147Z","last_seen":"2025-12-03T01:37:40.730494Z","times_seen":8,"resource_available":false,"data":null}},"time_used":2678,"timings":{"blocked":983,"dns":0,"connect":0,"send":0,"wait":1307,"receive":388,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/home-bg.1e09954b.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.569Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/home-bg.1e09954b.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://y108p.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 4014\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-fae\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725551=Tl57i2AA5msYKmQD6D9b96oj05vzNG1l1CRjWQNFDIl0/XOB91wmnNIuwbzcvYLLX/+8PfesGrw5GUIZPSgoLImPW3qb6JVtL/D3VFmUZJ2JOKFTQEmo6Emj7kqSzJVgZ3YR6VcZAjkG+nzNcBKE087eIDc4XsCyYhU4Om61Apb3ZxYss03gNL9y0YZ3YnNG\r\nAge: 1109449\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 9458F248-0978-4C84-9CD7-408098C25ED9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4014,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 278 x 80, 8-bit colormap, non-interlaced","md5":"ed0eb6c81f949885511fbbe4d666a2f0","sha1":"d74fb98c3b01727753bb182eb5ee5d6eedf3da4a","sha256":"7fecf4ed61ab1535aafe2800474ac643b49264b83f54fc1da596d7334868ae75","sha512":"dd2f749e24e6b35f80fa77856c9c8b1cb1e0cacb9250b947403283e152d8bb9e7bf539df00ca6743d4162aeac014e47ce82191b62847fabe6cbb5693b4cd7fec","ssdeep":"","tlshash":"1a816c7eb31a4997296ff194138b387d74b0709d0b546934388a9c31a4791fcf39e526","first_seen":"2025-08-29T11:05:53.155399Z","last_seen":"2026-08-14T14:48:35.145131Z","times_seen":2360,"resource_available":false,"data":null}},"time_used":1471,"timings":{"blocked":1165,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/kc523-1/download/download_nav.png?1756903280095","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:32.658Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /kc523-1/download/download_nav.png?1756903280095 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:34 GMT\r\nContent-Type: image/png\r\nContent-Length: 180314\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-2c05a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725554=9tILU5qlmfKwryxioowcE+FLXcwgmpYyFhaH7HXP07KNzQUcHECW0Mz2zbfqluseaatlMoYan5rIo0uSjiQuscGqKxMlLZDD2UE2MiPCskAPBjr0nABeZ7TfUQCz6gsoD7VTyiGOgjv1f1cRAwukP348YK+0Xd5CGVhKiy6WIT/Qd5yWJV7V9zTShTPM7A+G\r\nAge: 1109454\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 74CA9B08-C212-4F91-9CAA-DFD3C06888C0\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":180314,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 820 x 600, 8-bit colormap, non-interlaced","md5":"87eaffe415a7eb41b7b4b8a868bb3b32","sha1":"575618003efbf8dc8ea781379aeff463cd0cc498","sha256":"4264138e0c015e52e3efa14e34ce9c52490316935b4667756ea631b96eca64dd","sha512":"2b06fbacffed6de2fb1d4a6db2cbd0d9c5c790f9b5a10a6dceac64ff69d300f20628c465a720102da9bd857c80be886ab0a37848929741d2bdef6eddbe0de8bf","ssdeep":"3072:iWlCRQlVF5aSW/mUdJSu3405ovKFzkRKcZjF9Km/mKg/hPFsQBhXRU0K:iWM2I405oCRncZHL/mKWBhXRU0K","tlshash":"0f0412cc23773ffbf8a0865a83fbc1599c3bfd0824e56722ea1662b5186053145a59cb","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-14T18:21:23.214078Z","times_seen":2036,"resource_available":false,"data":null}},"time_used":2441,"timings":{"blocked":1815,"dns":0,"connect":0,"send":0,"wait":312,"receive":314,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size704x442_73525908-fb7b-43df-ab6b-ee9a1274a74c.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.915Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size704x442_73525908-fb7b-43df-ab6b-ee9a1274a74c.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:36 GMT\r\nContent-Type: image/png\r\nContent-Length: 223136\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WzyRDNxwowkxlLVV5phxMG9VO1lW9Fm9DW6hq59HnDAyis71x1tLpiWxvf3r0eLuk4ESI%2BIpQBOSFcw84%2Ff%2B9F0XaZ5X2tGsY0Yi3NbwbqpkXoYSEkBXlf6X7WkL\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"da3b1020a9a2b09010b291184754a369\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:13 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109438\r\ncf-cache-status: HIT\r\nCF-RAY: 9a1581c3292eddc9-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725556=nR/u3ECZA5pQyCeLNXKPPYGpEcWyonqlfq3mAiuMymQj5zr4wRh2qM9R9UxzUohkKR01hX/ndr/g/wR59lQ5vhpR/H5Bt1Czjn+hfojNM65TJ9v9PjehSVgkDNCv8lQuruu6rSlWsgjkYPX2yNHZouFuQM1WVRIkqrC7+hzmacrgeFG19om9k1GtoWuQ6fTQ\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: F8C60CD8-905A-498A-866F-5602BCA488AE\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":223136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 704 x 442, 8-bit/color RGBA, non-interlaced","md5":"da3b1020a9a2b09010b291184754a369","sha1":"c2d83f8c56c6e87dece5c934a28ca227ae094d48","sha256":"14b50178eb3b3f008b02476fee254dfaacb43181b760be8d3a1c7e5ff5401dd4","sha512":"3eeae26ae8746f3dd69d1640b0a791149692ef83b86997d98f0152f98376e931637a574bd82110c7765be51f0184bc8e33c9d04659f510d51c47b1bcc7be2059","ssdeep":"3072:c7iZjMzh8mXTYQ/tDoXB0TX8jLwAqw6Gw/mS5xr4OMWf8SG4DcXtHRpf7JeOrrUS:miZjMzh8mX02lo28vwAqVGoxreZHfl","tlshash":"80242397c71e3ebfe8a25c53b962143e66328042ba0dd4f85cdd14b6b12b1f50ca8d5e","first_seen":"2025-08-29T11:05:53.247777Z","last_seen":"2025-12-29T13:58:58.050217Z","times_seen":297,"resource_available":false,"data":null}},"time_used":4027,"timings":{"blocked":2794,"dns":0,"connect":0,"send":0,"wait":309,"receive":924,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_04beb05f-bdcc-4bf4-a35f-b560e45e45b0.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.943Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_04beb05f-bdcc-4bf4-a35f-b560e45e45b0.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:37 GMT\r\nContent-Type: image/png\r\nContent-Length: 108004\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EoESyVbuZmQ50WKV%2FervPcOK39%2F43NPUg8GgjPILFHPMqKpwc%2FQkPIheaa5mUFg1K%2BFyMr1aZQmsX1T%2FLtCNl7hX1gyfDR2o9lMxF27k5mXcH3502TyHU0zN%2FRZs\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"a3775875c9308eaccad9d436837da5ce\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:24 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109446\r\ncf-cache-status: HIT\r\nCF-RAY: 9a1581988b910dc3-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725557=scDVPKsbbAvx99LhIgALuOPSdX6xYY3HutBVudy+Q6HpGDBo5Z8Q2MjTgtiiiMRdMqGW7aug6JpNd55oNOni2BSumL5UI/LYwxuuMVJR3+2BO5rdD/DWiwrepZlKKf4ZjTsDUmRXj9vcCn+dNQYwChw2JyHAehyMDmkgxABV5TLoR6AGNQqjIYRKXNMCVGfp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 4E539101-E897-4EF6-8367-0FF2BC6771D4\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":108004,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"a3775875c9308eaccad9d436837da5ce","sha1":"f2cb91db0d4dfcaa7edcca96a05c75a001a37946","sha256":"de09df318c409253c016871cf0e9980c44b5cea2e4cfa6317d143a5a555953e5","sha512":"b3d098e269124f5eccfed2bbb054509c497cae3137f7883ee1cd11a4ef1aafd69cc14d1f7c832d9c02b702c0a7977263bd9b579158d64ac115fdbf1b7395accc","ssdeep":"1536:ybmCxBbtKe/h/N267ElA+7YePfJ1LrToGovotEpjB2G5zrk7mJWfz5b49rCqp:yXxHt/X26Ir7Y41rpPWkGiPfNbErCK","tlshash":"b1b31205563a0cfee4eb2531451db7c3dfcf9925a60328b57052ba4a31f9b83a6b7c18","first_seen":"2025-08-29T11:05:53.200832Z","last_seen":"2025-12-29T08:12:31.315831Z","times_seen":300,"resource_available":false,"data":null}},"time_used":4383,"timings":{"blocked":3770,"dns":0,"connect":0,"send":0,"wait":306,"receive":307,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/13575.1756903329400.cda1d494.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:21.494Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/13575.1756903329400.cda1d494.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:23 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-2f96c\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725543=61dmuydCWjCzLQU2zCyJxGo2a3J+yabvxh1wEcdz1uVIb3ct2y5Grk6xFzIZ4BcICGVwXzubEd7bpcqUIllxGgVZszq3wkQqeZZA9cbwHg8FJbA3rVT+nLWfIchJ7Ophsi3H5yrbVneU4KpjYpVRIIrNzxqyrfyuQ9/+U0Zdqa7EcU1GDjMlPzHLGc5y8IhR\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: 6D449DA6-5FBC-4FC7-923A-DF67827175E9\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":194924,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"60a85822cef01147878bbad7876a1fe8","sha1":"94563a78fcb76c76cce769d2fc4021baf782c844","sha256":"5b0a33a268e1507f5e758833c854e3cda700d19c35357e4a2098263a80da8892","sha512":"c23f2184349d611d1c54c379a0aa29d9564ea4b76b44c049647f0caf9e5b9dfd809c87eb9fa94c58377df9a9540580d0920802784fe9f485380985f36eaa4a5b","ssdeep":"3072:z7jHoKRKphCnDgJoec+IDWIzls+7Xr0X7:sKRBgUPDWCW7","tlshash":"42141a84764170b8c396a165322f601ae22f789650dd9c24f3789ba47f7470df26fabc","first_seen":"2025-09-04T00:49:32.754298Z","last_seen":"2025-12-29T13:58:57.972807Z","times_seen":438,"resource_available":true,"data":null}},"time_used":2511,"timings":{"blocked":1816,"dns":0,"connect":0,"send":0,"wait":659,"receive":36,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/chunk-common.1756903329400.8e9f70b3.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:21.490Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/chunk-common.1756903329400.8e9f70b3.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:22 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-26f1c\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725542=loAbgkj7GWx6iuZXUN8803wwHCF2tcMiMPh1K7jiPjw2nzUlPXgFYYntt8C+o4c+kP/Y4dl7q9hVWiVkghxclK2NAsYhlm3zqfjmYBpmPvKu4hGiLNJj950jQhd14O3ngI/kl/k50Yt97j9KKa34EbrRrMuA+on1Hbi/xHiRzaWydUSjJaRMKnKVKJhV4Try\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: FD26F373-A30A-487E-A01E-D5CE4B155AEE\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":159516,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"1b35e779a9012cf73988d1d4b0d9e5f2","sha1":"c139c75aed4b303657e5a48a1fb036d7fcec6533","sha256":"9231e7c73c53eeebd2a055dc9c7402342f21053dbbbdd257be62eaf29c98fafa","sha512":"53ab4c8aaf4fb2bd81c55c7356348b96d509ee4f2a91869043061c8b6ffac404ce76a6ca57caddd47e94dfa5e821a3e6a85c969cc94675fe8625cf44d689c05d","ssdeep":"1536:6ZVB2bNNcdWUc2UTC6oryXHuLmbErF/G7D1dMI5MHLui7TAN/voVG5glVbGD3tFZ:6ZVBM/TC6yjFecHLui7T4/voVG5agD3t","tlshash":"73f3e8c5b3a0f07e9a1ed53779331499b12f758274c87c60f1a1ada6bf19708a436ca8","first_seen":"2025-09-04T00:49:32.82259Z","last_seen":"2025-12-29T13:58:58.058135Z","times_seen":438,"resource_available":true,"data":null}},"time_used":3246,"timings":{"blocked":989,"dns":0,"connect":0,"send":0,"wait":484,"receive":1773,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/kc523-1/sponsor/sponsor_nav_web_3.png?1756903280095","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.141Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_3.png?1756903280095 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 7412\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1cf4\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725552=+hxA24sti7lqYYqupQnW9OdDveGHfM+yVXFNWLeNWVHbkZszbu4mHTohUTANLRNSQpC+on1scArJrHSuZR0EnNfSuCrQewLq1ZciobqdoGYLlt4BzR9bC9ZqEJokSjjy7X1RgRKhXeWPUwgVQIwdg9fSdElkJRYx7lyRsFydDCX7EZgGx0tbjXSJRf5EvAaZ\r\nAge: 1109460\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 5D5FDB1A-3004-4FD2-9C66-A40BF9A22A4A\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7412,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"eb94a297c215863d5d2232eaa67f4779","sha1":"d006f382f63ada4e4ef65d124a75eac2e4e72dd0","sha256":"6bd46b617bf27cb28fb798d50b2d6daa2aaed1a278ed50e9aa549b6e4fac48c3","sha512":"dc7759393acb5e7d1a635b4d91d73e84abc41fe6afde99a85a8e4ed6f4f8b1b5819bbcaa80b1c213c00c89df8b81db512a7bff142b24c50565ff1e6289f1a30c","ssdeep":"192:Sfq39wgHGYB1fcUWobKUUR6IHaDmzDxfbTow:uQ9gCEUWoWUe6DeJQw","tlshash":"94e1ad76a7f6d695a6b7908cfece94050fbba2722c6352762b7b8c02170c339525b411","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-14T18:21:23.054931Z","times_seen":2235,"resource_available":false,"data":null}},"time_used":4869,"timings":{"blocked":4578,"dns":0,"connect":0,"send":0,"wait":291,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/ecb/8f83064249b06e0660afdb30b60772fdcdfbb3036f","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:29.005Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /ecb/8f83064249b06e0660afdb30b60772fdcdfbb3036f HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://y108p.xyz\r\nXign: xCrwdWqKvW5X7BTPhkg8C/7q7PDg76vAgKPxQeZv+F4qPqsTgHAteJ/6W7W4V+WtbsU8TNz4e6UJrSxKbEUjudUa9XwFnsOFrOY+TjLC6hcKPOzVT7ap1EOE3fSpuXLLpf3Q/BSXnDJjtnmxu/aoJx237hRvPiMB2TCQbBWfbAM=\r\ntimestamp: 1764725548982\r\nsign: j3f3u7tn4a4o2o2f\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: rEfAYkDGbEEF5yTzpkNZQfYMBdt5bAF3\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:30 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Wed, 03 Dec 2025 01:42:30 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725550=EnwJxt5GEWZDoy2zM7O5VXjcyuKd9QeUQschlibf8N338Aywly3eO288QFLQVHJlDyo0pDjxpxgKkpZBHYec+tXMDURhFCbrUPeFgavax+z0IHuK0xhcuNPttVS5GyOXCrGmvQfb7udRo95bcQln5pJocaMrGFQivBnHGp5AthjDtr2jbX9R+GmiXuhzQg6n\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 4BCDB48E-D85C-4FCB-B4D4-723D3D1CF852\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3828,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"647935cd2e2223dd5ff94d1bf5bffe2a","sha1":"04f589be739414ffde22af46e4e3ea90177ab40e","sha256":"b086610b08ce52ffda1007e40892ac6bbfd8b3dc4160981791994ba4d56b4095","sha512":"8dd599b3d9ed74be8ca9fb0cb9a5c6ff33eb091833e37ae8fdbbee6bf2cef3b06a3c9d632c76c2e087245b743ae4814cee3647c81b74b99ebbb1a275674d825a","ssdeep":"96:eOG3iMFIo+Ut+WuQiHcSssJ1OIHOC2eLiyxtxbaUhfchDsjdnOXVXdxEs3uJ8jc:VL0Vuz85sJZOCxxtxba35UN2dF3ij","tlshash":"21c17a08f6a4b7949b4643fa74d615e9921f18bba28b6d7dc7f4837b0447a02835e308","first_seen":"2025-11-20T14:42:56.067007Z","last_seen":"2025-12-03T01:33:08.782126Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1437,"timings":{"blocked":831,"dns":0,"connect":0,"send":0,"wait":605,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/ce88afbb851348e58babf5d95813a1de?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.551Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/ce88afbb851348e58babf5d95813a1de?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 12577\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 10936\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"ce88afbb851348e58babf5d95813a1de\"; filename*=utf-8''ce88afbb851348e58babf5d95813a1de\r\ncontent-md5: y+lQxuK0Hha7Sbyu+Ew2+w==\r\ncontent-transfer-encoding: binary\r\netag: \"FhYGB4LMSu8RjVcchee10gQAtO6o\"\r\nlast-modified: Thu, 27 Nov 2025 20:11:05 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: WaJgNru3h\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: UMgAAACpoNqXhn0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":12577,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"cbe950c6e2b41e16bb49bcaef84c36fb","sha1":"16060782cc4aef118d571c85e7b5d20400b4eea8","sha256":"e81d205e5bf7e3a70a05758da4f9016f05536263cb82af5c062c98904cca4cec","sha512":"61ef865184bcf85634a1d88f968de45cda487399e45d382f9a2acffca39c02ce84b6391c0bed1223d167476088c3e388d3c221ba47437995ea4e0dda6b192939","ssdeep":"192:LA3Y6X0IvKgo72UOkGROApaWIGbRkh+V7s4AuhYcplOIIr8atQ/:LAoYKg+iAA0qqEsruhNlO3r83","tlshash":"3542beb267d8403f030b30c5b648b7c61de630f08ea8b990d52377a8b4f67e56a65165","first_seen":"2025-01-20T00:48:57.825526Z","last_seen":"2026-08-09T22:07:19.833264Z","times_seen":376,"resource_available":false,"data":null}},"time_used":2555,"timings":{"blocked":993,"dns":0,"connect":0,"send":0,"wait":1287,"receive":275,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/98a9c4e1e37f4894949407c7b9103c03?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.552Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/98a9c4e1e37f4894949407c7b9103c03?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 32317\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 9130\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"98a9c4e1e37f4894949407c7b9103c03\"; filename*=utf-8''98a9c4e1e37f4894949407c7b9103c03\r\ncontent-md5: AKhwJ4oZB8ojlIK7E8kMKA==\r\ncontent-transfer-encoding: binary\r\netag: \"FmyTZylL1g9KUjUTx-IuZBbN2N2u\"\r\nlast-modified: Thu, 27 Nov 2025 20:11:05 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: iBs67tWqX\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: gXQAAABXEyw8iH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32317,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"00a870278a1907ca239482bb13c90c28","sha1":"6c9367294bd60f4a523513c7e22e6416cdd8ddae","sha256":"09cdb370bbf06c5c2054ac8dd4fcd6e76ad0774dd8028602935683830360c3e3","sha512":"0f5071003e933fa03a0ec64c4f99b1c4a94a5ebcf2692753952971424eecb1c06407da8005413b3c61c74a37ea7fa94a16dca8d77bc03992c4c9d68178da781a","ssdeep":"768:yEMnvK7zfJQiqCZv8CUz7+igZ0hsf01F6zR8yvtXIKCa:yEMvK7TJhqCh8+iJ/1F6zF4+","tlshash":"7ae2e1eb40b82a563c2cc2772a3807e1f5a93558887ea54f554945e2b473b386bf3da0","first_seen":"2023-07-08T08:51:55Z","last_seen":"2026-08-09T17:07:42.914294Z","times_seen":314,"resource_available":false,"data":null}},"time_used":2542,"timings":{"blocked":992,"dns":0,"connect":0,"send":0,"wait":1286,"receive":264,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/css/52388.1756903329400.023ec95e.css","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:27.982Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /css/52388.1756903329400.023ec95e.css HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:28 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-10ce\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725548=wdtO4M5R3pyBXDSDlSB9FD5ieOJLpGjZdfC4za9oCAyN1n8vLsGZ+z8auR/Dh4ykS+PCyBfoKyAMuN0NuIOnM6NbqsNDb1di2mTV1gji9F+K2Iou2dNtgjOROSr+yzTqg8c7tnLTv6/yv2kgFzbOjVLWKxGxOEpbx/MH0+yEv5fPjuQbFYc97dxvwU8Cbcw6\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: DF14A1B9-3400-490C-8239-43B73129254D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4302,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4302), with no line terminators","md5":"4efa3b550af4fa3ebee130f514631a7c","sha1":"52f29a161a644ebd6eb64fdc07b98e62115eec6e","sha256":"9b87a918545ad75490c79272f4c435c319793820eef518ca60893ba92fbbc8cf","sha512":"096e5f166461728d63ce720dec1310e40390420bfd76d5d13406ad6f2720a55ef6131fcc40f021c6029eec962a1315614a0c7cae55717e6d3466bbabd48dfa43","ssdeep":"96:k8WL6Lfl5F3fPFqNu9h0ShU1ulYUsH270RHeO5k0IWlLBUWl1dLIrEjWm//:k0Lfl5F3fPFqNu96ShU1ullsH270RHe4","tlshash":"2c91124bf89ca23f58bab7ac59c7a55da45644059b270aade31c35e0438b4e0c133eec","first_seen":"2025-08-05T06:40:24.237782Z","last_seen":"2026-04-26T06:01:09.995598Z","times_seen":1255,"resource_available":false,"data":null}},"time_used":468,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":468,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/kc523-1/sponsor/sponsor_nav_web_1.png?1756903280095","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.136Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_1.png?1756903280095 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 7821\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1e8d\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725552=+hxA24sti7lqYYqupQnW9OdDveGHfM+yVXFNWLeNWVHbkZszbu4mHTohUTANLRNSQpC+on1scArJrHSuZR0EnNfSuCrQewLq1ZciobqdoGYLlt4BzR9bC9ZqEJokSjjy7X1RgRKhXeWPUwgVQIwdg9fSdElkJRYx7lyRsFydDCX7EZgGx0tbjXSJRf5EvAaZ\r\nAge: 1109460\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: CA40DD60-52AD-4206-9626-910A20289283\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7821,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"0eb441aa3c30cc3c92da984283938f90","sha1":"74a769808afa9b87ea483a82d47958bf05ab9b87","sha256":"146f45de163728bb850c9a8e6c1693dd4c82caf7b6e1f58728395003b84f286c","sha512":"d1c9c8824c4f42f71db8ce2b62955647aa55bb590305765cd931000d0fc6023f7d57cd3daf6992094365ca6ecb42f02f93d606d79f6643a2f89d52f71200461e","ssdeep":"192:AnUYZGCj89cpWsWKE+hAqF7k4Pk7KJw7OjF57HUNuvs7alaUd:AFEijWKE+hHF7kt7857HU/eRd","tlshash":"20f19f3eececd52cd1a745f68caf47a6142c5031ee9d7929b82fdc728649a409d403c5","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-14T18:21:23.044213Z","times_seen":2246,"resource_available":false,"data":null}},"time_used":4582,"timings":{"blocked":4288,"dns":0,"connect":0,"send":0,"wait":294,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/partner.dca3fc6e.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.166Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/partner.dca3fc6e.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:33 GMT\r\nContent-Type: image/png\r\nContent-Length: 28969\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-7129\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725553=FS6tYjKh1M+gSmmjCJc7Z5ItrAI5uLtwq1ey+8G7hLKPEt2q0r/meEfJ/8cV8j9e63TaT2ebLNzsT2vLgNVjhogT5H32RN5gJMZnna7ohuq71psenX2MCWWvVWWDwpqniEmr0zYChgtCACgnZEUzjgk1DDYgAenPeOBM1Y+Fa3resLtB1I3RbJPLpvzCgg7d\r\nAge: 1109459\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: D75BACD1-0522-4EE3-A6C4-3DF273A366A9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28969,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 480 x 151, 8-bit/color RGBA, non-interlaced","md5":"7374b72d05130af2d77119eb0eb4ba10","sha1":"5b3e5e621329685de250121b2fd9c798f46f7d65","sha256":"059a622a7f1f0f1f239d624f19b0f5531c0f0aedadb8ccd40d2570a76dd56752","sha512":"c2d0f744838a882c8ac15de6bb0bfbeb3dd2f31550cc7a259b9890ea38eddf835902171c1346ed7e1d2005ba18b929d598002d60b7355df72073d955521b18b0","ssdeep":"768:tAAoY1X4ITISUWhiqmMiuCaUENwHoacq8zqWx6:abaX4SIYIdMMow8zqi6","tlshash":"a2d2e0ecdc3058f1f533894dc979813a6f3886ba05e359817a36f92bddc3e8506491e6","first_seen":"2025-08-29T11:05:53.287538Z","last_seen":"2026-08-15T19:18:34.45832Z","times_seen":2461,"resource_available":false,"data":null}},"time_used":5136,"timings":{"blocked":4844,"dns":0,"connect":0,"send":0,"wait":291,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/4f5f0bbdc55d405da6702fa442c33237?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.525Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/4f5f0bbdc55d405da6702fa442c33237?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 59144\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 19047\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"4f5f0bbdc55d405da6702fa442c33237\"; filename*=utf-8''4f5f0bbdc55d405da6702fa442c33237\r\ncontent-md5: JX11jFz0NFPs+wqR0YAtOg==\r\ncontent-transfer-encoding: binary\r\netag: \"Ft6R4U_JGSUPGPyycw-4lOxAPWm1\"\r\nlast-modified: Thu, 27 Nov 2025 20:10:56 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: dSApSxNNi\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: dR8AAAASyTE3f30Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":59144,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 368, 8-bit/color RGBA, non-interlaced","md5":"257d758c5cf43453ecfb0a91d1802d3a","sha1":"de91e14fc919250f18fcb2730fb894ec403d69b5","sha256":"c60f9d9513d6d579348be9f3733ab92012f2bab1c4017c76f1e4af8ceaa91f7a","sha512":"04d4b411e739aff3442acf11056c2e48afbd914af97150f5f37d6ed55ae80fa51296b067387b0911e4a2b900cce33aa31b94f2c17f8bcc29e6b5e59a8da6e327","ssdeep":"1536:yzZBupZGeUt1MQ1eM3uOQTavZO4x26n0XNkIb:y9ApS173MuvZO4Ig0XK6","tlshash":"eb430284145d62d47abaff6a6a04a4264f21ef2a5d5b1137c438e06cfd0977312ba3fc","first_seen":"2025-02-24T02:30:01.441461Z","last_seen":"2026-07-31T00:12:30.659283Z","times_seen":307,"resource_available":false,"data":null}},"time_used":2893,"timings":{"blocked":1018,"dns":0,"connect":0,"send":0,"wait":1287,"receive":588,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/vs.21f89f73.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.571Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/vs.21f89f73.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://y108p.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 1306\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-51a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725552=+hxA24sti7lqYYqupQnW9OdDveGHfM+yVXFNWLeNWVHbkZszbu4mHTohUTANLRNSQpC+on1scArJrHSuZR0EnNfSuCrQewLq1ZciobqdoGYLlt4BzR9bC9ZqEJokSjjy7X1RgRKhXeWPUwgVQIwdg9fSdElkJRYx7lyRsFydDCX7EZgGx0tbjXSJRf5EvAaZ\r\nAge: 1115069\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: D504B556-4E86-4274-80D2-A9C6A4797425\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1306,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 70 x 28, 8-bit colormap, non-interlaced","md5":"41cff06a80e61ee3fcd32f7c29a6493e","sha1":"bb70bb0a3a0fde7a132788777aee629392c756e9","sha256":"3240fcea2e4168dc863b8aea602750e6a1fe11a557c18ac6a381781ef487746b","sha512":"fce7ff9f62b51c4f8994f0a8ec4a56f21570d0cd163471d99b357eb0a9a735c800b389c4a8a611ba441b208cea7eb483140042f5d11ef110b591c1c1898bbb8d","ssdeep":"","tlshash":"e921eaffe15b2c75ccb59bb3bc6c12656809582970866b137125e7588c539217f0c461","first_seen":"2025-08-29T11:05:53.184813Z","last_seen":"2026-08-14T14:48:35.615758Z","times_seen":2351,"resource_available":false,"data":null}},"time_used":1658,"timings":{"blocked":1355,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_bbac9ff6-d09b-48f7-9e60-77639d6ba1ec.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.901Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_bbac9ff6-d09b-48f7-9e60-77639d6ba1ec.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:36 GMT\r\nContent-Type: image/png\r\nContent-Length: 92069\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eb52Nj%2BEN5Dljb7yFsmKBu4nrTHAeDzIPdgNDhzx64SIL%2BZIAcPaHOWPBvCjgIm6j6RV3GD9K7X%2FxW1G6bzsnA2J6LqcXxi%2B%2F81%2BulZVN5yIP0rV%2F7LEoPAc6h3c\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"feb140fe19a10fd9e5db065a8a038f98\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:28 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1115068\r\ncf-cache-status: HIT\r\nCF-RAY: 9a14f8503b028610-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725556=nR/u3ECZA5pQyCeLNXKPPYGpEcWyonqlfq3mAiuMymQj5zr4wRh2qM9R9UxzUohkKR01hX/ndr/g/wR59lQ5vhpR/H5Bt1Czjn+hfojNM65TJ9v9PjehSVgkDNCv8lQuruu6rSlWsgjkYPX2yNHZouFuQM1WVRIkqrC7+hzmacrgeFG19om9k1GtoWuQ6fTQ\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: ACAEE45C-72AD-40AE-91AF-62AE1DCB32AF\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":92069,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"feb140fe19a10fd9e5db065a8a038f98","sha1":"5d0134793913e11a60a320c144c99ed060e1fd96","sha256":"20a24fe332b621908f702caccd9af7c3bd5f2bb30e3688dbee74cf2e92d42da0","sha512":"52cb6adf379c2cdc5acc60267ec402948eeb494f7181d0cba92c8fe24a245dfb941834f5c3e3c05e97f6b4fa867ab9e2deca29651e25a0a224f8867f8855df6a","ssdeep":"1536:kaaOm3ctZpCgpl/Vhbyyx0ZxUfhUg0Zif6rBF8ikHy+bgM8yd41nt12S1M0tdQr9:kRMnogH/VR9ZR0ZimkHn+hxtd8i4","tlshash":"6e9302bb4743ce6ce52cf0bf0469124571f91744332b6baa70e978a4993f50fad318a9","first_seen":"2025-08-29T11:05:53.160781Z","last_seen":"2025-12-29T13:58:57.996683Z","times_seen":298,"resource_available":false,"data":null}},"time_used":3162,"timings":{"blocked":2556,"dns":0,"connect":0,"send":0,"wait":303,"receive":303,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size750x590_1103f977-5f3c-414d-8305-ab6884e8769c.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.946Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size750x590_1103f977-5f3c-414d-8305-ab6884e8769c.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:38 GMT\r\nContent-Type: image/png\r\nContent-Length: 79714\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b9yj7BNhIOJHiw25LfhLoJdGYIADcH%2FVHz9weHTa8gOPKbi1kE5%2BoJsL1LHDYRu%2FlIe8D07V4GBRceZ51iDEdH9VWyj3EGI%2Flkk9siPGn1MeeVoQAJYTnk7bdA%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"ef17ab9ddd63b4c656b2b32b64dd5cce\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:30 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109434\r\ncf-cache-status: HIT\r\nCF-RAY: 9a1581eb9831a67c-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725558=CqU/qJIsoXMX7Gvi171YHqR2CQBtd5s+x9S73uNZlw2A3tlbc9+spA/CvW4Gm6DHJ1dMf2zTE8k58Rhrl70ihx3AV1eZaITtST6ZQhVQZ3ghB6qZz+vzHVTtt0vWUxKAvALFWrFGl0r/jxJMUvTXlSY9LSeq7ejV6cKXEUguF279zmB10apsNqAYt5NztE7E\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 568AA1D1-EFBD-4DFF-98BC-0A679070E7F0\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":79714,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 750 x 590, 8-bit colormap, non-interlaced","md5":"ef17ab9ddd63b4c656b2b32b64dd5cce","sha1":"7ba556d00dfb16b930aad4b1beaf8aa53da162e7","sha256":"420e21a46c35f4347e767d170b68460bc95304b5ec459cabc107e85980c6af0b","sha512":"c9db896e40ab968a297150834286016a08b8ca93b4ebb35e1397f4021fcc2f7b8bad6e5c4e21e3cb916b72a8c31862c0f9e11302d3059b4c02cea4b55c50591a","ssdeep":"1536:IkxOWEsKXHidS1bbSZ5ReqcL870XVwdR1++xXV+dU2GUlj1ksKU:IkgWEsqCdSlbSZ5ReqcLbXCdD++3qDLT","tlshash":"7d73023d6288b7bee034ff7551d1137641b18daa5e41eb0ecf5082652862ffa2c76c49","first_seen":"2025-08-29T11:05:53.078061Z","last_seen":"2025-12-29T13:58:58.056612Z","times_seen":292,"resource_available":false,"data":null}},"time_used":4799,"timings":{"blocked":4215,"dns":0,"connect":0,"send":0,"wait":291,"receive":293,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/config/initGeetest4.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:21.477Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /config/initGeetest4.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:21 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-3a06\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725541=pk0PFKpmbawWeBIbVoOKDDMrvldrlsez23xI//cP2jgBEbj6KUadRpCa8sronA+fpZpdrYEU9iyTjQ+G7WXxUkwQmGdrLu87cTyaDtvF0R/Offv+fejO3sIM11Ua8nb7MgxWgzAZ0a3px9OFJVmNd71TcQRGzzLbX2CxcaJeXtXITTo0QmDUzfYy7w0RFJkq\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 1544C4B6-F082-48BA-8D70-D6545DA28247\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14854,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"8c1728fc2d381e145b190ab70c9bb0a1","sha1":"0b96f2760bd9ca0f1d9ffaeed79934edb645cae2","sha256":"6d0aaf3dd58610ef691fb625d47237f756c4821be2dc28950c94e8eaa7761edf","sha512":"df586fb362b77f15f597573310941d008233942242914d9791e6a38e0a642874843b4f98b66d2ffd84be5fe0a986968aaccecbefedcccc7831b559164b3724c2","ssdeep":"192:hN3ar8HuCDoNu5dq+ExNiqc4K25MB5VsaiQxta4SScQVy8QRHIqaawzjTki59r8j:fJe61XHlii5aI2PG4lyUIVKQTwwwlB","tlshash":"a762104d68f750a35553b43c8b9fa014b5388a93041cde41be9ce394af9843d9bbabdc","first_seen":"2025-04-08T11:24:52.26859Z","last_seen":"2026-05-23T23:33:56.909269Z","times_seen":2066,"resource_available":false,"data":null}},"time_used":441,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":441,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:29.008Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://y108p.xyz\r\nXign: SpRiT3c40f5NhLYvWpGkL9OcX1b0T7mUd2rI3t53u06koKwMwYgdBD0opietOPPmIK922vmDFoaqD+BzTi062kjneRQh3Y5wWlrWKnonLL6OvzgABoNZfsxyh6DBKFoseApnIgLuWuMHn/BR+8d8p4/TaFxmdGYolY5X5RojOJk=\r\ntimestamp: 1764725548983\r\nsign: 1s68k6c2l9295b3k\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: rEfAYkDGbEEF5yTzpkNZQfYMBdt5bAF3\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:30 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Wed, 03 Dec 2025 01:42:30 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725550=EnwJxt5GEWZDoy2zM7O5VXjcyuKd9QeUQschlibf8N338Aywly3eO288QFLQVHJlDyo0pDjxpxgKkpZBHYec+tXMDURhFCbrUPeFgavax+z0IHuK0xhcuNPttVS5GyOXCrGmvQfb7udRo95bcQln5pJocaMrGFQivBnHGp5AthjDtr2jbX9R+GmiXuhzQg6n\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 5C1FA575-2134-4322-A36E-DE62B2C1F421\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6563,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"218a324fb8ba6b37b464afa09f7fdd87","sha1":"5c42ad3e84a8035b0ce17d95945fe7e7d6f31e1c","sha256":"4000a1d104faa165e34ecf2775eed6f541eca50901d02f40b62b0373287f477b","sha512":"637e1a72aaec60eb0fc86fa51cf4fe8f00844b1786333c76cabf19aac67e2873abc09f793d7aff19c75a5da517240121146263ecace66ac28fc84797b10206d8","ssdeep":"192:VW74MX5sJUN+HmDZQzX2020pUZfRza+yPFVNbmmvYh4aVNma/9HLVooM:cUMXAUoSe2kUZFxyPFVNVvy4ajmglVoD","tlshash":"66129f134204f782a1b7cab7ec2148c4358967f6bad6499eca94e7f60537242d70d4ce","first_seen":"2025-11-20T14:42:55.95119Z","last_seen":"2025-12-03T01:33:08.758011Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1650,"timings":{"blocked":1098,"dns":0,"connect":0,"send":0,"wait":551,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202506/_raw_size1260x1156_03543abb-5967-4969-b0c5-87347b24c4d6.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.963Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202506/_raw_size1260x1156_03543abb-5967-4969-b0c5-87347b24c4d6.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:39 GMT\r\nContent-Type: image/png\r\nContent-Length: 300115\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M31U%2FIVSmFe2LRSvQCgayx3CfXoMeLK%2BHhmL5JwthBpLV2HE4K8GKJTa%2B%2F8G4wFo9kGPBsRbKBF6X8EPH74ImJTe316dl6YMQ5E7vtKo%2FdPZx5iL18Yzpme5tHQ8\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"37fec7c80a51688c04f77c1037326004\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:17 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1115061\r\ncf-cache-status: HIT\r\nCF-RAY: 9a14f88fabe1e2e4-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725559=cskfHawHGVxhGeXXtbZRur3v20bZg50TtEUYGl4CB3C2tLar2sd3hOaapB8duFFbayAPc/WKHjrnWYjhmntPkR89gmB2hPvJg7C+Ys/l49+TrCan2VyPmluK6mFY2NTBpy4qDTfI53ZS4vX72F7xV7pl/xWHuH+W7Jtxy/IML4gnutunucRYTNGKiRUz1AJp\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: 24D72027-24F0-4EFC-8506-504F982441C9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":300115,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1260 x 1156, 8-bit colormap, non-interlaced","md5":"37fec7c80a51688c04f77c1037326004","sha1":"fd665b933bab23652f0cff470fba5592d3b74474","sha256":"b2b5ae8374cea37ae3d437a86c3f7149cfc0620470c5dc46a606a2858c9ea805","sha512":"4628d46516b68b86a355a4e48f93e3e662e57a75a061037c5bc151bda4ab7e9521cb9d7a41e2e61796c4f933c6d063fe5aefa99713532591a1a471f7147071a6","ssdeep":"6144:b3lXZwKOHfoPrrp3/CkvaKB7dufM9jn8J7ReuTXVGxwEk1av3YP7Ll7yi:b3hejHfoD9frj9j8J7RbXV5R1A3M3lx","tlshash":"215423b70d4d2a3be017d2f40e9f294a80955e91dc868270affbec95ca7777880749d1","first_seen":"2025-08-29T11:05:53.270915Z","last_seen":"2025-12-29T13:58:58.068155Z","times_seen":289,"resource_available":false,"data":null}},"time_used":6135,"timings":{"blocked":4922,"dns":0,"connect":0,"send":0,"wait":303,"receive":910,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_392325e1-efd7-4953-83f1-410dea55a03c.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.967Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_392325e1-efd7-4953-83f1-410dea55a03c.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:39 GMT\r\nContent-Type: image/png\r\nContent-Length: 80779\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=G1pN4PgKkbwVSdQqte8X6ynfsme%2B2lficUigt7r08bai7XJuUVZPdn1VWPBMKf8HkbyqIXpr%2FQK2gvX1uvRdnfd7zQpw4t4H2WaDX7fk2sacb3hsdrCkyktjfM%2BP\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"4c5942d2ff7143f561ab601251f4fd8a\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:25 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109445\r\ncf-cache-status: HIT\r\nCF-RAY: 9a1581abbcd40edc-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725559=cskfHawHGVxhGeXXtbZRur3v20bZg50TtEUYGl4CB3C2tLar2sd3hOaapB8duFFbayAPc/WKHjrnWYjhmntPkR89gmB2hPvJg7C+Ys/l49+TrCan2VyPmluK6mFY2NTBpy4qDTfI53ZS4vX72F7xV7pl/xWHuH+W7Jtxy/IML4gnutunucRYTNGKiRUz1AJp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 5620D885-ABDB-4197-8129-488093952C14\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":80779,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"4c5942d2ff7143f561ab601251f4fd8a","sha1":"33992d6c0f6b7cfd15c10b89cc21d6e61b388b9e","sha256":"930520faaba7720398434d06b0cdc67819d0bfb174db13978ea1df7f95fe2c19","sha512":"a8fd398b0dce4c041f2570df3a1be5d46766e8206a82c53c78ea7bf19fb22bddbf465acc1df277200236b58168149cf7101698f416ab9f763406d09d5e0b343b","ssdeep":"1536:THVzFXmHVHAZWTzvtRHxFyUBlN+f3LkQ33zIVxWDmI3Ay3/ntH8:TDWg4TzXHxPS3L9zIVxWCob/tH8","tlshash":"20831231929bf246f092a3b6fe3a5165181cdd60dfbcf58b8d5e4e281d6b2c1820dc97","first_seen":"2025-08-29T11:05:53.231567Z","last_seen":"2025-12-29T12:28:25.243317Z","times_seen":307,"resource_available":false,"data":null}},"time_used":5519,"timings":{"blocked":5205,"dns":0,"connect":0,"send":0,"wait":311,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/kc523-1/sponsor/sponsor_web_1.png?1756903280095","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.029Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_1.png?1756903280095 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 42326\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-a556\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725549=/hVpQNHfLaAcoXjZCNTD3ZDnYR8cYfq+YoSlktnj8vjV4yYEoNmYY0sKl65CWk9dh56Dl85PFjG7mrhMoZDvByy/GLY83hGvAKTjFaBL1ZoH+ejqwiyveU9JUw8qyMDteBKPL4KYudk6vsBAmQXX3V32d2e2abScXG4NnkM2M65b7NYaok48/b3a97O06i5p\r\nAge: 1109461\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: CD994C51-6750-418F-B036-C4198FCF7BAD\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42326,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"e0ecbe5a9349aaa328ffd6f9515f9007","sha1":"79ebc30d345c812a3e3a122f152829d161b00a52","sha256":"452d27839b3f3f35d11c9a26f06d6cc9db56dc8c61261ee43e0512f69abf71f4","sha512":"fd322bf3ca925ce2eb45317adae1dee0f1c2e4f30035738052a97ccc054ffb576a92a46758559c8d13cff6be549caca5541d14c5692cbec2758ab2b3c7f3324a","ssdeep":"768:2o9mjFjepo5h5jLasrCO57PIrvmMOSf4t7q5bo6Wruv9CSMsfRLMD7XZ0:2ogpymTxRrwmDSM7mbo6WrutR60","tlshash":"8713f2ebe1075d80bb946c9b3925eec61da50f047bc78d68c5e055f921290bb0fa33a7","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-14T18:21:23.29363Z","times_seen":2373,"resource_available":false,"data":null}},"time_used":1164,"timings":{"blocked":854,"dns":0,"connect":0,"send":0,"wait":308,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/api/tenant/domain/list","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:29.010Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /api/tenant/domain/list HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nx-request-source: https://y108p.xyz\r\nXign: bFAX5unev/LO+u/pgZwORVfobH+y6TsGqoRnlf+CDp7/cpKL/Hlkm8x21FTdCJkopt2sxTZvD/1nqb+GUtRirsZ5tRB6U1NTe3nUCdVNv9ldpHVhDjYCu9IJpQqmDLvIu+T16rVBuGwWTQUj1XL+CUQ4CWLfFRjanrWnMfMYeZ0=\r\ntimestamp: 1764725548998\r\nsign: c67145c4o2d5k63p\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: rEfAYkDGbEEF5yTzpkNZQfYMBdt5bAF3\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:30 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Wed, 03 Dec 2025 01:42:30 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nVary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nX-Content-Type-Options: nosniff\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725550=EnwJxt5GEWZDoy2zM7O5VXjcyuKd9QeUQschlibf8N338Aywly3eO288QFLQVHJlDyo0pDjxpxgKkpZBHYec+tXMDURhFCbrUPeFgavax+z0IHuK0xhcuNPttVS5GyOXCrGmvQfb7udRo95bcQln5pJocaMrGFQivBnHGp5AthjDtr2jbX9R+GmiXuhzQg6n\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 84EE01A0-DA57-48B3-BA69-FF83A2394717\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1108,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5d9e96bd132a2c24281ae50f2b09efe4","sha1":"503ea18100d0f1573baa195933355a1372e93841","sha256":"7f205b18b5deaae96622989dbc8ad73999a9616e96ef26d909f19525deadb328","sha512":"ab5a589dc81944d2fe05d656777e9e490d42a2fd68c7e577387cfdd47c9b0c5276ca2f91a3868407c373e500d00bb5360a5ae035c7c0cb1addf47f20755a268b","ssdeep":"","tlshash":"fb11c6101c6f12c8d6e8d29263503345388d8b76056db91b69d6b74fae0583a32120a4","first_seen":"2025-08-29T11:05:53.144028Z","last_seen":"2026-08-15T19:18:34.43594Z","times_seen":2672,"resource_available":false,"data":null}},"time_used":1801,"timings":{"blocked":1261,"dns":0,"connect":0,"send":0,"wait":540,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d2d5999f29734180a87d7ac819815a00?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.500Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d2d5999f29734180a87d7ac819815a00?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 30034\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 21722\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"d2d5999f29734180a87d7ac819815a00\"; filename*=utf-8''d2d5999f29734180a87d7ac819815a00\r\ncontent-md5: +wHD1DXCuXvqQgexp8fOig==\r\ncontent-transfer-encoding: binary\r\netag: \"Fr_z8jzxWKa5BM49UJSleZqqxSSk\"\r\nlast-modified: Thu, 27 Nov 2025 20:08:25 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: 1l7boXImr\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: GvoAAADVb3HIfH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":30034,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"fb01c3d435c2b97bea4207b1a7c7ce8a","sha1":"bff3f23cf158a6b904ce3d5094a5799aaac524a4","sha256":"3db0feefc11a26f581f0fa0c04c61df6214799a3cdc48e413367d4bd9a07e41a","sha512":"4528bf7062ed22e6974628d54c2164747ccd459fbe986ec24623b4df1fa3eda860a4c0737a257bd183652891766918dfc1ee2d57ddeb874809245c1e924afb4a","ssdeep":"768:zRU9EXfCxUhMKI8DZYohgbfGFK1nnZvUXyQ0FO:zCEqxKRXxhohZvUj","tlshash":"a6d2e1718f78183d55c04a55348d15a844efca3c939c92b662e2cf89c93e2ec9f1a9fd","first_seen":"2025-01-29T13:39:14.809113Z","last_seen":"2026-05-24T05:41:01.498075Z","times_seen":270,"resource_available":false,"data":null}},"time_used":2410,"timings":{"blocked":1042,"dns":0,"connect":0,"send":0,"wait":1287,"receive":81,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/a74ddce028b241ff9e2a21dbd3bc1dd6?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.558Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/a74ddce028b241ff9e2a21dbd3bc1dd6?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 22198\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 3721\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"a74ddce028b241ff9e2a21dbd3bc1dd6\"; filename*=utf-8''a74ddce028b241ff9e2a21dbd3bc1dd6\r\ncontent-md5: wjdG3PpMPT+ZjDYRVJ8Klg==\r\ncontent-transfer-encoding: binary\r\netag: \"FqjJqrPjiRnpCGX_vPBUY1RTEjr5\"\r\nlast-modified: Thu, 27 Nov 2025 20:11:10 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: jRIMMQ1bJ\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: svYAAABy348njX0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22198,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"c23746dcfa4c3d3f998c3611549f0a96","sha1":"a8c9aab3e38919e90865ffbcf054635453123af9","sha256":"b96be1be4cf0e5339618471d63fc2aa132f715f41245ae32f14466900c3e37e5","sha512":"402c4e66d724590ef009bec876bb0c7ddcc26d5f6c8868fb22688991e34738a3f76a8e93cd46034ec613221895e008ff34ccaa7a80c71b4f7b20376d98b889f9","ssdeep":"384:Gi905+UZBLfJEqzUa3E3RTxUSwO/dLaLgrFSjan/vOFpn+caGYTH5:nTUTxEE3nS3/dessmn/vOFpn+l7D5","tlshash":"f2a2f1f7000943c55fe27f7eb8024f8b295cf4e96452656ebc9e4ea802291e157fd480","first_seen":"2024-08-20T01:52:57.905354Z","last_seen":"2026-08-08T01:00:40.507254Z","times_seen":243,"resource_available":false,"data":null}},"time_used":2614,"timings":{"blocked":987,"dns":0,"connect":0,"send":0,"wait":1306,"receive":321,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/842c79ff332d45e7ba0721f842d206c4?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.567Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/842c79ff332d45e7ba0721f842d206c4?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 13776\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 86\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"842c79ff332d45e7ba0721f842d206c4\"; filename*=utf-8''842c79ff332d45e7ba0721f842d206c4\r\ncontent-md5: 7YczUxauZY5hz65kEJWtBw==\r\ncontent-transfer-encoding: binary\r\netag: \"FoARqgR6yekYDL6VzuoFJRsOFq6Z\"\r\nlast-modified: Wed, 03 Dec 2025 01:29:04 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: rfwc7GQXu\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: LkcAAACVfPJ1kH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13776,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"ed87335316ae658e61cfae641095ad07","sha1":"8011aa047ac9e9180cbe95ceea05251b0e16ae99","sha256":"1cb895792563ca3b87994b4c16af92a147f8702c3f3569b276969b067d8a72c0","sha512":"238be1727b99e1dc07780293f76e5f43e425f133f17e9c55c29af905d91cd2e95bec695ddb4b32c28bbf018d6579ee8333258da58e4f3565b13624864d80404f","ssdeep":"384:6YWhphok9n4ORy9qWHIeHL48ILvQRf3zhxPG8AbUWTx5:6rpP/y9fIeHL45Ufzzt6UWT7","tlshash":"9652bfd37200c64802c13c3bfdeac1920b5d4f865f68aa4de8d62a765194fe53991d76","first_seen":"2025-12-03T01:33:08.798716Z","last_seen":"2025-12-03T01:37:40.695673Z","times_seen":8,"resource_available":false,"data":null}},"time_used":2660,"timings":{"blocked":980,"dns":0,"connect":0,"send":0,"wait":1306,"receive":374,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/configPage.js?v=9/3/2025,%2020:46:11","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:21.475Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /configPage.js?v=9/3/2025,%2020:46:11 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:21 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 949\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:19 GMT\r\nETag: \"68b8389b-3b5\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764725541=pk0PFKpmbawWeBIbVoOKDDMrvldrlsez23xI//cP2jgBEbj6KUadRpCa8sronA+fpZpdrYEU9iyTjQ+G7WXxUkwQmGdrLu87cTyaDtvF0R/Offv+fejO3sIM11Ua8nb7MgxWgzAZ0a3px9OFJVmNd71TcQRGzzLbX2CxcaJeXtXITTo0QmDUzfYy7w0RFJkq\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: 413213C3-3145-4CF7-BA6F-63785CD46466\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":949,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (917), with no line terminators","md5":"e6aa74bb352ef198ba3e1c9a4b01b014","sha1":"2ea8bd6b5045475a36432f7665a129728e822d9e","sha256":"73828e873c0b6e847b37d78941ca436247471dfc90a12f743964f869f75abd5c","sha512":"2faaf24fdf1e4da637af8e9f82d1778bf061b00752dfca0c8f73432ba236a7b69410a7ad2a73727bc83e6cd631fd6555c3cc0d9d3a5d8a7f81818dd66566011f","ssdeep":"","tlshash":"be117aaf57444dffcf1d7e00a08b0a5ea8bc61d261889d4da8e9cf29e1c99002378978","first_seen":"2025-09-04T00:49:32.949926Z","last_seen":"2026-08-15T19:18:34.487984Z","times_seen":2888,"resource_available":true,"data":null}},"time_used":445,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":445,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/52388.1756903329400.521cb32f.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:27.984Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/52388.1756903329400.521cb32f.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:28 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-6b1a\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725548=wdtO4M5R3pyBXDSDlSB9FD5ieOJLpGjZdfC4za9oCAyN1n8vLsGZ+z8auR/Dh4ykS+PCyBfoKyAMuN0NuIOnM6NbqsNDb1di2mTV1gji9F+K2Iou2dNtgjOROSr+yzTqg8c7tnLTv6/yv2kgFzbOjVLWKxGxOEpbx/MH0+yEv5fPjuQbFYc97dxvwU8Cbcw6\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 71D92B30-3979-42C2-9C9F-4060A1C8D145\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27418,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (27172), with no line terminators","md5":"cdd31eb0b7ccfc1eafcead314123dfda","sha1":"2bd4708c1e30cebc08cdada8ef890baec6ef8622","sha256":"669b207d5cf11b0e229699f6e54104836b252c5398e20c4bb564b89b2525f0a2","sha512":"9c48059df23c4a9632eed22a28d883786e40c593fe3ffddb9144fbca21a45322121e36580084fc642e9058f086d3657d819f5d2b9528a91633aeb2085cd5ff06","ssdeep":"768:f9Vl3u/ffsp3aNWchZ4IIATAJ016fkmD19mprq2xd7QjDv1gyT8CpYCVc5WsNiU:8308O1cq2TlW0","tlshash":"84c20a80d6b4f5fd636ec9ab8a3a8464602637c5b0c8ace095ec6e8c3d4475774788fc","first_seen":"2025-08-29T11:05:53.257205Z","last_seen":"2025-12-29T13:58:57.988641Z","times_seen":422,"resource_available":true,"data":null}},"time_used":466,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":466,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/kc523-1/noData/cms_noimg.png?1756903280095","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.394Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /kc523-1/noData/cms_noimg.png?1756903280095 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 9882\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-269a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725552=+hxA24sti7lqYYqupQnW9OdDveGHfM+yVXFNWLeNWVHbkZszbu4mHTohUTANLRNSQpC+on1scArJrHSuZR0EnNfSuCrQewLq1ZciobqdoGYLlt4BzR9bC9ZqEJokSjjy7X1RgRKhXeWPUwgVQIwdg9fSdElkJRYx7lyRsFydDCX7EZgGx0tbjXSJRf5EvAaZ\r\nAge: 1109451\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 4B2FC44C-B60A-41F4-A291-B0DA1A45240C\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9882,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 700, 8-bit/color RGBA, non-interlaced","md5":"85e60fd8767b18839ffb552a5d543f8a","sha1":"341cfd68a5b39cb246af6ade1e3171c857d2df5a","sha256":"4b7ad68306ffac25830d1016ba86154890deef8bd77a03257b767b37de1c8338","sha512":"785f028aab80d3f96794431f84025483f490d7d642022404a7b14ccb4785aa52fe4a21048d44acda3bd160eedeaccfb4959a677986dfe47ef038d80724f2acb2","ssdeep":"96:74iGykVWI7TGvGJUgTFSebsBzYofEC16+TqBK7R7LWKaR8a8D7uZNgAMXFL73:74iyHunEFSebsvP1nTP7IF2uAAMX5","tlshash":"141259118573d43cd82ce57926df6fb93b709f996890476e8328e7342f2a2f78d60848","first_seen":"2023-05-01T09:33:58Z","last_seen":"2026-08-10T17:58:48.364752Z","times_seen":3146,"resource_available":false,"data":null}},"time_used":1963,"timings":{"blocked":1655,"dns":0,"connect":0,"send":0,"wait":307,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/edbdcfbcb1ff4012bea4b998f8178e6f?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.496Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/edbdcfbcb1ff4012bea4b998f8178e6f?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 26979\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 27130\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"edbdcfbcb1ff4012bea4b998f8178e6f\"; filename*=utf-8''edbdcfbcb1ff4012bea4b998f8178e6f\r\ncontent-md5: sqpQHaq8y/AMfv0AIvlhaA==\r\ncontent-transfer-encoding: binary\r\netag: \"FlE1iMF2Oftfg1LEJAWngt7Wkw75\"\r\nlast-modified: Thu, 27 Nov 2025 20:08:08 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: KlKsXbl3E\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: p88AAADyBlfdd30Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26979,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"b2aa501daabccbf00c7efd0022f96168","sha1":"513588c17639fb5f8352c42405a782ded6930ef9","sha256":"991f38cc89172fbe9fd52bd9edb6377b90f0eb7c0e25760586fca8e7a16c327f","sha512":"e09ed2108a6fed1271e866133d156f1d092c57986c2f2c3a024f982e25ae94307ba509e0d9291a8e1c175c43bad15468e529123e168761b9a387ebeeb65136ff","ssdeep":"768:vQO2GxdPKOAxzeL38FtJQwaRR5XJE8nku938FcG:AydaxzC3SopvXNTKFl","tlshash":"b9c2e1c1252b49eb7299fccb1257ca8f832646c30e79525dcd287a7461706f56fac10e","first_seen":"2023-05-27T18:34:14Z","last_seen":"2026-08-09T17:07:42.874055Z","times_seen":178,"resource_available":false,"data":null}},"time_used":1665,"timings":{"blocked":1046,"dns":0,"connect":0,"send":0,"wait":568,"receive":51,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202506/_raw_size1164x872_0e80d399-2c93-4f64-89db-61a96d3b05e4.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.953Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202506/_raw_size1164x872_0e80d399-2c93-4f64-89db-61a96d3b05e4.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:38 GMT\r\nContent-Type: image/png\r\nContent-Length: 216312\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xEtVvVcTYOuV96TjOUDuECUxydIeN%2BmJRt%2FBDlWFq3lHkiolYtXPGvAzkCpOHVVLbrqWXQhmTbqQERJl63jdCRLP8lc%2Bf%2BKG8m8xOqYbTtQ5pqTxLkSdZia5J8NX\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"4a57e212f11798f459137139c2f5bb01\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:21 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109442\r\ncf-cache-status: HIT\r\nCF-RAY: 9a1581b9cb7220e1-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725558=CqU/qJIsoXMX7Gvi171YHqR2CQBtd5s+x9S73uNZlw2A3tlbc9+spA/CvW4Gm6DHJ1dMf2zTE8k58Rhrl70ihx3AV1eZaITtST6ZQhVQZ3ghB6qZz+vzHVTtt0vWUxKAvALFWrFGl0r/jxJMUvTXlSY9LSeq7ejV6cKXEUguF279zmB10apsNqAYt5NztE7E\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 40615862-4580-4539-BFB6-F0EF201F9FA4\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":216312,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1164 x 872, 8-bit colormap, non-interlaced","md5":"4a57e212f11798f459137139c2f5bb01","sha1":"0ff7a4bf94e0d27bca7e36651637f02900f4cbc9","sha256":"947dcc120d07e5be157b5e2122b563b2291e17bb797e4f253b9b721601296412","sha512":"6a2b161befcae34ceb4835b6435adfe769896ccbc56214410545d6def652290fa13df00d80490dd6111176f53b24bfbad359ef40741239fc201b5a1f0a0fcc3c","ssdeep":"6144:/nUGyYD33U0fwEG5JaO2SXnoTlxXQ7k0kYY:/nPHU0YEGPk+o5xgkZ","tlshash":"f62413abe3f3e57eb17456350ed57b6c92f23e82a3611d152ec361d2275a930c31ac60","first_seen":"2025-08-29T11:05:53.081023Z","last_seen":"2025-12-29T13:58:57.986615Z","times_seen":294,"resource_available":false,"data":null}},"time_used":5219,"timings":{"blocked":4593,"dns":0,"connect":0,"send":0,"wait":311,"receive":315,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/68d5249410a44836b310a82ee0c15de0?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.474Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/68d5249410a44836b310a82ee0c15de0?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 15879\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 2040\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"68d5249410a44836b310a82ee0c15de0\"; filename*=utf-8''68d5249410a44836b310a82ee0c15de0\r\ncontent-md5: Jg8ZBYBjpotUbBzhlWn1SA==\r\ncontent-transfer-encoding: binary\r\netag: \"FrebNVHsoTyqdRuEHp3Y3ehbEQd5\"\r\nlast-modified: Sun, 30 Nov 2025 03:33:41 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: iIx2Hjn8I\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: y1sAAAChyRmvjn0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15879,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"260f19058063a68b546c1ce19569f548","sha1":"b79b3551eca13caa751b841e9dd8dde85b110779","sha256":"0c79db842bd26399927e2ec0d19d4b8bc72d5cb6b1503b1ae20a1626a5af76e7","sha512":"5ed5da11489565e24ca32f66f026d98669739907e080b027507284fbe9afcc647cc68987b90bf5fae54edcb7b3579fbc7f0836a7c39b9bffdffe6717137928c6","ssdeep":"384:bSnkS/yZkhVmqWQCdA2+bUfZDIWlc65kZzZyC1FtFZGzM:UyZkhVTCdA/wxsWik4ZyEFtKzM","tlshash":"f362e187dae1a2c79000b29b2f0f0e5f72fd73a1356c7298d630215246ef57299e7b42","first_seen":"2024-08-19T15:20:18.70949Z","last_seen":"2026-08-09T02:10:38.849241Z","times_seen":108,"resource_available":false,"data":null}},"time_used":2213,"timings":{"blocked":1068,"dns":0,"connect":0,"send":0,"wait":1078,"receive":67,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/2348aa2d309b47748903d40dde39ace6?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.542Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/2348aa2d309b47748903d40dde39ace6?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 52586\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 19046\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"2348aa2d309b47748903d40dde39ace6\"; filename*=utf-8''2348aa2d309b47748903d40dde39ace6\r\ncontent-md5: 1ppxRmw0AYwSmXliREX5qA==\r\ncontent-transfer-encoding: binary\r\netag: \"FijqU49j5N9HGaBy6QdtpjVbWKMj\"\r\nlast-modified: Thu, 27 Nov 2025 20:10:58 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: xQBWrjfDX\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: UvkAAAAu4nk3f30Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52586,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"d69a71466c34018c129979624445f9a8","sha1":"28ea538f63e4df4719a072e9076da6355b58a323","sha256":"cb00fc18d15599d05c6db877f650b957cab6be19f1a37f1ef771ff59bb4d959c","sha512":"6a0abbf618b0dfa61565f92249c3991d7114c994ba93de78b1913c1922df03376ed645fd344609a61e5147d96c2e3efb21f00f3db5b2f698b2f16b7a1b240aec","ssdeep":"1536:FvJrVUxq3bGS1ocyxIgVj5QSJ+b+bQ/XWBVNzDG:FvJxUx+bGSGqgVjTJbQiPG","tlshash":"ff33f16e147c1417180418f101fea597f8a99ea3414fbf6eebe9912f7a1337f488b285","first_seen":"2023-10-24T17:07:16Z","last_seen":"2026-07-31T00:12:52.487113Z","times_seen":351,"resource_available":false,"data":null}},"time_used":2885,"timings":{"blocked":1002,"dns":0,"connect":0,"send":0,"wait":1287,"receive":596,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/api/sport/match/player/match","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.579Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /api/sport/match/player/match HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nx-request-source: https://y108p.xyz\r\nXign: J72ZZuMIvhdFXpuImAMJX2IycXtdPEXWFQJa+DUfCKvkREhWSyrxUMPRatu0yIBnjzFjwJr++Gcy5lgcM5sA7p5WIb3HrvXcuOjDuWN7yUbrSLl1Ue/Wr6oIqMwhIfAaeXPNfgxNhis8+cKtsj8t/YxfrIRGlM4+q6E59e+8A2I=\r\ntimestamp: 1764725550482\r\nsign: 2b7k40g3n3r2v3nl\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: rEfAYkDGbEEF5yTzpkNZQfYMBdt5bAF3\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:30 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725550=EnwJxt5GEWZDoy2zM7O5VXjcyuKd9QeUQschlibf8N338Aywly3eO288QFLQVHJlDyo0pDjxpxgKkpZBHYec+tXMDURhFCbrUPeFgavax+z0IHuK0xhcuNPttVS5GyOXCrGmvQfb7udRo95bcQln5pJocaMrGFQivBnHGp5AthjDtr2jbX9R+GmiXuhzQg6n\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 53F158CE-5E22-4BB7-8B35-522BFEF8F7BD\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ad1b5cbc37e087c212a41eca07a863ae","sha1":"f990fb40077ca4c90bbde8ffb87c73e1c06fd931","sha256":"0fca88eefe8bb5f59242b88e2b8b179148a088b4cde3499e1c56fef8c84c309a","sha512":"fe056eef22791a958cc37f63c1cc4b3f35bd990c34d1d321f34504b7b99769b571fe46cf18ede31f7ca0e564baf63aaca9d4f3601395bd7a3ce424e50a2aaf87","ssdeep":"","tlshash":"56a002473a282ea49bc31066b50e7a5500a421749a55f469cc8e623dc755453b546531","first_seen":"2024-05-26T00:49:06Z","last_seen":"2026-08-15T19:18:34.477068Z","times_seen":2698,"resource_available":false,"data":null}},"time_used":544,"timings":{"blocked":77,"dns":0,"connect":0,"send":0,"wait":467,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/8953c3b5-a3a1-4b97-a677-4b5efb3fb94a.jpg","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:32.364Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/8953c3b5-a3a1-4b97-a677-4b5efb3fb94a.jpg HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:33 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8aS14idb9dz0kpH3EpmTqIlXp7YFum7B%2BMNRn59pNM7k6nmpwprRf2xOCgXjhYxXSq7Bm0xo%2BmY3P0JFSTyk8Aj%2Btl8cH0lyUV54vDGn1Kfjj1VyFzixcY7JvfPb\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"4ba8eca994e0876f66da342a8f47763e\"\r\nLast-Modified: Mon, 25 Aug 2025 07:00:16 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 77432\r\ncf-cache-status: HIT\r\nCF-RAY: 9a7f4f97ea517158-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725553=FS6tYjKh1M+gSmmjCJc7Z5ItrAI5uLtwq1ey+8G7hLKPEt2q0r/meEfJ/8cV8j9e63TaT2ebLNzsT2vLgNVjhogT5H32RN5gJMZnna7ohuq71psenX2MCWWvVWWDwpqniEmr0zYChgtCACgnZEUzjgk1DDYgAenPeOBM1Y+Fa3resLtB1I3RbJPLpvzCgg7d\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: F596EA3D-AF93-4500-8F68-BDB5F28BB04F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":359196,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"4ba8eca994e0876f66da342a8f47763e","sha1":"5f483535de56c4253674b0a35d3877d0dd200a82","sha256":"0f95823dd45056d46accd12818e592b49ac3f5050accf68610b4371c62320ede","sha512":"6b69475dcf180cb83d799e6fce9c07ecd91df196e3821adbcd7f4eb90c3831799ba864e2c35760f72d2dc5e5e7e3b74726a83efab3f5a1c3234d965e46def7c7","ssdeep":"6144:dqJy3fkqKTt3/vdG/ZHOMjOUZgO1EjSa+6V4IG1ukzX+wPpoSLB/ON:2wstNGJZjhu6EL+sGIqJs","tlshash":"4f7412e67e777d4b86b68fb6f3d02e4811919b02dce115487854f42328eb0ece89ec59","first_seen":"2025-08-29T11:05:53.189307Z","last_seen":"2025-12-29T12:28:25.234625Z","times_seen":340,"resource_available":false,"data":null}},"time_used":4633,"timings":{"blocked":1230,"dns":0,"connect":0,"send":0,"wait":496,"receive":2907,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/assets/logo/favicon.ico","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:26.740Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /assets/logo/favicon.ico HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:27 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 58278\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-e3a6\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764725547=ZeBRC80LTJHPPI7+oQOCUenUy6TYZ+KmFrw1JR0Iyyn8PAFS0kApFMnQKAyo59yPniskPq2Lp+EsfxmzuOlqtRplgWv8rGdhxZn46bK9M3+DE3/dryCYhCjyAiWHjoVeSJa831Y7QVBSZDFuG3DPWuN+XIeSJ0XS1R/EL72IF40w40mrTtjwo5ru860rvzzS\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 8A19EE59-4011-4F54-87D8-8E48C603FF39\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58278,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"7fb9203f2701deec1371d2fd0ddd079a","sha1":"a7d4ea5f1c3d103aaa3c078bf540b56404aec0e1","sha256":"2a342dd0f9977afb12227889cf13ff008d4cf1e9a4ca07fb4131d14af05978d0","sha512":"964cf7794a7b72bb9515927efe748563b6d46fe122b35baa4c7f57fafb09ea759e5e759a3000d385872218cdd08383a58a2b66feb9a712e6f3e9a06cc87e43b5","ssdeep":"1536:e7V6OVB39Hdm34GeF4KERayBlZ3WgaOlblY4+:e7V6OV7034GeFERd3WgaOlbGN","tlshash":"af43f10a258e86c73047c3921b2dc09b70d12c776b8daef9e6bc4a5816d54731bbd1ae","first_seen":"2025-08-29T11:05:53.165834Z","last_seen":"2026-03-18T12:35:38.966648Z","times_seen":1201,"resource_available":false,"data":null}},"time_used":537,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":472,"receive":65,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/bj1.17ef2db8.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.145Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/bj1.17ef2db8.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://y108p.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 58859\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-e5eb\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725549=/hVpQNHfLaAcoXjZCNTD3ZDnYR8cYfq+YoSlktnj8vjV4yYEoNmYY0sKl65CWk9dh56Dl85PFjG7mrhMoZDvByy/GLY83hGvAKTjFaBL1ZoH+ejqwiyveU9JUw8qyMDteBKPL4KYudk6vsBAmQXX3V32d2e2abScXG4NnkM2M65b7NYaok48/b3a97O06i5p\r\nAge: 1109457\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 6C2920E2-B8E5-4C0D-ACA9-2243204E8A0F\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58859,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 1299, 1-bit colormap, non-interlaced","md5":"59f1176bd542d042d8ddecbe4ab2cbdf","sha1":"7251e6f8bc0bf8bf3e62e892b34540f8259dcf9d","sha256":"b3bc2f14721d5f84900af66179eb6ad69a9c8d5a89eae36f877cf09fc9872603","sha512":"c4e7f1491686b72482ba26e34fd94496fc71bec2a35ba1d7cf67391e1f47f859465ad9f0c7d286bd35f9a26132fd80012a2cd2f8133cf1c6013db4f4d27a85d7","ssdeep":"1536:jlJ0Z4kwI3cG0YXIPf/OWcFOtk2bnIlfyMcw68vTbD8:gxbsGvYXd8OtTbIsgTbD8","tlshash":"004302d3b5e9f610dd38c157a3d1c9da504483be3e938d0bebbe402629fd56840a6f16","first_seen":"2023-08-17T12:39:32Z","last_seen":"2026-08-15T19:18:34.471019Z","times_seen":2681,"resource_available":false,"data":null}},"time_used":2288,"timings":{"blocked":738,"dns":0,"connect":0,"send":0,"wait":620,"receive":930,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/LOTTERY.4e81790a.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.113Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/LOTTERY.4e81790a.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 59689\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-e929\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725551=Tl57i2AA5msYKmQD6D9b96oj05vzNG1l1CRjWQNFDIl0/XOB91wmnNIuwbzcvYLLX/+8PfesGrw5GUIZPSgoLImPW3qb6JVtL/D3VFmUZJ2JOKFTQEmo6Emj7kqSzJVgZ3YR6VcZAjkG+nzNcBKE087eIDc4XsCyYhU4Om61Apb3ZxYss03gNL9y0YZ3YnNG\r\nAge: 1109445\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: D9BF3B6A-FC1C-44E3-9222-CE920B074F94\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59689,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"f86c9671c7aed55212fe0eb5219a664d","sha1":"6e765dfb0ce3c646d8c808940071554e78e7d409","sha256":"4ba3fff550a17eff9585d6acbc4a96bd515149510f6a8bb7638985fb4b41a181","sha512":"706aa66f138a3459eaf34f5b7a8ffed3dfacecec6adf14a2e83f1149143cfbb059f97aaaac2032587a80c0e30c62e5b46b07b4dc6f3cf5925e6e1db2a8ed45d6","ssdeep":"1536:Cyp1EBaRnsFt9ZXZj0wEYsRvqm1waPbZsY:CLB+sFtzXN0w2ym1fFsY","tlshash":"914302f36beb0bc5b07adbcf4ed354f0067a71496b42dcd44f4120e61ea6199bac420a","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-14T18:21:23.282769Z","times_seen":2363,"resource_available":false,"data":null}},"time_used":2020,"timings":{"blocked":1438,"dns":0,"connect":0,"send":0,"wait":291,"receive":291,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/a2ff2b1a3cc747748a9f6b5df148e234?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.514Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/a2ff2b1a3cc747748a9f6b5df148e234?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 111393\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 21721\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"a2ff2b1a3cc747748a9f6b5df148e234\"; filename*=utf-8''a2ff2b1a3cc747748a9f6b5df148e234\r\ncontent-md5: YPHHeIvjFIo3Db9Z+RSr/g==\r\ncontent-transfer-encoding: binary\r\netag: \"FkzGoPe49FMiCNOSpG32h6wN42vB\"\r\nlast-modified: Thu, 27 Nov 2025 20:08:24 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: Pfq1ul4ym\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: -G8AAABwt8LIfH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":111393,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"60f1c7788be3148a370dbf59f914abfe","sha1":"4cc6a0f7b8f4532208d392a46df687ac0de36bc1","sha256":"4126bd04b0380459e079462b3e0fb5a0654b5fb6c7c259fa9a9244b7d317e6ab","sha512":"ef4df4afc26a68365c30da321b39daedf9ac3d30e6ccabcff1ba08158b26a4f84de64c627e3fda7a7132e1385bda4630124e5c4e647ac3804c2ff620bbf49d59","ssdeep":"3072:bgiOsXv2nWFW3+IbUHabVr6cAcnDYijDni4ZFCnqmoZui:Ter+krAo88ziS8qma","tlshash":"99b3025da51980d3a680a7a7fc244ea65463d3d7a386cc450e3aece03f3b97ce375294","first_seen":"2024-12-26T20:26:09.863194Z","last_seen":"2026-06-05T22:09:33.515007Z","times_seen":279,"resource_available":false,"data":null}},"time_used":2852,"timings":{"blocked":1029,"dns":0,"connect":0,"send":0,"wait":1287,"receive":536,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/879f6f5cf8dd445f9b212d7831722397?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.543Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/879f6f5cf8dd445f9b212d7831722397?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 6273\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 12738\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"879f6f5cf8dd445f9b212d7831722397\"; filename*=utf-8''879f6f5cf8dd445f9b212d7831722397\r\ncontent-md5: uYc8vaZLAWt3TtqZtyAyyA==\r\ncontent-transfer-encoding: binary\r\netag: \"FkPM0DhgFhUzK_DTlZyy2G4I7w-k\"\r\nlast-modified: Thu, 27 Nov 2025 20:11:02 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: KFPo231eu\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: EYMAAAAZWVD0hH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6273,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit colormap, non-interlaced","md5":"b9873cbda64b016b774eda99b72032c8","sha1":"43ccd038601615332bf0d3959cb2d86e08ef0fa4","sha256":"58fcbc95c13ed4b6d5c71ffa1420cec47803b99748e01d2034c00638731d537e","sha512":"7e48d7f17f262b9ebfc2293df5cacc031ce80d08fd3f2052b70094ec8030586fe2cedf567c5c9eb33ef69cea78cd9191ed047407ca93df4497235f514dace390","ssdeep":"96:FqQ+5OSzJwA5sDZGoyiA8AuMrOU+Wh9RPiJfwoLP+gBRmEyVjrLMasaDDpDSW3Xm:FqcSOAQZryVZCWwNxFHmrbzdeAXm","tlshash":"69d18dce2c0027e5990cce64f29868ac8d22147b1ad1780d87f658e627f681faab570d","first_seen":"2023-10-04T01:17:15Z","last_seen":"2026-08-09T22:07:20.17565Z","times_seen":292,"resource_available":false,"data":null}},"time_used":2415,"timings":{"blocked":1000,"dns":0,"connect":0,"send":0,"wait":1287,"receive":128,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_e9ecc337-e18a-4722-9eda-2e27fa32dae5.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.960Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_e9ecc337-e18a-4722-9eda-2e27fa32dae5.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:39 GMT\r\nContent-Type: image/png\r\nContent-Length: 132257\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=R6ay3E84DxQ2eKj1kX7LZPifcLveGmF8rVYgasm3gx6y7biHwcaasyLBC%2BfXhImtp0kc75Q9%2Bc6DMHe1eHxrNwYF9EyoFgAyFiGAuxlGmZt1Mu0m4t%2FGwJIFLqHk\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"5cdbeb01fd724f1bb7cab656a7f26600\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:21 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109449\r\ncf-cache-status: HIT\r\nCF-RAY: 9a1581956d1b07ab-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725559=cskfHawHGVxhGeXXtbZRur3v20bZg50TtEUYGl4CB3C2tLar2sd3hOaapB8duFFbayAPc/WKHjrnWYjhmntPkR89gmB2hPvJg7C+Ys/l49+TrCan2VyPmluK6mFY2NTBpy4qDTfI53ZS4vX72F7xV7pl/xWHuH+W7Jtxy/IML4gnutunucRYTNGKiRUz1AJp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 4B1AC0D2-290D-4707-93FD-A1FFE86DE598\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":132257,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"5cdbeb01fd724f1bb7cab656a7f26600","sha1":"cda5b8d10d40b3644d7338a4954bb2aacfd9ea42","sha256":"94ab7c32c0b1b4b526b394c0e9ef60da57601f69a4e57c155f689b5e8c7d2aed","sha512":"275c1f05f6dcb147ba73a5c089de897e605f4a4b758097024690aac3bcd9d8883bccadac6b8e02abe24673147fe431159f9eb0b1f77b0b556e42c6fd302bbf52","ssdeep":"3072:t3HnneSTvjcHceoD9xTo8pDbH6n1apXCp6f3nO5xe/VKUS:h3r289NDbHw1Ppq3PxS","tlshash":"e4d31286f50f3842f0f507f7ee699bbc8132b8185a76a08c2521faadcfdd1591b5c095","first_seen":"2025-08-29T11:05:53.29294Z","last_seen":"2025-12-04T08:51:36.794732Z","times_seen":238,"resource_available":false,"data":null}},"time_used":5831,"timings":{"blocked":4908,"dns":0,"connect":0,"send":0,"wait":308,"receive":615,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/css/chunk-common.1756903329400.fcaa3bb6.css","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:21.479Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /css/chunk-common.1756903329400.fcaa3bb6.css HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:22 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-340e\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725542=loAbgkj7GWx6iuZXUN8803wwHCF2tcMiMPh1K7jiPjw2nzUlPXgFYYntt8C+o4c+kP/Y4dl7q9hVWiVkghxclK2NAsYhlm3zqfjmYBpmPvKu4hGiLNJj950jQhd14O3ngI/kl/k50Yt97j9KKa34EbrRrMuA+on1Hbi/xHiRzaWydUSjJaRMKnKVKJhV4Try\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 774C5D12-07DC-4A4A-891C-1A774E017C49\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13326,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (13326), with no line terminators","md5":"826c687e5a03ee71f95d5348db199e55","sha1":"46d95f05e1da96866b57353cd147ecfe9f20f2dc","sha256":"daf2bc8bfaa2d7608bfcd21eb0a6aeda1d3452dc26f2b8577a7c69e599bb8d3e","sha512":"47a2d7bf1b9905ec12876df1008c5b7cd9da2ef5d6f72026fea2ef705e6b63bf2f88941c5b57b112aa663a612327e48e1e85da444a119e7187b615b4089da7df","ssdeep":"192:4dQK/X4cBY4mZGX1lsUTLA7gY3bz/i//LN4hHSQZA2VxM2XwKjv0:M8oTG3bz/i//LihHBrxP0","tlshash":"7852b831d635b53ce57be226f9d09adc6024d417e2730baeea653b3ac5ca4d215332c8","first_seen":"2025-08-29T11:05:53.265444Z","last_seen":"2026-04-27T23:33:28.249766Z","times_seen":1343,"resource_available":false,"data":null}},"time_used":1595,"timings":{"blocked":578,"dns":1,"connect":290,"send":0,"wait":421,"receive":0,"ssl":301},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/zeren.c0aa584f.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.167Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/zeren.c0aa584f.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:33 GMT\r\nContent-Type: image/png\r\nContent-Length: 3322\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-cfa\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725553=FS6tYjKh1M+gSmmjCJc7Z5ItrAI5uLtwq1ey+8G7hLKPEt2q0r/meEfJ/8cV8j9e63TaT2ebLNzsT2vLgNVjhogT5H32RN5gJMZnna7ohuq71psenX2MCWWvVWWDwpqniEmr0zYChgtCACgnZEUzjgk1DDYgAenPeOBM1Y+Fa3resLtB1I3RbJPLpvzCgg7d\r\nAge: 1109458\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: FB025746-21C6-43C7-8232-BC842923A01A\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3322,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 414 x 130, 4-bit colormap, non-interlaced","md5":"217588cbcd6216a09cac17953ae710b1","sha1":"de250755d284bb75dcee38ee45f2fc839987dcba","sha256":"24c2821b322d0c9087bcb0727dc0307311f6cfbb52af9f8a93308e48705f706e","sha512":"da190054ec0862c9927bb3bd928481459d53d4d778e9b2928c2507f2a34df5791d43adda750fcf184b767c1ba3a3f92e45dc57242a80869e253a9b37639abb4a","ssdeep":"","tlshash":"50616c01eb9130b8129c286701bd3fcda4c64d993d203d798d87b29bd6f970d288b123","first_seen":"2025-08-29T11:05:53.326961Z","last_seen":"2026-08-15T07:28:34.276768Z","times_seen":2437,"resource_available":false,"data":null}},"time_used":5426,"timings":{"blocked":5135,"dns":0,"connect":0,"send":0,"wait":291,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/65246.1756903329400.c090be2c.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.169Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/65246.1756903329400.c090be2c.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:28 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-11f2c\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725548=wdtO4M5R3pyBXDSDlSB9FD5ieOJLpGjZdfC4za9oCAyN1n8vLsGZ+z8auR/Dh4ykS+PCyBfoKyAMuN0NuIOnM6NbqsNDb1di2mTV1gji9F+K2Iou2dNtgjOROSr+yzTqg8c7tnLTv6/yv2kgFzbOjVLWKxGxOEpbx/MH0+yEv5fPjuQbFYc97dxvwU8Cbcw6\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 0B8DC8B2-3BC4-4D4C-883E-F0AA062CE5B6\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73516,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (48688)","md5":"9695de283c01f0fadf4795c612b010e2","sha1":"9e9b20c41d8eac731f465f87713f570eee532180","sha256":"82d3d78a522caa25376deb145964490b699e6d2c976ae6cdad15f2c4e57cfc7e","sha512":"5f583070eebf753cebbbad1720360c270ec09391ef530c0efb982a92e03b1a10689136cbb74c005fa386f20111b32a602557c0fdf5e2d716062da09d942e2f6e","ssdeep":"1536:r2+iDvYvNjx4Uyao0L8oDNzAuMMsTAQ0mqt2pXYzA4dANV1:i+iDYvPo0L8oZzAuMMsTA7mqt9zA4dA1","tlshash":"c773a501f78272384fa7e290220f2026e16d191505ac5bd8f179ffb93ef4954aa7d7b4","first_seen":"2025-09-04T00:49:32.778143Z","last_seen":"2025-12-29T13:58:58.019409Z","times_seen":420,"resource_available":true,"data":null}},"time_used":761,"timings":{"blocked":282,"dns":0,"connect":0,"send":0,"wait":478,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/LIVE.88ccbf98.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.106Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/LIVE.88ccbf98.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 61665\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-f0e1\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725551=Tl57i2AA5msYKmQD6D9b96oj05vzNG1l1CRjWQNFDIl0/XOB91wmnNIuwbzcvYLLX/+8PfesGrw5GUIZPSgoLImPW3qb6JVtL/D3VFmUZJ2JOKFTQEmo6Emj7kqSzJVgZ3YR6VcZAjkG+nzNcBKE087eIDc4XsCyYhU4Om61Apb3ZxYss03gNL9y0YZ3YnNG\r\nAge: 1115071\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: 23B851C9-CD13-4598-A863-E69041A4D963\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61665,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"372d01a2bda7ccdca1e7966af39c2327","sha1":"d438c1947b711d032c5621a6b4b08bbbca2c338d","sha256":"4eac7be4c06fa607ef5e95789e3ead43806bfeff97872ed6567e3810f2f661bc","sha512":"9f04160df8696cf984cd77604dddaea73969479e4f1c5050e53351df7f11e85d8ecccb14ecb87dcd58bea0ba04d9ba5ea3f99c69a179ba88ad38d5416b7a94d3","ssdeep":"1536:jTjrlfQBxhFWiXt2lnJE9mARbSK0k2C8ve1HfarCtt:jH1QjwWUC9mA10jC8WZfaQt","tlshash":"dd53124a2ecc3a1f7bf21e5e06f286814d36a186d0f9ba5bc6e70ef1218521de0e4535","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-14T18:21:23.215168Z","times_seen":2380,"resource_available":false,"data":null}},"time_used":1514,"timings":{"blocked":1209,"dns":0,"connect":0,"send":0,"wait":303,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/91c35614a25045a5a899d261fb674094?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.538Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/91c35614a25045a5a899d261fb674094?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 85245\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 19047\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"91c35614a25045a5a899d261fb674094\"; filename*=utf-8''91c35614a25045a5a899d261fb674094\r\ncontent-md5: s2WtDoXisby/Y/eg8vcKeQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FlqMtbTRYFVRe-qsbpalFULgRytm\"\r\nlast-modified: Thu, 27 Nov 2025 20:10:56 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: w8h4XCTcP\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: GJoAAABxzjE3f30Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85245,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"b365ad0e85e2b1bcbf63f7a0f2f70a79","sha1":"5a8cb5b4d16055517beaac6e96a51542e0472b66","sha256":"6d6b875c28d823fc72e52b4d4cd8f7c832adbce9ceecdbf4c9be41f00349826d","sha512":"1f03424999953553474d1da7326a39f9ada85437a41aeb6c3be03432906bb7598866b84181ca471165972cce2f1a6b81e0ea6f735ddf9e00438982e3b1fb5050","ssdeep":"1536:8o9jZLSJvy26uNIy8SWsNgRwJvIrTiIKu03nfrGBLLSW:dj5KV6unFWuvIyu0vrGZLSW","tlshash":"548302a34403759f8becbe9a169bbc20b6731bd2d32527a853055c7e20dd045c6767c7","first_seen":"2024-12-26T20:26:09.887304Z","last_seen":"2026-08-09T13:56:35.979558Z","times_seen":472,"resource_available":false,"data":null}},"time_used":2872,"timings":{"blocked":1005,"dns":0,"connect":0,"send":0,"wait":1287,"receive":580,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/0c079f02c7b948639446e5f1bcfe29d5?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.540Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/0c079f02c7b948639446e5f1bcfe29d5?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 113581\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 19047\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"0c079f02c7b948639446e5f1bcfe29d5\"; filename*=utf-8''0c079f02c7b948639446e5f1bcfe29d5\r\ncontent-md5: ChHnFLjMseKHUghXvWzwHA==\r\ncontent-transfer-encoding: binary\r\netag: \"FraOPrljDrunas9QWYsKdgt8gWL9\"\r\nlast-modified: Thu, 27 Nov 2025 20:10:56 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: DH70M5mbI\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: M2MAAACVzzE3f30Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":113581,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"0a11e714b8ccb1e287520857bd6cf01c","sha1":"b68e3eb9630ebba76acf50598b0a760b7c8162fd","sha256":"ad22fbb2a80750a62150119c95d1f1192c1b4083b000994e99431857f5fb6ec7","sha512":"641de85a2a2481828f89891bf8e460fe815d6063068b6140e72b673b97ad4550c7ada3f73385916e2245cc5b4307abf0146a9554da86ea3cf7d110fa0e3996b8","ssdeep":"3072:9BDBVGdym3OhOTQJPhBMpH1nB6yvPX4PS8TNEA1:LtVG8m+XJOVnBWTNz","tlshash":"6fb312761cece09e664f1bf1340084778e088649d966cfc18b6ce97f98b962c278d52b","first_seen":"2025-01-29T13:39:14.661465Z","last_seen":"2026-05-24T05:41:01.341666Z","times_seen":393,"resource_available":false,"data":null}},"time_used":2923,"timings":{"blocked":1003,"dns":0,"connect":0,"send":0,"wait":1287,"receive":633,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/f0600e57-43d6-4af4-8f1c-08ad10ecab8d.jpg","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:32.373Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/f0600e57-43d6-4af4-8f1c-08ad10ecab8d.jpg HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:34 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2xdhBb5oPuWBpq2f1hl09G2hNo6HJYOvcFFELNiV3U4CxW6S5r93FLfdd8eYHbn6Piq5xdwkGTItlBqFWkjevuqCu1UTgROYuPw3M9HvwEb6EHyo8GKxhuawwA%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"a66ab14232d9530ba56c6b3cf1a838ce\"\r\nLast-Modified: Mon, 25 Aug 2025 07:06:16 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 14999\r\ncf-cache-status: HIT\r\nCF-RAY: 9a7f4f9d2f24dd4e-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725554=9tILU5qlmfKwryxioowcE+FLXcwgmpYyFhaH7HXP07KNzQUcHECW0Mz2zbfqluseaatlMoYan5rIo0uSjiQuscGqKxMlLZDD2UE2MiPCskAPBjr0nABeZ7TfUQCz6gsoD7VTyiGOgjv1f1cRAwukP348YK+0Xd5CGVhKiy6WIT/Qd5yWJV7V9zTShTPM7A+G\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: EDCA3516-A749-4379-A6CE-28622FD7F0A6\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":396057,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"a66ab14232d9530ba56c6b3cf1a838ce","sha1":"7e1bd193a64756193437d09ab24ad5d6f9c1651a","sha256":"0baad519e4642a8a4454ae51b511aa61c9619a1825d1e5e29265e1009c0dadbf","sha512":"f146ae5c96ebc25388e2a67ead2f02256a7b49452031debe3ceea88efa07a1699302508dc2480641c2283786649dbad3d619a3eda67546e2180b2fe2179fdb54","ssdeep":"6144:RnkD2g7Xp2j6ic0qwwyN3TV9rOxsiitOVWkjtA8xsf5eCnqLhAi5iZS8fVSA:JQ7p2j6rxwwyNniM+WkjtAgErq18k8fV","tlshash":"668423b2c8fac94a736bf975649d99469024fc4f36df5cf9e1249c2f7602a32690813c","first_seen":"2025-08-29T11:05:53.269151Z","last_seen":"2025-12-29T13:58:58.048972Z","times_seen":342,"resource_available":false,"data":null}},"time_used":4085,"timings":{"blocked":1981,"dns":0,"connect":0,"send":0,"wait":587,"receive":1517,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/64369.1756903329400.27cb8135.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:21.496Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/64369.1756903329400.27cb8135.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:24 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-269de\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725544=qUQEP8SNYPTGOqrcZx6Dtd4Jed1q+9haGbuQqFtaJYiTmhLqOkXAcWFVmV4rrX1x9NTL2pweDaExL8o8r0aif/AN3jKc6T1Gs9EWk9625NhGGo5IUCcgEH+baY4vQXKFuWHAEjloy/Ka5vmsirI3m3axmdakL2OX9yVI469rp3IUqp3QDYkavuef+a8JHKvR\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: 2FB0828C-EA2B-4A72-9F27-F96CE38072D3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":158174,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"ce99014ab42559bc99f808a69bf596c2","sha1":"adf52a59aba8080dae7b97585e346f5aa782141f","sha256":"39076e64a0e5facd6f6f3d4db7f7fa71039c87d4a6250298dd4bd3059bfd9863","sha512":"ede23f1e36658737f40782ab61a166f1a2a6f61957524beefc283035c39337325c487d6236975bd97cf44aa91b31ed6985a3416ef561edd5b977ff02fb6b1b54","ssdeep":"3072:cHW7tB4Vgj5tNlxyU5YegxYffj7TEOiG1Zl+DJVkzEcx1nKR:cHW7tBwgttXxyUtffjAG1T+DJVkzEcxE","tlshash":"6cf31bd4f2c070f6475f45f2a22b1075b26f4d92318c98b0e15ba6597f21a48c7abeec","first_seen":"2025-09-04T00:49:32.946075Z","last_seen":"2025-12-29T13:58:58.086406Z","times_seen":434,"resource_available":true,"data":null}},"time_used":3321,"timings":{"blocked":2509,"dns":0,"connect":0,"send":0,"wait":477,"receive":335,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/641518a8f6174e4db6262653ff45e0bd?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.544Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/641518a8f6174e4db6262653ff45e0bd?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 27999\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 12737\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"641518a8f6174e4db6262653ff45e0bd\"; filename*=utf-8''641518a8f6174e4db6262653ff45e0bd\r\ncontent-md5: PoCe5WFU4TkC3z7XMwGrhA==\r\ncontent-transfer-encoding: binary\r\netag: \"FmM1JhtxD8aZ5daujxQvunckdGxJ\"\r\nlast-modified: Thu, 27 Nov 2025 20:11:03 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: 7KIAy016J\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: AJkAAAAuTmL0hH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":27999,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"3e809ee56154e13902df3ed73301ab84","sha1":"6335261b710fc699e5d6ae8f142fba7724746c49","sha256":"1f57ed40cc438793e3dc2ea7c341665932a1168df576aeebaa698a11a12fd0e4","sha512":"63dbfcd47f91f319dd17a994c51e8ff393c9c052a024a4e7a749d9d8cf55ff4069e8779f446e13fa59783eb1de662f8701640295a77fd94ec0595684f7a0a35b","ssdeep":"768:KAB3L4pHV8zSOvFYm/V/e7lbBmH+qrXpfvMY4ldWDHcAPNZsp:BFcA3/1e7Z857ude5wp","tlshash":"80c2e1c610dccf22370b96fac580a95d1bbefc9436935b4ad387756089d4b2e80651fa","first_seen":"2024-10-24T22:52:54.636945Z","last_seen":"2026-08-09T22:07:19.761682Z","times_seen":239,"resource_available":false,"data":null}},"time_used":2414,"timings":{"blocked":999,"dns":0,"connect":0,"send":0,"wait":1287,"receive":128,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/ce7a8182b54d4feaa1728daff7eefa26?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.555Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/ce7a8182b54d4feaa1728daff7eefa26?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 5985\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 9130\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"ce7a8182b54d4feaa1728daff7eefa26\"; filename*=utf-8''ce7a8182b54d4feaa1728daff7eefa26\r\ncontent-md5: 6fY4+W9LgTJ6MSCIGp9a8A==\r\ncontent-transfer-encoding: binary\r\netag: \"FqKFAafJNzUg4wrm-tosP4MWRUHA\"\r\nlast-modified: Thu, 27 Nov 2025 20:11:06 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: WVHOmS0qZ\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: sSoAAABODCw8iH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5985,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 179 x 179, 8-bit/color RGBA, non-interlaced","md5":"e9f638f96f4b81327a3120881a9f5af0","sha1":"a28501a7c9373520e30ae6fada2c3f83164541c0","sha256":"987a3baa2fdfdc872f6b5ba040d9afbb48e0767ed62c3fff4f8d1a24ad3869fb","sha512":"c58665e068d2c82fb9e7ded516fff4244853035f814b7f7afdbafaa9417616c5c890cbaa7879ac95401c0fc1158aa7c984fa81ef66e7e436f1cf5be9ddf4febd","ssdeep":"96:ZeChTFtuNHFpKQ3+lMsIg9YK1aK4vulkZjwVRDjWXh/UJ6Pr7WPQVpl+M:ZeCxiFpKQU/haK7fRICZPQsM","tlshash":"13c19e374ae472226addc0b2115dd2b85eba97ed033a6ecc4d1dc525f7a33098ec60d0","first_seen":"2024-08-19T15:20:18.579068Z","last_seen":"2026-08-08T00:56:42.257851Z","times_seen":253,"resource_available":false,"data":null}},"time_used":2667,"timings":{"blocked":990,"dns":0,"connect":0,"send":0,"wait":1308,"receive":369,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_de72e240-4300-48d6-8f6e-b9cb363e7924.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.954Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_de72e240-4300-48d6-8f6e-b9cb363e7924.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:38 GMT\r\nContent-Type: image/png\r\nContent-Length: 117698\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mybiRYqVJ2x5aUH9u1GKfaNOITP9uoI6%2BTht%2BenTf6cjvHtj5xE6OOww2HcT9evIk9FLmrm5fJ78m0QynTPmsJiBxiA20EkCTr9Jbvt30LOMUTAZhSTn3JxxnMIb\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"875d51b8597a97b96daa5c4c3eaafefd\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:15 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109439\r\ncf-cache-status: HIT\r\nCF-RAY: 9a1581ca6bfc8b32-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725558=CqU/qJIsoXMX7Gvi171YHqR2CQBtd5s+x9S73uNZlw2A3tlbc9+spA/CvW4Gm6DHJ1dMf2zTE8k58Rhrl70ihx3AV1eZaITtST6ZQhVQZ3ghB6qZz+vzHVTtt0vWUxKAvALFWrFGl0r/jxJMUvTXlSY9LSeq7ejV6cKXEUguF279zmB10apsNqAYt5NztE7E\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 1DB56646-6202-4C0D-863D-61BB8BDE9D39\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":117698,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"875d51b8597a97b96daa5c4c3eaafefd","sha1":"bdbe15944aacbb25d3795a9882751bab0e25aa41","sha256":"5cd3cd5c2a9dd3c20ddbfbcdff886459c3dd0a3bede9ce34e1daf9059e375ea0","sha512":"718dbdb9f5dd7fe65fbcf893c416cf87efecd27eb6e9f8af92efb0cb0f5ed2831fa5a805b510322c7232db68a958b29d6bb9b3dc9ee1f0f811ef5579a71e0289","ssdeep":"3072:VqUdofN7Rg/0SAT7MpXyPJ1ZpIZlUij14AtAR9e:AUstSAT7vPKlUij+DR9e","tlshash":"7eb312f3e46e905be7bf016c22329c100d7905aa9b7e48d6a9d34b221cddeb2dcf4554","first_seen":"2025-08-29T11:05:53.31739Z","last_seen":"2025-12-27T06:51:48.781217Z","times_seen":291,"resource_available":false,"data":null}},"time_used":5519,"timings":{"blocked":4592,"dns":0,"connect":0,"send":0,"wait":309,"receive":618,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_aa2a4724-288d-4252-82c6-453d0458d8c1.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.974Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_aa2a4724-288d-4252-82c6-453d0458d8c1.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:39 GMT\r\nContent-Type: image/png\r\nContent-Length: 117319\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kt5HGgveyVMQWrPL207AuCUS7nTDgXo1v%2Bu8k6SAGflGv%2FOtGM%2FcV%2F7XKHexEELGbdp9dExJS0lc0SRunyl%2FSyZStrv3d4jhL5evtfNp34AqvdK0rR5bipMXO0uD\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"e77591741af3e68e5fe71d23ae4370ff\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:17 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109451\r\ncf-cache-status: HIT\r\nCF-RAY: 9a1581872b32f51a-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725559=cskfHawHGVxhGeXXtbZRur3v20bZg50TtEUYGl4CB3C2tLar2sd3hOaapB8duFFbayAPc/WKHjrnWYjhmntPkR89gmB2hPvJg7C+Ys/l49+TrCan2VyPmluK6mFY2NTBpy4qDTfI53ZS4vX72F7xV7pl/xWHuH+W7Jtxy/IML4gnutunucRYTNGKiRUz1AJp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: E9323ABB-112E-4647-9352-D6E55910B98D\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":117319,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"e77591741af3e68e5fe71d23ae4370ff","sha1":"ac4d530b4ad25b0dc275d4a16d0a93c649aa5822","sha256":"b2c2bd6de89142477d0cc668277e5a8dc737a7b09e85a8ea98dd59e3879154e1","sha512":"20daacb87078c7f45478e325e17d9d824653899ff15e004f41a73dcabd668cc011617bfa0526b8e00020a79cd0928b6837531f0333bdf942afb74e923e6dc51a","ssdeep":"3072:A+kUtq3tYWiGRJMf+5rzUZpd3F/WKDT7PPrJdd1fExWh:AeqmjiJG+5iF/W0/nrJdfQq","tlshash":"5db31280331968a5c586b83636766d969cb5ec36b347060ff96cd0a814428cf6f9fce9","first_seen":"2025-08-29T11:05:53.117443Z","last_seen":"2025-12-29T13:58:58.08881Z","times_seen":295,"resource_available":false,"data":null}},"time_used":6433,"timings":{"blocked":5817,"dns":0,"connect":0,"send":0,"wait":307,"receive":309,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/home.1756903329400.bfa8c420.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:27.402Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/home.1756903329400.bfa8c420.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:27 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-2d959\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725547=ZeBRC80LTJHPPI7+oQOCUenUy6TYZ+KmFrw1JR0Iyyn8PAFS0kApFMnQKAyo59yPniskPq2Lp+EsfxmzuOlqtRplgWv8rGdhxZn46bK9M3+DE3/dryCYhCjyAiWHjoVeSJa831Y7QVBSZDFuG3DPWuN+XIeSJ0XS1R/EL72IF40w40mrTtjwo5ru860rvzzS\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: D9EE7C33-DC82-4B40-9F0E-5521B7195025\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":186713,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64200), with no line terminators","md5":"caeef6f42deb46a855ccb60a2ed5b445","sha1":"13594059c305a13f3f001270017ab9aaa21443c2","sha256":"ede9bdf96f357afd7f61662fc1654334932bdf9d3e0ad7e9581a792bf2912530","sha512":"0f28cdf6693505cf9c674caa54a226cb16de87aead1b75244f3c6e68ee5d206b133b3e5f081aa9a1db2b285e8ac607f1a1a289401afb0b6404b3e2865d0d9d03","ssdeep":"3072:f1E8oNSIMrtwsAFJBuokQvFUqlGSBJZhxffj7TEOiGRA3:f1E8oNSIMrtwsANKUFHzffjAGa3","tlshash":"c3040880b5f0e275575fd2bbd7371024b22b1686d0ccac60e1f66b187e18799b236db8","first_seen":"2025-09-04T00:49:32.93504Z","last_seen":"2025-12-29T13:58:57.964054Z","times_seen":424,"resource_available":true,"data":null}},"time_used":512,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":479,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/bj2.a8fabbac.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.159Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/bj2.a8fabbac.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://y108p.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 360604\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-5809c\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725550=EnwJxt5GEWZDoy2zM7O5VXjcyuKd9QeUQschlibf8N338Aywly3eO288QFLQVHJlDyo0pDjxpxgKkpZBHYec+tXMDURhFCbrUPeFgavax+z0IHuK0xhcuNPttVS5GyOXCrGmvQfb7udRo95bcQln5pJocaMrGFQivBnHGp5AthjDtr2jbX9R+GmiXuhzQg6n\r\nAge: 1109457\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 134206E7-EB1C-495C-8BEA-5E3F4C15A3E4\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":360604,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 641, 8-bit/color RGBA, non-interlaced","md5":"e0fe8ffeed1841f74df53c3b0c1f2db0","sha1":"77bf6dfe664cdc936776654af151f49368479ec3","sha256":"db4d87e8a403e388c54dd5d114b738c82e1d2dbe65b95630fd5782179f0d7d54","sha512":"825bf73262c2b613b6a8a8397f869db6b2cd4118e554689d228503e7a04c4e674d49c5649e4ac8e2423a7b526c0f6621c259566d0e9bb6ebfa0712a7352968fa","ssdeep":"6144:iAHwIFRCiRIygxWS9v34xfZzuwbIYGzl8BPp0eIiOk3Fg7la6RUIs4pU2:rwy0IgxDEfQwbjw8dpmiOiFgpLHFU2","tlshash":"2874238d711d48cc9c9b45003dd82d9e1c55aa2f7aab20b58264fed24d17ddeec0ea3b","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-15T19:18:34.475688Z","times_seen":2551,"resource_available":false,"data":null}},"time_used":6982,"timings":{"blocked":2282,"dns":0,"connect":0,"send":0,"wait":309,"receive":4391,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/api/sport/match/list?sportId=1\u0026client=web","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:29.003Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nx-request-source: https://y108p.xyz\r\nXign: ow8QjwWrbth/yhLyGGwU6TIjtgkfCoLHpv4ARUNG3zW6jmHwOYOH5MbOuMK3L+Lm+RqFTQl1ALl5NfD49OoT0sLyTQE6expgAKGf8qOszsj3TZ8H37YPg9Dvo5U71TM4Ix/uOelKkzokb2KRP8IFImxw5vSbO7N17c5n3xTOZn8=\r\ntimestamp: 1764725548978\r\nsign: v7fk2p78613m6f3r\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: rEfAYkDGbEEF5yTzpkNZQfYMBdt5bAF3\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:30 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725550=EnwJxt5GEWZDoy2zM7O5VXjcyuKd9QeUQschlibf8N338Aywly3eO288QFLQVHJlDyo0pDjxpxgKkpZBHYec+tXMDURhFCbrUPeFgavax+z0IHuK0xhcuNPttVS5GyOXCrGmvQfb7udRo95bcQln5pJocaMrGFQivBnHGp5AthjDtr2jbX9R+GmiXuhzQg6n\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 56E8329A-5ABF-4E12-85E9-6F392F2D9C07\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11733,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"564f0bcfef33f993a8a93fcdbc8b66a5","sha1":"a226ab3a5b144379cfa86e251c2b0196ab2d865f","sha256":"867d63cd297a203360bf014d6dc66d8cbd398160c91c439d4b8cc1d72e3bcd0f","sha512":"84bac30d6db4fc053a41875d4cf5725a7737e36b705cd29b9c02915fb603525a17e7daea7f0c03eb83db8da4b68917fe447adef3f22e5fed40dcd61cb1e4f08a","ssdeep":"192:eGRkgqChKan+RzVsB4c8E9McgeOMRzdJD3xw/U3RodmfURodCrWRodSAQnRod2/B:eG2LCX+pqB4y9qeOMpLD3gU3S8fUSsrk","tlshash":"3f32ef5281dc18e52b9c21d65d4e3f4d987eaa5b0a9ef9d5ed4ecf0c20b43fb5200e29","first_seen":"2025-12-03T01:33:08.818851Z","last_seen":"2025-12-03T01:33:08.818851Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1266,"timings":{"blocked":738,"dns":0,"connect":0,"send":0,"wait":528,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/5b26803eacdc498fb7115cfb43e53155?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.521Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/5b26803eacdc498fb7115cfb43e53155?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 54142\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 21721\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"5b26803eacdc498fb7115cfb43e53155\"; filename*=utf-8''5b26803eacdc498fb7115cfb43e53155\r\ncontent-md5: CWi7ioZE+0S1gcSetpb9LQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FnQYmDIF5GNICdqo4E8jzlTRV9nu\"\r\nlast-modified: Thu, 27 Nov 2025 20:08:26 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: dJCMBq0V9\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: HnoAAAA55sTIfH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54142,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"0968bb8a8644fb44b581c49eb696fd2d","sha1":"7418983205e4634809daa8e04f23ce54d157d9ee","sha256":"87dac5ec07340804d58dfe54c5a20e20835bc1c5dd066a34215422db25637830","sha512":"baeec27cd7d7e3f91b477fc26d873af98bc556d067b5137cd599cc87f965abd66095ddbb475b3dd3144ce28031c71bd07c9ee285e3b553d283aea71440b8f095","ssdeep":"768:iSDik3Jwb5VEi07aI2bujTteEfk0zq3QqEGFGAeaynrIY44Z/ZEr0jLtggEnHWzE:iSDiR67aI0ujoT3QqXGA2rDTjZgdn2zE","tlshash":"d33301ec8fd6338627e464bbd344d25a898ddb16c99f08a4ff467afd6865911328002f","first_seen":"2025-02-04T17:13:00.980594Z","last_seen":"2026-08-08T12:57:06.98618Z","times_seen":197,"resource_available":false,"data":null}},"time_used":2868,"timings":{"blocked":1022,"dns":0,"connect":0,"send":0,"wait":1287,"receive":559,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/f0f83841-a720-4f18-8acd-c726f4c1e685.jpg","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:32.371Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/f0f83841-a720-4f18-8acd-c726f4c1e685.jpg HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:34 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jw6%2BHKpPtCxVdtDJBPE6FJR%2B6rCfnG3LCcOPgQEo2SjH%2BkpraSsEYm74F%2B7g3JAof8Fg6maHD3yEN9wsqO0%2FwTQd1NXoyusto6Dq0taN5yOlOnZj%2FcM%2BiuaSZQ%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"9a51e62132d61aed9329d3365be2ebe0\"\r\nLast-Modified: Mon, 25 Aug 2025 10:17:44 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 11927\r\ncf-cache-status: HIT\r\nCF-RAY: 9a7f4f99dbb1d4b4-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725554=9tILU5qlmfKwryxioowcE+FLXcwgmpYyFhaH7HXP07KNzQUcHECW0Mz2zbfqluseaatlMoYan5rIo0uSjiQuscGqKxMlLZDD2UE2MiPCskAPBjr0nABeZ7TfUQCz6gsoD7VTyiGOgjv1f1cRAwukP348YK+0Xd5CGVhKiy6WIT/Qd5yWJV7V9zTShTPM7A+G\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 3C0BA016-C556-4B97-BB98-7772529DAC5F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":363024,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"9a51e62132d61aed9329d3365be2ebe0","sha1":"ba931e82f0a0d6918ce044f0f615558efe8be66c","sha256":"71597c4dfe22a7312b692b0cd0a2f44582566617510a23883a44e84045882362","sha512":"9d94dc049160f5dae8daa5ac6038b90087c0093987feac83bee54a97063ee0b46a60f8ee5172d1726662db7c938489fb08f99a98df4020ab2756be9f83751339","ssdeep":"6144:QQgiqnqSjhCWWT0HqPrWJehmhH6rFITZWJEkA0DmfsskR7s+kQXpNhd3:QYiqSFMT/jWJehyaJLEFssE7O+3","tlshash":"e37423928e8f8c8257bf9f7114027c4e9048dbc6b9d107e05238de998efe508d6ac68d","first_seen":"2025-08-29T11:05:53.128791Z","last_seen":"2025-12-29T13:58:58.049671Z","times_seen":343,"resource_available":false,"data":null}},"time_used":3889,"timings":{"blocked":1534,"dns":0,"connect":0,"send":0,"wait":510,"receive":1845,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_ebfde7c7-fdc6-4b58-9f46-2e709f79d7d7.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.928Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_ebfde7c7-fdc6-4b58-9f46-2e709f79d7d7.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:37 GMT\r\nContent-Type: image/png\r\nContent-Length: 443950\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IRwrBnq87yJeCbI8fMOxtL%2B9duVxGbplK4%2BR8cUJhNfNcyUdpZWGPDqXx2XUTDCW2kyqbUQqBb1IleT84BIoV7DzazSw2GumvNxjpI%2BX4AdFWe4Q0inMN9hgxC4R\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"0a0b476de0285ffcf9a077b66808908a\"\r\nLast-Modified: Mon, 08 Sep 2025 20:42:36 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109448\r\ncf-cache-status: HIT\r\nCF-RAY: 9a15818a8df00719-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725557=scDVPKsbbAvx99LhIgALuOPSdX6xYY3HutBVudy+Q6HpGDBo5Z8Q2MjTgtiiiMRdMqGW7aug6JpNd55oNOni2BSumL5UI/LYwxuuMVJR3+2BO5rdD/DWiwrepZlKKf4ZjTsDUmRXj9vcCn+dNQYwChw2JyHAehyMDmkgxABV5TLoR6AGNQqjIYRKXNMCVGfp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 94E2D0C7-7613-44BE-B874-6F229232C9DC\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":443950,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"0a0b476de0285ffcf9a077b66808908a","sha1":"c69f9c378ad5b92541d6461966f4eb1e26b5c1be","sha256":"5facd22044586932e08dd8884be7e0df1e6e6e383fa62e4a48e15588173d07e3","sha512":"2354f610c6afb2176c92d08255f091daa234022a17d7baf02641d4599b6efe2845f87b1a5435b2967f9bed66f40ed7cb968fad0cf8a52f77aa023324c110193a","ssdeep":"6144:aJG2OHBVqe8TgOuacNjojaE3MZ84Zz61zNnHeCZWDuWGthjzDrhYunDrofVLeSkD:wG2gXt8TgfKBcZV+DHeCZjWahjDh+VL0","tlshash":"f89423cf58d732c138082647369bd27a71424367682558eccfd28c4e21987ede996baf","first_seen":"2025-08-29T11:05:53.304655Z","last_seen":"2025-12-29T08:12:31.375235Z","times_seen":287,"resource_available":false,"data":null}},"time_used":4295,"timings":{"blocked":3045,"dns":0,"connect":0,"send":0,"wait":311,"receive":939,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_fc0e1468-bc71-4d42-9849-b6735b50978a.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.940Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_fc0e1468-bc71-4d42-9849-b6735b50978a.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:37 GMT\r\nContent-Type: image/png\r\nContent-Length: 115787\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GJGYamfaQoNKcsj2FHjJedEatrS7sYtJ3JE9UnpYr%2F0d%2BbApFJrRi9E00emmaaclruCB%2FHWxm9iNkDMTjduuYJIFF8F0byp9s%2FX19YhHUoiw51hvKzn1RHDvrglo\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"abd281a4af5a65d4299fe253a6e4ff61\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:10 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109449\r\ncf-cache-status: HIT\r\nCF-RAY: 9a1581876db806b9-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725557=scDVPKsbbAvx99LhIgALuOPSdX6xYY3HutBVudy+Q6HpGDBo5Z8Q2MjTgtiiiMRdMqGW7aug6JpNd55oNOni2BSumL5UI/LYwxuuMVJR3+2BO5rdD/DWiwrepZlKKf4ZjTsDUmRXj9vcCn+dNQYwChw2JyHAehyMDmkgxABV5TLoR6AGNQqjIYRKXNMCVGfp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 81577F21-462E-45DB-8DFA-9ECEE2B3CD76\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":115787,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"abd281a4af5a65d4299fe253a6e4ff61","sha1":"fe83384c6f30f0d8088265253b05e664caa94b06","sha256":"e24c3350cac84789d5b9b5de7aabfe3203feb5f681d7cb27fbd637743754df57","sha512":"1ca10fd3aa8a6d8e4a2c1a47d701b1c59b7aa433aece4f6652ea0d24ba96c3d4a52078be3f26181283703f4e4f18e63fc9768d292fba09d96b9e8ca3ec5ebfb2","ssdeep":"3072:AaljLBKFeIcCPcF7fAV+e05d565c8T8mcArg5f:AsnBK7PcRAV+e07SRT8O4","tlshash":"abb312b5d477e069d8289f498b430092f5bea1a234ea0c726cc552f3165bdbe1ccca5f","first_seen":"2025-08-29T11:05:53.198537Z","last_seen":"2025-12-29T08:12:31.363529Z","times_seen":297,"resource_available":false,"data":null}},"time_used":3773,"timings":{"blocked":3159,"dns":0,"connect":0,"send":0,"wait":306,"receive":308,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/bj3.a7dbd558.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.161Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/bj3.a7dbd558.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://y108p.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 5835\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-16cb\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725550=EnwJxt5GEWZDoy2zM7O5VXjcyuKd9QeUQschlibf8N338Aywly3eO288QFLQVHJlDyo0pDjxpxgKkpZBHYec+tXMDURhFCbrUPeFgavax+z0IHuK0xhcuNPttVS5GyOXCrGmvQfb7udRo95bcQln5pJocaMrGFQivBnHGp5AthjDtr2jbX9R+GmiXuhzQg6n\r\nAge: 1109456\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: BF180794-5231-4B0F-AA1E-44ECFFBD24D9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5835,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1003 x 171, 8-bit/color RGBA, non-interlaced","md5":"b79234bcd23ce7e063481b3605bcdd45","sha1":"eace4c48cc352cfb10fb6fcffed50748f18aa78d","sha256":"2dbca2ee9a515b178cb6a5ce670a5dafa30941ad8c753fa3e94642f8dacca13d","sha512":"40fa685181391f1ca805440f53683045d1fbd5c0f36cf471f53641c6f289481f42fefc4d1f2b2fdfe8a20d7488ef0537f10352492e46af76770b49fe8876def7","ssdeep":"96:brOIaX7VK+RUSrZ3rnZ1L++y+hsVoK4CBVVikox3n0muoE7Nqh7zwGto:K7VK+RBZ3l1i+y+3peikr3oEJqh7MCo","tlshash":"91c18f03f313ed339b875f190abe4dc3498b2f9a4725a7d6285b5aa89654819c062e82","first_seen":"2025-08-29T11:05:53.328141Z","last_seen":"2026-08-15T19:18:34.469602Z","times_seen":2619,"resource_available":false,"data":null}},"time_used":2578,"timings":{"blocked":2287,"dns":0,"connect":0,"send":0,"wait":291,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/30a7de0f1d844ab285e7bdbf112acbf3?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.462Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/30a7de0f1d844ab285e7bdbf112acbf3?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 16765\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 90144\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"30a7de0f1d844ab285e7bdbf112acbf3\"; filename*=utf-8''30a7de0f1d844ab285e7bdbf112acbf3\r\ncontent-md5: IeEVyPCuH9W/84cmPUugjA==\r\ncontent-transfer-encoding: binary\r\netag: \"Fs7YtZkJeaJuQTTGfWxWmRVLVaQH\"\r\nlast-modified: Wed, 26 Nov 2025 20:07:48 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: HsMGjmIfq\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: FjAAAAC-Os2NPn0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16765,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"21e115c8f0ae1fd5bff387263d4ba08c","sha1":"ced8b5990979a26e4134c67d6c5699154b55a407","sha256":"a935327ee707b3689c3fc90037bff01d181dc6f0088db095329b48897f8ca4ef","sha512":"3ddb250278092ea2559da5012d26c74ec997d340df8722288cb84e5d3f163359f5f2a1943465c13dd871b944f8578dc9807c73b4c940d994f19d3266bd2f059d","ssdeep":"384:cv2fOX7d2KxImfW/Ka7MA0i3idjLPw0htSavPvf04iMEfWbFM:cv22LdLxIme/DN/A/3SOvf04infWbm","tlshash":"4672d070d4310aaba8b97bb3f9c508e7c946c1bdb33b95937679a003814a450ed963a9","first_seen":"2024-08-19T15:01:26.193141Z","last_seen":"2026-08-09T01:57:58.531955Z","times_seen":210,"resource_available":false,"data":null}},"time_used":3060,"timings":{"blocked":1085,"dns":0,"connect":267,"send":0,"wait":1306,"receive":120,"ssl":279},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/415b0a4bd93e4e7185f77cee60ab81e4?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.504Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/415b0a4bd93e4e7185f77cee60ab81e4?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 14098\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 21721\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"415b0a4bd93e4e7185f77cee60ab81e4\"; filename*=utf-8''415b0a4bd93e4e7185f77cee60ab81e4\r\ncontent-md5: kVNt5ypPx5lnS+gPX2r4bw==\r\ncontent-transfer-encoding: binary\r\netag: \"Ft9XWuUYQLSmib8Y_1r3H7QfT5ow\"\r\nlast-modified: Thu, 27 Nov 2025 20:08:28 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: GluXfYV9G\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: lrwAAADEAJzIfH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14098,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"91536de72a4fc799674be80f5f6af86f","sha1":"df575ae51840b4a689bf18ff5af71fb41f4f9a30","sha256":"9a07fb612ce17f0d6de8b1c5bc1687da5340b2aa29cb9bc17ecff53c202c7e06","sha512":"930a68510daf0f5f5bdd74d41bfd25c2425b36fa39a62d7ef9e1828da6b4160d1b4c460451059318732185efc37dec77e574bba0d22756a764f2326b147a622e","ssdeep":"384:s+jw1P4UXdOuVTRoreoeuX6b4LYIwMgwJX:BjwFnFR4eYqb40bM9JX","tlshash":"0552c1edcb14b4fcfcea60d5a550a152ba2e103d407f115194b5f6a3ec6067562c0f37","first_seen":"2025-02-26T15:38:27.684348Z","last_seen":"2026-07-22T10:03:29.794433Z","times_seen":213,"resource_available":false,"data":null}},"time_used":2424,"timings":{"blocked":1039,"dns":0,"connect":0,"send":0,"wait":1287,"receive":98,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_91f2d885-8341-4928-bace-352c8c691bef.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.977Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_91f2d885-8341-4928-bace-352c8c691bef.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:40 GMT\r\nContent-Type: image/png\r\nContent-Length: 21794\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VXJNTaDS6blMSOz3Z6TZuSU%2BCm3FqbwfDs5bTu0Wirf2fm688lut80RErCDV6bSLjZkifnMXME6Z7pC4wjppuGbjoaxwAkE6S5oHgyLKN%2BBC70QJ4TqBf5BVSA%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"05954182d3e76bcba1d9910b7be852aa\"\r\nLast-Modified: Mon, 08 Sep 2025 20:50:48 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109451\r\ncf-cache-status: HIT\r\nCF-RAY: 9a15818dfc4fd4b4-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725560=wHXrE1F/X1qgErX9nr7aClmx2aoDvmTjxDD3Fva4lVmI/5p0qyaCxjVefIzX7y3r+fgjNYnJA8N7l98RwMtZmhDIkJDZObNycr+8i4PJ0xykm/qi9TjMSwSNUV19Yb50LdOVkl4dw2sNt9HavVWq/ABuXgTNxwnCIQIziZDVivyUNIoU5PWku4ZyrZqGx0Yd\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 8874EF16-3915-48F9-94CF-CAC4B2339F83\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21794,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"05954182d3e76bcba1d9910b7be852aa","sha1":"3617dd01f0d33d63148a64c12fa0fc800d5329d9","sha256":"74e1f25ab615997c5ccbc6b22e6f6f8ad738fc1b4f347ef2161aa7e0462fca0f","sha512":"b3979ea799e42e976794e05449f2345983d6ca8b5fa3a8aefcdd0361a6eed1ee9bf7099339cba4e814c468077d65c295028093b54b92adbe681dac638a1a47f7","ssdeep":"384:ITj2Gcb4jiuqtG/BJCcX6w849XLCXk4jaQR1SkZPKNCFDWDIzDH9M49r9b:ajk4j/yOhl7CXJ+QLSQPKNeN3v9Zb","tlshash":"c4a2d1f94f476cb8ed9f14b4a37d1360d3a85b8af12197ac12d31a6cdde04321a15aac","first_seen":"2025-08-29T11:05:53.291531Z","last_seen":"2025-12-29T13:58:58.043263Z","times_seen":299,"resource_available":false,"data":null}},"time_used":6225,"timings":{"blocked":5933,"dns":0,"connect":0,"send":0,"wait":291,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/CHESS.80cb714e.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.108Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/CHESS.80cb714e.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 58759\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-e587\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725551=Tl57i2AA5msYKmQD6D9b96oj05vzNG1l1CRjWQNFDIl0/XOB91wmnNIuwbzcvYLLX/+8PfesGrw5GUIZPSgoLImPW3qb6JVtL/D3VFmUZJ2JOKFTQEmo6Emj7kqSzJVgZ3YR6VcZAjkG+nzNcBKE087eIDc4XsCyYhU4Om61Apb3ZxYss03gNL9y0YZ3YnNG\r\nAge: 1109445\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 3B7AF6B3-E9B5-4411-8539-54AAB19080A7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58759,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"727b4dc207a4141335b27fa73f76fb10","sha1":"bb63b02e635f5503d76c4fc3532c2c652a06cac8","sha256":"5d840214ae46c94540df7d0a94963cc398b32c7b868edddb6a4f2a2faf113e42","sha512":"c1512f9d9a191ea10e806fe3a8f812f78dec9832568373b7b5362fafe9aef6783947d248deb2fc8d30ba1c61fd3b94f308298e69c1de32686110fa35f7bd4ed4","ssdeep":"1536:gtPCh483gu6aLw9AJeteTzkprgTWEHbP4BzrJ:344U9Xte3kprgKE7gZJ","tlshash":"0543025a13c1159f422f37b8148758a6d8154f9f38f32ea11a9e2afda58cb0af431c3d","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-14T18:21:23.120057Z","times_seen":2376,"resource_available":false,"data":null}},"time_used":1626,"timings":{"blocked":1318,"dns":0,"connect":0,"send":0,"wait":306,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d0e06d2f1f7d4368911f27030550409e?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.511Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d0e06d2f1f7d4368911f27030550409e?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 52403\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 21721\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"d0e06d2f1f7d4368911f27030550409e\"; filename*=utf-8''d0e06d2f1f7d4368911f27030550409e\r\ncontent-md5: ISJEUTPw7u7Lth/kn7aQIg==\r\ncontent-transfer-encoding: binary\r\netag: \"FoVZk9bJsZuRy8SEGoW2jSfEMgIa\"\r\nlast-modified: Thu, 27 Nov 2025 20:08:24 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: pPaWL3gih\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: NQQAAACMjL3IfH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":52403,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"2122445133f0eeeecbb61fe49fb69022","sha1":"855993d6c9b19b91cbc4841a85b68d27c432021a","sha256":"e7a9df9e1b37258176ea04bb06ce47833e8c270bb8a431f37b9c26ed17d0e04c","sha512":"673d423aa700211ea9f977ea8e2192804aa394ee410d472238029161db048243dbfd93ea00946d5eb63e2cd58fcd32bfa79baddb0834a66b6ccb48d3917c40b4","ssdeep":"768:aa4fQiypBZOVjdTjtsRamnEXK/kL8nkQNI1+O3f+3FApXZUogLYPLEYYLo4ljvCA:R4YzetdH6gmEpwZjd3FAXRULNljvCA","tlshash":"bc33015ce15b5f9b3b52b089c2d0e3e9d5e02ba78b4653a810789e2d77902fe0f0c59d","first_seen":"2023-08-06T17:52:17Z","last_seen":"2026-08-09T14:01:03.992491Z","times_seen":367,"resource_available":false,"data":null}},"time_used":2771,"timings":{"blocked":1032,"dns":0,"connect":0,"send":0,"wait":1287,"receive":452,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_ad0ed5ff-8fa0-4231-a619-ce0616ad2a8d.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.893Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_ad0ed5ff-8fa0-4231-a619-ce0616ad2a8d.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:35 GMT\r\nContent-Type: image/png\r\nContent-Length: 437541\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2gVuq%2F57xTKHbzg%2FW4pIZF9lGjYwROfa2nT48O3TGetp9o7Zev7fNjUrZ3520IMz1BI%2BNslx5T30RJ4RN%2Bmq3rQDUfj8DA5qq90cfFqM89TCpei2jM4%2FwXKLFA%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"022efc3205a0b1288fa238227eb86951\"\r\nLast-Modified: Mon, 08 Sep 2025 20:42:38 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109438\r\ncf-cache-status: HIT\r\nCF-RAY: 9a1581c13cc4dd3e-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725555=di09Ojwi78c9tYtrFEgwhaeBpipMetMPUx2otooXXob6k2eyI5S7E7Gw3UlPfGCLBIwuXsOsjS6jRe4Wg1A5E0u6jZOEdw/4uX6jgt8ws+7GVyhVbt0ZtdJpnwYTH1R9r3RGpqoZBNYu5fUIYJu/c4tyqHk2JNi5UZaV+oh/tyXL2AIwh9OIlf7w9e6JRMQM\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 684ED016-4336-4A2C-B960-36DEDE82F9F1\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":437541,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"022efc3205a0b1288fa238227eb86951","sha1":"199eb2260e9390258f0fe010fe69365aff31a927","sha256":"d19ee176da9545bbc2d1463e31a456643804b2acc0382b4b8a6952924d15b536","sha512":"310ca94418c0c0559c34e7fb749fadd579d86e2e6d3727fb59ccf3446e54d0e2bf881283202bf0d342578af036c0384a119554cf89623afdcc8bb46498969e3e","ssdeep":"12288:4iXmQ8+GAh49y1xGL6uHhEI2qt7VMv06R7nLQItYg:4MVTp4+xGHhhxU0KnLQm","tlshash":"a29423f9140d9b6cb37673d5fc549dab26b0301fa63214be198259c70fcbd99c2ca226","first_seen":"2025-08-29T11:05:53.238055Z","last_seen":"2025-12-29T08:12:31.323425Z","times_seen":282,"resource_available":false,"data":null}},"time_used":3079,"timings":{"blocked":1207,"dns":0,"connect":0,"send":0,"wait":311,"receive":1561,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_c0a34e2a-97fa-40dc-8123-594806696886.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.955Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_c0a34e2a-97fa-40dc-8123-594806696886.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:38 GMT\r\nContent-Type: image/png\r\nContent-Length: 20219\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Eg3iHFoVSRkOk%2B7z%2BEBxhXDy0eRR1xMcQfLPTr%2B36dSifwSwr1fd%2FvrNSZWi15uerZMYLhx6%2BBEhbO5%2FFBRydOaiMM9jlOa1dwAKleEfNLxEfJ9LRKLeiueVzw%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"7fc7275341b7ffb7fc3c2e44aa37d83b\"\r\nLast-Modified: Mon, 08 Sep 2025 20:50:55 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109450\r\ncf-cache-status: HIT\r\nCF-RAY: 9a158186cac1dd53-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725558=CqU/qJIsoXMX7Gvi171YHqR2CQBtd5s+x9S73uNZlw2A3tlbc9+spA/CvW4Gm6DHJ1dMf2zTE8k58Rhrl70ihx3AV1eZaITtST6ZQhVQZ3ghB6qZz+vzHVTtt0vWUxKAvALFWrFGl0r/jxJMUvTXlSY9LSeq7ejV6cKXEUguF279zmB10apsNqAYt5NztE7E\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 5C1E02C1-E630-4094-BB41-EE86629534A6\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20219,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"7fc7275341b7ffb7fc3c2e44aa37d83b","sha1":"065bc30356a5837360c7194171d69da1feeada48","sha256":"58f2ef2554dc2845f5ea9b292b7fbf331543f49b3dcfcfee4353b924d1965663","sha512":"95f1b4c0e5e6060628321d0c6694d443893b1b8aaaf94e3ef05ea703e30003de317586329fcfaaf743d311ff27c2c58baddb7a8242e0de5514a0cf5303980815","ssdeep":"384:cbjBpF/NpKkd89ztdkMcDd2/GiyURwOnogFc5cBmwcbe2osrF:cbjBpFNpbePvcDdYv7ogFCcBm/e2o+","tlshash":"7592df661053129bfccb853eb52e99f0f9f484abd0bc871da6034c561b8e85c1668a9f","first_seen":"2025-08-29T11:05:53.28171Z","last_seen":"2025-12-28T02:09:46.214845Z","times_seen":307,"resource_available":false,"data":null}},"time_used":4912,"timings":{"blocked":4603,"dns":0,"connect":0,"send":0,"wait":308,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/bc49a7a2d27c4172961ec2c17863f9bd?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.495Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/bc49a7a2d27c4172961ec2c17863f9bd?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 31179\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 3722\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"bc49a7a2d27c4172961ec2c17863f9bd\"; filename*=utf-8''bc49a7a2d27c4172961ec2c17863f9bd\r\ncontent-md5: fxFFvfg7UdesS29wAe8zLg==\r\ncontent-transfer-encoding: binary\r\netag: \"FmSsuhwXZLuo90GvXYcqCuHPs50B\"\r\nlast-modified: Wed, 19 Nov 2025 04:00:23 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: BYYoT1djH\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 0a4AAABAL1knjX0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31179,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"7f1145bdf83b51d7ac4b6f7001ef332e","sha1":"64acba1c1764bba8f741af5d872a0ae1cfb39d01","sha256":"4ab00e1ec22d9a98e4a8d9fb26e934bba511e3bc97f04eb42246e3e0786d355d","sha512":"ea6fa5a20f9250830d72624ae21da27a18d20fa4f486584856279deb3ce70f547b8ca5df2ff9ae864ab877ca81e1e7021ec5e472b608eb630e0af5263edcf722","ssdeep":"768:PE/K4qz81+ePoP6e8hrReaemFCUW3ermuj7E0L3:PEEI1BC8hr8KCUVFl3","tlshash":"0fe2f1af98c87cb5b809267e9258107068c42593a8b8bf7b64e12ddc87d3249c5b3d75","first_seen":"2023-07-08T08:51:56Z","last_seen":"2026-08-09T17:07:42.799338Z","times_seen":299,"resource_available":false,"data":null}},"time_used":2380,"timings":{"blocked":1048,"dns":0,"connect":0,"send":0,"wait":1079,"receive":253,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/592e4c5710ef44c18bc371ea2969fa58?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.550Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/592e4c5710ef44c18bc371ea2969fa58?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 18548\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 10936\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"592e4c5710ef44c18bc371ea2969fa58\"; filename*=utf-8''592e4c5710ef44c18bc371ea2969fa58\r\ncontent-md5: FqvmDGa+OaWp8m5P6UAxPg==\r\ncontent-transfer-encoding: binary\r\netag: \"FmzCLh5WjzsChiNmhrZc2bPNJDsN\"\r\nlast-modified: Thu, 27 Nov 2025 20:11:04 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: b9nN7Bv1b\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: ukcAAAAyg9qXhn0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18548,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"16abe60c66be39a5a9f26e4fe940313e","sha1":"6cc22e1e568f3b0286236686b65cd9b3cd243b0d","sha256":"96ed548b95751ea605be681e7856f0ec71ee722f9671080851cc5fa3d1e3d9af","sha512":"541e18fa288a42cf84cd31925cacfe29d37b548acd14d917fbbe4b355782cdc422e0e5c735c7989ebb9ae2b251a3ab7acd6fa7d421a32f336e45eeb9fd400678","ssdeep":"384:7RWtSF8DKeqt5SMwGfs9g1hD0Th0xGDvDaI3Ye6Lwu:7RWtSOcPSMf2g1hDMh0+mT1","tlshash":"2882d01c52b74c98e6f976a60b056993c43369df3fd20e198253f43d98d7822b2e6d22","first_seen":"2024-08-19T15:01:26.191029Z","last_seen":"2026-08-09T17:07:42.79806Z","times_seen":212,"resource_available":false,"data":null}},"time_used":2646,"timings":{"blocked":994,"dns":0,"connect":0,"send":0,"wait":1308,"receive":344,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/45540.1756903329400.c33043f4.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:21.492Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/45540.1756903329400.c33043f4.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:23 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-37fe8\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725543=61dmuydCWjCzLQU2zCyJxGo2a3J+yabvxh1wEcdz1uVIb3ct2y5Grk6xFzIZ4BcICGVwXzubEd7bpcqUIllxGgVZszq3wkQqeZZA9cbwHg8FJbA3rVT+nLWfIchJ7Ophsi3H5yrbVneU4KpjYpVRIIrNzxqyrfyuQ9/+U0Zdqa7EcU1GDjMlPzHLGc5y8IhR\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: 376780D9-2A8B-466E-B60F-720247C42318\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":229352,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"000be9e193b9b0e7a8e7e2fc6a908605","sha1":"1f04ee0d0816dcb4a310f1bf9053f36c15561922","sha256":"0968ff07195a9aad5c3f080a919c803c162ccb3bb176330b762c1e4e884e75d0","sha512":"d05ca2e4dbd262beab20be9f7872c1faf4d88129b59234fb2009c9ecc7114341558d7813d701cc5aa54dfa4ec028ab007eeff864ac6bed87a4ed8d42499954cf","ssdeep":"6144:rYD4wFsYiSGfKnCKPP6Xm9sm3MCln1OSgpozfEe5a:rYD4wFsYiSAKNH3TY5","tlshash":"2b24e894f294f1be075fc1f1d23b501af35b5e6120cc9ca0d296e6942e20b49da77eac","first_seen":"2025-09-04T00:49:32.837166Z","last_seen":"2025-12-29T13:58:58.015173Z","times_seen":439,"resource_available":true,"data":null}},"time_used":1817,"timings":{"blocked":1291,"dns":0,"connect":0,"send":0,"wait":490,"receive":36,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/service.68be110a.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.164Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/service.68be110a.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://y108p.xyz/css/index-399e2569.1756903329400.f2d3fd45.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 10641\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-2991\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725551=Tl57i2AA5msYKmQD6D9b96oj05vzNG1l1CRjWQNFDIl0/XOB91wmnNIuwbzcvYLLX/+8PfesGrw5GUIZPSgoLImPW3qb6JVtL/D3VFmUZJ2JOKFTQEmo6Emj7kqSzJVgZ3YR6VcZAjkG+nzNcBKE087eIDc4XsCyYhU4Om61Apb3ZxYss03gNL9y0YZ3YnNG\r\nAge: 892847\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: 44945A98-0B01-4759-879F-607A8D234C2A\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10641,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"993784a38ddc1156572bfc3308055ead","sha1":"becff431867226bf323b5a6535fa383992f107eb","sha256":"abca3af980888b08c6cbd57366b3ac94344d66ea048484c4f9867e300ee8703a","sha512":"48790c6340f273a58295fc6607306353ab69d5a818569fe36ef1bffc8fff084b23d37b401e10502b830c67a5efedca56c1c9d778d6198e4069018d055f1869f0","ssdeep":"192:NdsarkpjwOOmfStcnaHtzB3l2eKD9RdfXtRqi3ln+ojjjKMGlnyL5H7nx+:nJQpjgOz9Dd0orKMGlnA5Hbs","tlshash":"8822c0c41e1be1b6d2ffa916b28543a04b3421fda1a24c342d828c04ccad56ac91f9e7","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-08-15T19:18:34.475024Z","times_seen":2589,"resource_available":false,"data":null}},"time_used":3152,"timings":{"blocked":2848,"dns":0,"connect":0,"send":0,"wait":303,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/3596d1500c0844a4bdb290482de8b18e?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.480Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/3596d1500c0844a4bdb290482de8b18e?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 23913\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 12738\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"3596d1500c0844a4bdb290482de8b18e\"; filename*=utf-8''3596d1500c0844a4bdb290482de8b18e\r\ncontent-md5: l5/+aut+FQuX3rF+WU0xNw==\r\ncontent-transfer-encoding: binary\r\netag: \"Fjj3Rs82GLVftlN-Dm2tpzVVKOOt\"\r\nlast-modified: Thu, 27 Nov 2025 20:11:01 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: ojiEMhINK\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: nm0AAACLUFD0hH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23913,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 139 x 181, 8-bit/color RGBA, non-interlaced","md5":"979ffe6aeb7e150b97deb17e594d3137","sha1":"38f746cf3618b55fb6537e0e6dada7355528e3ad","sha256":"6f92bd8b155f012a4b75e42fecf224470519ed4041e926d497142b47d33b88a6","sha512":"3bb568232330784364af55a776400ac9a558633c43ab9369b60cd5f11ec903d9dbc343dd7da80e98cd2625a4b986a37bbb1904fbe612353dc4f7d25a18a1cbfd","ssdeep":"384:usz/Efq9KVbmDwazjKskZZQzzaw1lnGvwCEZJ07y8emeDum2o8lXHWp4QNWCKqiC:dz/v49mDw8vzaCGvPEZqW8cJSYGQNoDG","tlshash":"65b2d102a678c26394c16b13c89d435d2ed8f71ce26fe31c8de684d1241ef5de5b4a99","first_seen":"2025-03-31T13:06:08.137119Z","last_seen":"2026-08-09T22:07:19.898878Z","times_seen":309,"resource_available":false,"data":null}},"time_used":2240,"timings":{"blocked":1062,"dns":0,"connect":0,"send":0,"wait":1078,"receive":100,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_f26e0b0b-19a9-470f-90cf-ab38984671ab.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.931Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_f26e0b0b-19a9-470f-90cf-ab38984671ab.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:37 GMT\r\nContent-Type: image/png\r\nContent-Length: 163087\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Mrg30f%2BlSs%2B%2BHT%2Feg06B%2B9uvreu50oc9Us8tJdwJISfnz2W6M7jvdG53EQgQ3a5erTxZUs0CX5MbkArIxGQyDykPcrrq8WwoGOG2qusSYirb1PZcsrUHRDBvcMo6\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"665f9e6ae0a86d0eae47cb8dff17bae3\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:05 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109445\r\ncf-cache-status: HIT\r\nCF-RAY: 9a15819f4ef10ef8-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725557=scDVPKsbbAvx99LhIgALuOPSdX6xYY3HutBVudy+Q6HpGDBo5Z8Q2MjTgtiiiMRdMqGW7aug6JpNd55oNOni2BSumL5UI/LYwxuuMVJR3+2BO5rdD/DWiwrepZlKKf4ZjTsDUmRXj9vcCn+dNQYwChw2JyHAehyMDmkgxABV5TLoR6AGNQqjIYRKXNMCVGfp\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 66CF8959-288A-483F-8263-6361CF6F5517\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":163087,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"665f9e6ae0a86d0eae47cb8dff17bae3","sha1":"dd7600af4c65b5bda644140616ee4d76ac1795da","sha256":"caf741c67c08cd0c8291a16caf42ea1d9830283434a62be24fe1396f1bd21dc4","sha512":"3a8ed0a038a0089a590a989397da4b147781ca6aa99daef06344686e38bd3987772fce673345007dd6bab344d3719ecce0d75649355eeb8f3474cdc8aa78f5a7","ssdeep":"3072:f2ERsjJw8K6/iWw8B6ssU9m4QkMyu6IDLWuDboEfXO464gl3omZ1AU/eoIOff4e:f2EeFZ/aW6c9bszDCuPo+XO461YmnAiX","tlshash":"21f313d848400afcd04349fa6fa09931c3b17bcf53d9869afe8c63ae5d49964bc1568e","first_seen":"2025-08-29T11:05:53.303219Z","last_seen":"2025-12-28T07:17:25.238253Z","times_seen":289,"resource_available":false,"data":null}},"time_used":4231,"timings":{"blocked":3067,"dns":0,"connect":0,"send":0,"wait":292,"receive":872,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/loading.da46bff6.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.183Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/loading.da46bff6.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 473164\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-7384c\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725552=+hxA24sti7lqYYqupQnW9OdDveGHfM+yVXFNWLeNWVHbkZszbu4mHTohUTANLRNSQpC+on1scArJrHSuZR0EnNfSuCrQewLq1ZciobqdoGYLlt4BzR9bC9ZqEJokSjjy7X1RgRKhXeWPUwgVQIwdg9fSdElkJRYx7lyRsFydDCX7EZgGx0tbjXSJRf5EvAaZ\r\nAge: 1115074\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: 0C3EC39E-4810-4455-AC7A-B2E653411065\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":473164,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"ac7ca483f10bc73cffa89f639f6ffa56","sha1":"03873b9607c635752526968af31773498d259afa","sha256":"a054b81d2850fe2da5b4f97a1c50c05ee59a24c37f1c700e5cc45fe6079598b6","sha512":"caa6b3e243f02c86ccaf71aafd0e716834a7a0cf07305c5c7cc0a1b9d637cc2802caa067b0010c7c3c064e3fe8f7881b26992f57137f98477266653342257760","ssdeep":"6144:NFoYczeWIF3Q/IUPYhuF0KX38I4z/tcKZPehCIjAl/CS+b:rLczeTUPpF083CBdeh7MlvI","tlshash":"79a423929b411988e1096432215fab4d23993b6458ab5fbf78843d88893cf059ff763f","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-08-14T18:21:23.02208Z","times_seen":2245,"resource_available":false,"data":null}},"time_used":6170,"timings":{"blocked":4046,"dns":0,"connect":0,"send":0,"wait":303,"receive":1821,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/17600.1756903329400.89772027.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:27.958Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/17600.1756903329400.89772027.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:28 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-2526b\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725548=wdtO4M5R3pyBXDSDlSB9FD5ieOJLpGjZdfC4za9oCAyN1n8vLsGZ+z8auR/Dh4ykS+PCyBfoKyAMuN0NuIOnM6NbqsNDb1di2mTV1gji9F+K2Iou2dNtgjOROSr+yzTqg8c7tnLTv6/yv2kgFzbOjVLWKxGxOEpbx/MH0+yEv5fPjuQbFYc97dxvwU8Cbcw6\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: CC18DEA9-CD57-4038-8057-72787B33FB53\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":152171,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (33789)","md5":"537a1190cc025f0707bbb2a736630283","sha1":"1ac2e221c5e4e26737c6e1b7fddf2d363e4b65c3","sha256":"296f9d35557dc9588e8c6bed7134ca0e3055473306531756660582a6886bfedb","sha512":"3202114c8afb764ea0c4cd32bd78e7ad51295face85601b71b7316535d8fc29ecfb314bc1ace4ff0f54ef46a2016d09e764078ea1d7bd08ae75077ad6eab2341","ssdeep":"1536:+D5AxGst7xILpT0iiRs1vE/yKLJdLI065veGiHjLFIEfma5/xY8SbF9JiNp/QQbU:+DqxNfns1v4yKMpBesDz7+I1ou","tlshash":"d8e32a94b380717887a743b5b21f5196d22a08601098bca4f26eed94bf749ddf63ecdc","first_seen":"2025-09-04T00:49:32.979776Z","last_seen":"2025-12-29T13:58:58.065817Z","times_seen":421,"resource_available":true,"data":null}},"time_used":511,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":479,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/kc523-1/sponsor/sponsor.json?1756903280095","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.119Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor.json?1756903280095 HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:28 GMT\r\nContent-Type: application/json\r\nContent-Length: 646\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-286\"\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764725548=wdtO4M5R3pyBXDSDlSB9FD5ieOJLpGjZdfC4za9oCAyN1n8vLsGZ+z8auR/Dh4ykS+PCyBfoKyAMuN0NuIOnM6NbqsNDb1di2mTV1gji9F+K2Iou2dNtgjOROSr+yzTqg8c7tnLTv6/yv2kgFzbOjVLWKxGxOEpbx/MH0+yEv5fPjuQbFYc97dxvwU8Cbcw6\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 67DD6CB0-9730-4016-B735-778BE2503421\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":646,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"10d2161de8cf99c474812f4c43645a26","sha1":"71884ef7281cdcb5084088f16d4550ce8790e634","sha256":"bb02fd7438bb49dd4decb6f76a71f11e93355332fd9f965d6f9f13bb8175aeca","sha512":"bf0fd1232309fcc5582d5c42644e1c7b4b8d235b1066e988ff55e0dd94a956f89742401f00c2d904359041c8e0c2bac8e9316252fab60db5eb0a3b4c935172f0","ssdeep":"","tlshash":"d8f0f44ad8b25b93211fb57c58cd050470294a8f0eccaac4baac987c4f598ddd1e839e","first_seen":"2023-06-16T04:51:50Z","last_seen":"2026-08-15T19:18:34.464911Z","times_seen":2855,"resource_available":false,"data":null}},"time_used":765,"timings":{"blocked":311,"dns":0,"connect":0,"send":0,"wait":454,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/away-bg.00d4ba2a.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.574Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/away-bg.00d4ba2a.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://y108p.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 3883\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-f2b\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725552=+hxA24sti7lqYYqupQnW9OdDveGHfM+yVXFNWLeNWVHbkZszbu4mHTohUTANLRNSQpC+on1scArJrHSuZR0EnNfSuCrQewLq1ZciobqdoGYLlt4BzR9bC9ZqEJokSjjy7X1RgRKhXeWPUwgVQIwdg9fSdElkJRYx7lyRsFydDCX7EZgGx0tbjXSJRf5EvAaZ\r\nAge: 1109450\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 142F679A-1855-416B-884E-F4D9B556FAC8\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3883,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 277 x 80, 8-bit colormap, non-interlaced","md5":"ce3e5a71ef5dcf15c030882243e12315","sha1":"d4fdd1329ecac30941a67bd5108bad525c791c12","sha256":"3c2aad01ce2fce6463d6ed3bde348515922dd019d8a670b07b53d66b39c68d3d","sha512":"f6a55d8c079529988760a1c22541c097af159a3653f5ffe89c5c31ee20371f2c879c64797319f4176be77c821294f0f72d83ad77f2a0141203c857c8f987966c","ssdeep":"","tlshash":"6f815cf693e66bd0d5675106a3a14c89624d69d925a325530923f45ec3bb1ac02fe381","first_seen":"2025-08-29T11:05:53.10673Z","last_seen":"2026-08-10T17:58:48.509666Z","times_seen":2337,"resource_available":false,"data":null}},"time_used":1773,"timings":{"blocked":1467,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/no_data.02e9590c.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.063Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /img/no_data.02e9590c.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T02:04:44.628897Z","times_seen":17911053,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/undefined","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.121Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /undefined HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:28 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: public, s-maxage=600, max-age=0\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725548=wdtO4M5R3pyBXDSDlSB9FD5ieOJLpGjZdfC4za9oCAyN1n8vLsGZ+z8auR/Dh4ykS+PCyBfoKyAMuN0NuIOnM6NbqsNDb1di2mTV1gji9F+K2Iou2dNtgjOROSr+yzTqg8c7tnLTv6/yv2kgFzbOjVLWKxGxOEpbx/MH0+yEv5fPjuQbFYc97dxvwU8Cbcw6\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: BDDA2F87-8064-407A-940A-6B958340CDA1\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23624,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5777)","md5":"87588e90bb24e209460bdbf1bcbcc074","sha1":"f3c57be16a0eaf6879f3469c6a2db7720a699832","sha256":"61ed38427305a473065294efb15ef101340cf9d3e19be35a6c6c86083698c328","sha512":"160c240e67f56096c7c519eeb5b11bd9fcac971ffbdaecd231be6aaba4f98a1dbf5f44a22c0edfbe64860e3039a11eba5be0eb13802c82e7033543d7891a8e51","ssdeep":"384:kR7B3v2VwiYwJvSoVXsp+pa/iZcVk97g6nMusplliz:kRdviNYiKop/E6wkpcu2lUz","tlshash":"9eb2292e8df349762523703a2bbfb208797180134309ed803e4de7584fd59aa46e7bd6","first_seen":"2025-09-04T00:49:32.720758Z","last_seen":"2025-12-29T13:58:58.052747Z","times_seen":445,"resource_available":false,"data":null}},"time_used":790,"timings":{"blocked":329,"dns":0,"connect":0,"send":0,"wait":460,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/fonts/DINPro.9ee75b04.ttf","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.177Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /fonts/DINPro.9ee75b04.ttf HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://y108p.xyz/css/61540.1756903329400.030a612e.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:28 GMT\r\nContent-Type: application/octet-stream\r\nContent-Length: 119892\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nETag: \"68b83893-1d454\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764725548=wdtO4M5R3pyBXDSDlSB9FD5ieOJLpGjZdfC4za9oCAyN1n8vLsGZ+z8auR/Dh4ykS+PCyBfoKyAMuN0NuIOnM6NbqsNDb1di2mTV1gji9F+K2Iou2dNtgjOROSr+yzTqg8c7tnLTv6/yv2kgFzbOjVLWKxGxOEpbx/MH0+yEv5fPjuQbFYc97dxvwU8Cbcw6\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: FF3E37B4-8994-4AD4-825C-C3F5BB50CBE3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":119892,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 10 tables, 1st \"OS/2\", 30 names, Macintosh, 2005 Albert-Jan Pool published by FSI FontShop International GmbHDIN Pro RegularRegularAlbert-Ja","md5":"028cefac160ed3b006f47106fbc68d1c","sha1":"efcecac09684435facd7397e4f6163a5069802c2","sha256":"fb841a09a82787982ad1774bdeb45e8e06ff4909161a9ce33fd42f8822c5ddc3","sha512":"3a5a284d0c4da6593b857ba785a4ba7d5f2e2b73d22a2ef25435b9558063d2486228d76a3cd5d3a59b5abe4c0da696a75373111b3569a94a9dea1516cf16091f","ssdeep":"3072:YhtN/CZnt1tbtKtHtFNgz1QZt0tbt2ktwtNstAtqNaEctWpy8TLtsIb66AUeo:YhtNGnt1tbtKtHt7t0tbtxtwtNstAtqV","tlshash":"5ac308c153e8fa4ad83996388511c7434226ff2de65d4f36ffd94d8c688e8e9064e6e0","first_seen":"2023-05-08T18:58:40Z","last_seen":"2026-08-16T00:42:03.375734Z","times_seen":5617,"resource_available":false,"data":null}},"time_used":1118,"timings":{"blocked":292,"dns":0,"connect":0,"send":0,"wait":485,"receive":341,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/ecb/8f8306425eba6e0167bcdb25a31b67ec8f","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.987Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /ecb/8f8306425eba6e0167bcdb25a31b67ec8f HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://y108p.xyz\r\nXign: baU1AMfwVhyjl+I/IV94Q7pg/ybIsoqzSRWbOiaAmGECbEEnJilVBN3CO03v2eJhegNf1F6QzvRLb9Ck8nU69VIfvxAFfE2GFFFPZWULCw3OWdwG7sxDQgqzhFop3pdEe4sFFaYP5NNPi8x0+lBra9q5xTJZhcJH0sKUFOUFEAQ=\r\ntimestamp: 1764725548982\r\nsign: 81r5l2j2b7f2p722\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: rEfAYkDGbEEF5yTzpkNZQfYMBdt5bAF3\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:29 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Wed, 03 Dec 2025 01:35:29 GMT\r\nCache-Control: public, max-age=180, s-maxage=180, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725549=/hVpQNHfLaAcoXjZCNTD3ZDnYR8cYfq+YoSlktnj8vjV4yYEoNmYY0sKl65CWk9dh56Dl85PFjG7mrhMoZDvByy/GLY83hGvAKTjFaBL1ZoH+ejqwiyveU9JUw8qyMDteBKPL4KYudk6vsBAmQXX3V32d2e2abScXG4NnkM2M65b7NYaok48/b3a97O06i5p\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: EDA522B8-BE40-4B1B-B139-C7A72BCC6DED\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3580,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"5a5c66191c1de15722a49c05b1218b21","sha1":"4ef8e7920b9b9fea6dc6125c99ba5abf140fbdcd","sha256":"5a4eeed848f8ac6db493f821f01fe8f64085cf768cf43c46a804a016f4b89828","sha512":"ccdab12bc2f1f01e151621af74cb295ba5279ac6814d8ba30e30945dd4c746483df0c92acac8e2cc6187b899b1eb4aa9dc929db480729ed9b2e08fe03f80d95a","ssdeep":"96:eOGS7hTEAd9wDsZ/BOOoDZAPJOdb5yfSZEt7bcn1E2HiNm1KftprCYZIh0MMcT9/:VP7SkasxBOP64dWSacq2HcuYZgOPhTw","tlshash":"a6b16cc3a2b1972370d450e2d775a4e884dd0fa4e2c51c09e66a10cc1efdaf9b2af940","first_seen":"2025-12-03T01:33:08.83557Z","last_seen":"2025-12-03T02:08:18.713176Z","times_seen":15,"resource_available":false,"data":null}},"time_used":662,"timings":{"blocked":206,"dns":0,"connect":0,"send":0,"wait":456,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/33441bc88dd1406787927fc2960e14fe?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.456Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/33441bc88dd1406787927fc2960e14fe?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 16966\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 90144\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"33441bc88dd1406787927fc2960e14fe\"; filename*=utf-8''33441bc88dd1406787927fc2960e14fe\r\ncontent-md5: xSMolmNDcTJkLrkm49UcVg==\r\ncontent-transfer-encoding: binary\r\netag: \"FpShJjcI6FHr6cJDYJ48MiFt_oe5\"\r\nlast-modified: Wed, 26 Nov 2025 20:07:47 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: oyXK50EZV\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: ONAAAAADPc2NPn0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16966,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"c523289663437132642eb926e3d51c56","sha1":"94a1263708e851ebe9c243609e3c32216dfe87b9","sha256":"aff0b91e8c316db0df3546c6c7ce84a929076a8c1df8971fa36750e59cdbb413","sha512":"0a82cca27a105472309f202c1a7b7c0ac9095355b834f35a81c8e71545ed68b7853091c65809fb3316362ba0135ddaca5e6c2fcbe738076bbc6b734f9dc32e80","ssdeep":"384:fKwc1JK+3T0pujE37nz3XfTCelEc+Ar+zl9uUQVFg:SwcTP3Y337TXLhlEc+D","tlshash":"9f72cf8cf5228dacd70618c4c5dd1e1f4e7d373a68aa2709e1a43424552caf572aee1e","first_seen":"2025-09-21T04:12:33.87118Z","last_seen":"2026-08-08T00:56:41.985635Z","times_seen":246,"resource_available":false,"data":null}},"time_used":3119,"timings":{"blocked":1104,"dns":0,"connect":258,"send":0,"wait":1293,"receive":160,"ssl":302},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/f97efbfd72eb42d28ac406e56a397c20?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.471Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/f97efbfd72eb42d28ac406e56a397c20?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 173989\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 2040\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"f97efbfd72eb42d28ac406e56a397c20\"; filename*=utf-8''f97efbfd72eb42d28ac406e56a397c20\r\ncontent-md5: gVmgmnDNMQ1GTPrki5P+vw==\r\ncontent-transfer-encoding: binary\r\netag: \"FsbP4pnFLfRyzKaRjzXUs7xdmHvY\"\r\nlast-modified: Sun, 30 Nov 2025 03:33:41 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: 4iy6KUWod\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: jVgAAADRmRmvjn0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":173989,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2000 x 3264, 8-bit/color RGBA, non-interlaced","md5":"8159a09a70cd310d464cfae48b93febf","sha1":"c6cfe299c52df472cca6918f35d4b3bc5d987bd8","sha256":"32f2f001bcedd2f87090ec2277e2165d7925990ae63c3391d74537dbec2b1d10","sha512":"77de4b81409a8a47f5e2afbd03ed642ee451fc93c323554bb974a7ac923a33a5c915d0a323ba9bef3093c4ed068ea7ef0677ae82364f3a61d40e5941bdb574bc","ssdeep":"3072:oWuj/UtcM/r1e4tXOUfwAqJzdCg+3bWz5qJBGcsrdOCJUCMakwiEsFJ6CQZKp6OV:Oj8V/r04VffwAARCg+muMvJlfkwOae","tlshash":"3704f1a06825ccc5ee91997d74330fd8ae6881bbd4298ecb9156f053ea4e34e3d8b5c4","first_seen":"2023-08-17T12:39:31Z","last_seen":"2026-08-01T18:08:46.353926Z","times_seen":88,"resource_available":false,"data":null}},"time_used":2965,"timings":{"blocked":1070,"dns":0,"connect":0,"send":0,"wait":679,"receive":1216,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/31098.1756903329400.4108b3dd.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.584Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/31098.1756903329400.4108b3dd.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:31 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-561f6\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725551=Tl57i2AA5msYKmQD6D9b96oj05vzNG1l1CRjWQNFDIl0/XOB91wmnNIuwbzcvYLLX/+8PfesGrw5GUIZPSgoLImPW3qb6JVtL/D3VFmUZJ2JOKFTQEmo6Emj7kqSzJVgZ3YR6VcZAjkG+nzNcBKE087eIDc4XsCyYhU4Om61Apb3ZxYss03gNL9y0YZ3YnNG\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: C9D38354-8EDF-4F3C-A9B4-FAB7A45EC2E3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":352758,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65338), with no line terminators","md5":"215815c091a19829f9fd6e5f28039f0a","sha1":"8ff2707b0ab4498bfd2bb7f99674b5a245ecceee","sha256":"06371440853645a0532df5edbbfd5c9e9661bec969aabc25b3353297c6f6574a","sha512":"34933b0388cddca0826af79fdd0f82c31c1264e87f004cd921360b19dc83a0ff188ac52a4de89427cc1c09f2785179fdf4d0ff7526d4a74a55f7971fa2738e9c","ssdeep":"1536:Ow+0YvC9jlTKAUSseG1SY46DCdlBBo3AgXOG9AsqCfCXsvCfCXsLCfCXsyCfCXsf:O/KK5sY4brG7O3SnLJNpL","tlshash":"1574b6f4c248c6fdea04ce0a7e7d6f2d50723783f2ec96c446aaf8865e91857245c4da","first_seen":"2025-09-04T00:49:32.813984Z","last_seen":"2025-12-29T13:58:58.029423Z","times_seen":409,"resource_available":true,"data":null}},"time_used":965,"timings":{"blocked":154,"dns":0,"connect":0,"send":0,"wait":520,"receive":291,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/heying.d446c85d.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:28.013Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/heying.d446c85d.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 1425\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-591\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725548=wdtO4M5R3pyBXDSDlSB9FD5ieOJLpGjZdfC4za9oCAyN1n8vLsGZ+z8auR/Dh4ykS+PCyBfoKyAMuN0NuIOnM6NbqsNDb1di2mTV1gji9F+K2Iou2dNtgjOROSr+yzTqg8c7tnLTv6/yv2kgFzbOjVLWKxGxOEpbx/MH0+yEv5fPjuQbFYc97dxvwU8Cbcw6\r\nAge: 1109457\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: F2EB3D63-0128-4C13-9F3C-3348E79B70E1\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1425,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced","md5":"c0d0c516850381dd1ca39dd94b08f21b","sha1":"54522affec52debd9c0bd3784f0ce9bf692f5d6d","sha256":"301cbb9a8c3fae88d732c8b8fdfe40113e3257831d37150e95564cc0f9b8fbe7","sha512":"6d6b1263f2de2b35237c784fd0aa127c469f8b6ebf347ff1987d791611d5b36f0909f3a81f9db6b1571756ecae60454d854e776e5ed782acbdfcce4fda2b9c86","ssdeep":"","tlshash":"dd213b5023742cd0e8ae3457ef12e5fdb823417994f8dd0c99b9bc3e84908b1057a48e","first_seen":"2025-09-04T00:49:32.953523Z","last_seen":"2026-08-10T17:58:48.227911Z","times_seen":2285,"resource_available":false,"data":null}},"time_used":869,"timings":{"blocked":559,"dns":0,"connect":0,"send":0,"wait":310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_07a2d840-d1e1-4217-9d3b-badf80b88abd.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.897Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_07a2d840-d1e1-4217-9d3b-badf80b88abd.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:35 GMT\r\nContent-Type: image/png\r\nContent-Length: 486455\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M6lw%2FItGstvr1smZyin5z0mjdgV1ZTmda2vVHutW5cjw6aYwo4Or5NsiszJakCevScIiexsJvyveZR8Qwh1%2BhHa7wS%2FgFxL1APlWfdI%2F4Tj8RJHi3hDSoneWsQ%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"611135936dde834c3aaf7a7221c0c4a8\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:28 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109448\r\ncf-cache-status: HIT\r\nCF-RAY: 9a158180fd95a8ad-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725555=di09Ojwi78c9tYtrFEgwhaeBpipMetMPUx2otooXXob6k2eyI5S7E7Gw3UlPfGCLBIwuXsOsjS6jRe4Wg1A5E0u6jZOEdw/4uX6jgt8ws+7GVyhVbt0ZtdJpnwYTH1R9r3RGpqoZBNYu5fUIYJu/c4tyqHk2JNi5UZaV+oh/tyXL2AIwh9OIlf7w9e6JRMQM\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 119076CE-F678-4230-B056-4DC971F5A448\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":486455,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"611135936dde834c3aaf7a7221c0c4a8","sha1":"bc54ddd95adc718bcccdf0606743046d161d74e9","sha256":"047e2dd38d93d1572c3871f71ae7f34e7506798853bc471d8330436de6c2e353","sha512":"b0bf93ab6e9041970ae87f14a519087735218c795f479c3107b5105d9d7dd9ab13589460fd5657cb79f1bb648e0b3ff1f02c1b9921febf635559f1ba8f426f9c","ssdeep":"12288:J8cUsxN26nlb9TH9sr2oZKpArG0jMh2dUwJRgD:lzxN24HTdcKajMbwvg","tlshash":"19a423e1f6a044efe955ee721e640738b05b65c8c36c7e4056ca943b9f6331e9d0f092","first_seen":"2025-08-29T11:05:53.277372Z","last_seen":"2025-12-29T08:12:31.331218Z","times_seen":285,"resource_available":false,"data":null}},"time_used":4649,"timings":{"blocked":1244,"dns":0,"connect":0,"send":0,"wait":309,"receive":3096,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/js/45734.1756903329400.46beea1c.js","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:21.495Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /js/45734.1756903329400.46beea1c.js HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:24 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-43a22\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764725544=qUQEP8SNYPTGOqrcZx6Dtd4Jed1q+9haGbuQqFtaJYiTmhLqOkXAcWFVmV4rrX1x9NTL2pweDaExL8o8r0aif/AN3jKc6T1Gs9EWk9625NhGGo5IUCcgEH+baY4vQXKFuWHAEjloy/Ka5vmsirI3m3axmdakL2OX9yVI469rp3IUqp3QDYkavuef+a8JHKvR\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 38E78AA1-72E9-4DB7-BBD0-35722C89ADEF\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":277026,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"e5f34b5441b6b582d6d469c537f6f97a","sha1":"defd5aad4e0d066131c97173b21b7b3442cdb951","sha256":"44db08eec9e6d649f62d7d208bce223e33424ebc58c21098181a90ae5a1c6437","sha512":"4096ae8bc07709597c8411157950bea75aba46cee36964fe1e280a31a2c2c9d4a8d5821c3e8a4cca552919511930bc9f834e2054580c452acc17c1011d1e6168","ssdeep":"6144:F/EFTU8Ra90Jjytg7DiQPkcsz1h84faSDWidmVHrqZL:9y/jytgPJP484fa5VHryL","tlshash":"2a441c84b291f0b4879b42f7922b4055a17f48a130ccacb4e2a5ed90be7555c927fbfc","first_seen":"2025-09-04T00:49:32.926111Z","last_seen":"2025-12-29T13:58:58.062377Z","times_seen":438,"resource_available":true,"data":null}},"time_used":3072,"timings":{"blocked":2489,"dns":0,"connect":0,"send":0,"wait":516,"receive":67,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/93b64a9c2cbc428289ae4714a04e3236?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.492Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/93b64a9c2cbc428289ae4714a04e3236?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 31930\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 3722\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"93b64a9c2cbc428289ae4714a04e3236\"; filename*=utf-8''93b64a9c2cbc428289ae4714a04e3236\r\ncontent-md5: B56Gzr1lEc6AfMYHOj4m7g==\r\ncontent-transfer-encoding: binary\r\netag: \"FqdsHfRImE7MV-0grJACmrHSyAHs\"\r\nlast-modified: Wed, 19 Nov 2025 04:00:22 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: d8Fl6B2ky\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: JscAAAADJlknjX0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31930,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"079e86cebd6511ce807cc6073a3e26ee","sha1":"a76c1df448984ecc57ed20ac90029ab1d2c801ec","sha256":"66154e8b3d76e58107fe47e8816a1613810508d4b356e6d82c218553dd52c0b9","sha512":"4301188e496932b1f96f5c92ce12bfbd09ecad6e61c02a2a3f81acb2e84da8062b54f27ecb30217202c1802197276e4ef472a60cb17961a792343e8ba89712a5","ssdeep":"768:Cf4ccyUe9Cd6utoOpMFTtkgiX4un+OypJM:CfdcyUdxMFTOVX5+lpK","tlshash":"48e2f1e8895aaec1fd4cd79cc7cee8894d2ddce448d072b3d80635c0859e63466d4bca","first_seen":"2025-04-01T11:41:17.854765Z","last_seen":"2026-08-08T00:56:42.512698Z","times_seen":274,"resource_available":false,"data":null}},"time_used":2317,"timings":{"blocked":1050,"dns":0,"connect":0,"send":0,"wait":1079,"receive":188,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/e3c08a14df7f4d559eaaf5d46489a934?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.499Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/e3c08a14df7f4d559eaaf5d46489a934?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 83553\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 21722\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"e3c08a14df7f4d559eaaf5d46489a934\"; filename*=utf-8''e3c08a14df7f4d559eaaf5d46489a934\r\ncontent-md5: m0OmkNWgnx4xnwNoIejh0w==\r\ncontent-transfer-encoding: binary\r\netag: \"FowYnSMK5U7gsc9HHzuU5q5kIu8Y\"\r\nlast-modified: Thu, 27 Nov 2025 20:08:25 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: NLQdNTp2K\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 2HkAAAAFbXHIfH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":83553,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"9b43a690d5a09f1e319f036821e8e1d3","sha1":"8c189d230ae54ee0b1cf471f3b94e6ae6422ef18","sha256":"134c96509adde7a2c9afadb08cbf80912dfa6bb23ce380b8477a0f8d3082c4ed","sha512":"d3f91c9b93f6bc4a44a129aaf50389c8d1d1d3a370aef596e5502f7eaa410f0e591c5d80d14440c348c466f2b595a8eb8ec11555907e026b865195d3a3ca813f","ssdeep":"1536:MV7U/tbKlY7wNcTSngrT+wSpPOLKG92MMdjHjuMxZayIK8R5yzC8O0CTW:MV4/0lVNkrTPSpPnZVnx/e538ZCy","tlshash":"908312ba6c734dd782f9fede13b6f09ba9c8b575b7b0de5e74513c18aaa04a20430111","first_seen":"2024-12-26T20:26:09.90712Z","last_seen":"2026-06-05T22:09:33.514208Z","times_seen":241,"resource_available":false,"data":null}},"time_used":2943,"timings":{"blocked":1043,"dns":0,"connect":0,"send":0,"wait":1286,"receive":614,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/425e4d3d75a543438681a5588a8d38b9?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.553Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/425e4d3d75a543438681a5588a8d38b9?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 17304\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 9130\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"425e4d3d75a543438681a5588a8d38b9\"; filename*=utf-8''425e4d3d75a543438681a5588a8d38b9\r\ncontent-md5: hWPQQAWU77+IFkMQxF/UNA==\r\ncontent-transfer-encoding: binary\r\netag: \"FmgZjRIQmsV9Edt0ANVGQDjz44Bd\"\r\nlast-modified: Thu, 27 Nov 2025 20:11:06 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: RUYcdf2dY\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: LBsAAACeCSw8iH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":17304,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"8563d0400594efbf88164310c45fd434","sha1":"68198d12109ac57d11db7400d5464038f3e3805d","sha256":"33dff23b580d8a36eb17310344afc976ac623f3eff980bc466cefe56e45f12dc","sha512":"9f0e3cac9d90a87326a0e4d5477e8c31eac28a23e4dfe1e42a6b22e8f74cc361df74625908736c2414eb6b736e83b968d63601d4691be5b46b2c502d82b5e61d","ssdeep":"384:39BHr8pMZcNy5H+anKCyafIAnJ/+y4zIt2ADKqUkd5GZdpMz9lZdasq:r4pjo+JC5I6/+TADOS5GZdk9lm","tlshash":"0572d1c0dace7bb34bc963a503ee60b6f57ed6f4053c3aa8eb2d610e6a5426503dc100","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-14T18:21:23.189036Z","times_seen":199,"resource_available":false,"data":null}},"time_used":2626,"timings":{"blocked":991,"dns":0,"connect":0,"send":0,"wait":1307,"receive":328,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/0739fff817404e41803d1b2ae0197d8e?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.565Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/0739fff817404e41803d1b2ae0197d8e?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 13027\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 87\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"0739fff817404e41803d1b2ae0197d8e\"; filename*=utf-8''0739fff817404e41803d1b2ae0197d8e\r\ncontent-md5: jiqGqAK59fWltx50D62HDA==\r\ncontent-transfer-encoding: binary\r\netag: \"FnnHNUL546wi9q7j6UaXl23aMc4i\"\r\nlast-modified: Wed, 03 Dec 2025 01:29:04 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: NXGiIpkgl\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: gIsAAAB3gdN1kH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13027,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"8e2a86a802b9f5f5a5b71e740fad870c","sha1":"79c73542f9e3ac22f6aee3e94697976dda31ce22","sha256":"7f2307bf607251a26c17652670a7444714ced3ae02a0a16b35f48d12e1a7eb5d","sha512":"eb5e51b03b75e83787dcd45f795ad87861a3ce7ba8556e85690d7feff4832bdbecf3aa64ef8f981caa8c3f5d3aa78e6566c27369ae8039ed42316e8bcd5581f8","ssdeep":"192:2bAs+yKMsxJrsWbO+KE62X9BJRS65zZhZ0ga5pkPHc/7Z+HLxAnmMrVjc9Xvw:qAQcFn6o9Bm65VhZD8e8/7M1AnXpcS","tlshash":"4d42c0409bf88fbae35b96107d286884ff2d59078199cafcdfa8977cdd6001593643d4","first_seen":"2025-12-03T01:33:08.84119Z","last_seen":"2025-12-03T01:37:40.740956Z","times_seen":8,"resource_available":false,"data":null}},"time_used":2671,"timings":{"blocked":982,"dns":0,"connect":0,"send":0,"wait":1307,"receive":382,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_ce6f5a12-ce60-4931-b7a7-3cfa94c956bf.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:33.910Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_ce6f5a12-ce60-4931-b7a7-3cfa94c956bf.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:36 GMT\r\nContent-Type: image/png\r\nContent-Length: 112081\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EhU%2BxCFnb6qZd3FqH%2BdKVRB4WWkC%2Br9tKo1xlg4%2BPfxrgq6YXmFIsd4qI1x5QF4OxkgD2eLCIWx8U0SHj3GWOGVi5RGOvWIge64eadtQkn%2Fq2WsVFS5XnmBMG7z9\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"e400b1ce694e9efbda2b9479c60f4115\"\r\nLast-Modified: Mon, 08 Sep 2025 20:50:51 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 1109439\r\ncf-cache-status: HIT\r\nCF-RAY: 9a1581c00a850449-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725556=nR/u3ECZA5pQyCeLNXKPPYGpEcWyonqlfq3mAiuMymQj5zr4wRh2qM9R9UxzUohkKR01hX/ndr/g/wR59lQ5vhpR/H5Bt1Czjn+hfojNM65TJ9v9PjehSVgkDNCv8lQuruu6rSlWsgjkYPX2yNHZouFuQM1WVRIkqrC7+hzmacrgeFG19om9k1GtoWuQ6fTQ\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: CEDA712F-435C-4B54-9B6B-02855C8C6618\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":112081,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"e400b1ce694e9efbda2b9479c60f4115","sha1":"7dea27eee3238d11200801bc44d1bfdf6c2a561b","sha256":"155e9244c0749d2c6891d3b541a8c081104c180e6c9308ef87eb4755ebce213d","sha512":"681dc38636b2420c7e4731f6cd2b11d483e848a64d5c19706465dfa373613c791b8caaf7b8cec746e624c00e6582e7923bf74f0d1d05dad8646f6bcabf267d64","ssdeep":"1536:CaONt1WZ4PaW32QGG8HJRfa9bjz2mt/XO8wLQmI2GOcj2B1Kudk1UaMEcS9dd0f7:B4P5eIbjz2mt/MLQj7j2B1LiUkR9dpe","tlshash":"cdb30201aed3bc913942658841e1d296350f78b2e5ba83c7edffcb0ae5911afc9d4462","first_seen":"2025-08-29T11:05:53.339263Z","last_seen":"2025-12-29T13:58:58.050834Z","times_seen":290,"resource_available":false,"data":null}},"time_used":3188,"timings":{"blocked":2574,"dns":0,"connect":0,"send":0,"wait":306,"receive":308,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/img/EGAME.d289cd48.png","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.207","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.114Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /img/EGAME.d289cd48.png HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 59546\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-e89a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725551=Tl57i2AA5msYKmQD6D9b96oj05vzNG1l1CRjWQNFDIl0/XOB91wmnNIuwbzcvYLLX/+8PfesGrw5GUIZPSgoLImPW3qb6JVtL/D3VFmUZJ2JOKFTQEmo6Emj7kqSzJVgZ3YR6VcZAjkG+nzNcBKE087eIDc4XsCyYhU4Om61Apb3ZxYss03gNL9y0YZ3YnNG\r\nAge: 1115071\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1763280971\r\nX-Request-Id: 754698B4-5BDD-4FFA-876E-36EE8D123F04\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59546,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"eb8991eb9e0db175522c914343f0a10a","sha1":"ce2d41b154df64421d46bceaeb9878da455592dd","sha256":"b837b4e9fc693e5c65eb049c56547caefe1cf73ea31ae59f95ae46d052fd36b2","sha512":"7d2a886e3ac412f6ea1b1ba290064373e1d07a0751bdd7f546af3116ad057d1f17bbe4847179cdf87297a967c0290280ec0c51ab9bfdeb1da0b881e366eb19a8","ssdeep":"1536:hvA9R/SReJczzaRBd6s3DhCDnQcvyFVWGDnmhKYNa67:hIPVczevUIhCDnQc21C7Na67","tlshash":"dd430276882a8fcd499304944bf9afe164eaf19097b3cf91f24c5fe0423d184d881b6b","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-14T18:21:23.26505Z","times_seen":2346,"resource_available":false,"data":null}},"time_used":1812,"timings":{"blocked":1507,"dns":0,"connect":0,"send":0,"wait":303,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/8d072c43088c4a2f9afd8ee836c2d019?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.439Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/8d072c43088c4a2f9afd8ee836c2d019?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 12753\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 4925\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"8d072c43088c4a2f9afd8ee836c2d019\"; filename*=utf-8''8d072c43088c4a2f9afd8ee836c2d019\r\ncontent-md5: y2xw8kMAnkfj0hne5lu11g==\r\ncontent-transfer-encoding: binary\r\netag: \"FnSsnPKUFzHCBhFiqHbbJXW1PW8E\"\r\nlast-modified: Wed, 26 Nov 2025 20:07:46 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: Zee989jLU\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: U7EAAAAM9GoPjH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12753,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"cb6c70f243009e47e3d219dee65bb5d6","sha1":"74ac9cf2941731c2061162a876db2575b53d6f04","sha256":"42682c4dc725a3a6c224a42e21ba39d00c43060a7d3fd04eaf61564c2de3d6e1","sha512":"6c14c8fcdd6ddaa9a15d7f1c92786a8883a3703347fee20e58c214081d6d3f619cbb415aeb7e364af4198d26a74a3d63f49c0ab90c999127b96931f1a73538f1","ssdeep":"384:dBA5tK2EISGM8TnuVXABQ4AY4EkgIkpu8/B070GB4:d+AI3nIXSjrTkC/B0AGi","tlshash":"5442b09f394c440bba55f4d63200e5c6c2bb1f05cb0dd58577f0a2259b80d5745ba9d7","first_seen":"2025-02-24T02:30:01.520048Z","last_seen":"2025-12-03T02:08:18.708436Z","times_seen":25,"resource_available":false,"data":null}},"time_used":3674,"timings":{"blocked":1123,"dns":550,"connect":250,"send":0,"wait":1292,"receive":146,"ssl":308},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d4bc3be4b61f4878b3f24e7d4ee6f332?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:30.522Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d4bc3be4b61f4878b3f24e7d4ee6f332?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 03 Dec 2025 01:32:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 76093\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 21721\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"d4bc3be4b61f4878b3f24e7d4ee6f332\"; filename*=utf-8''d4bc3be4b61f4878b3f24e7d4ee6f332\r\ncontent-md5: QjltGERBVuZAw3R2wrQbkw==\r\ncontent-transfer-encoding: binary\r\netag: \"FuDsNwVtqxeELOZYeMcIrIGPKUyd\"\r\nlast-modified: Thu, 27 Nov 2025 20:08:27 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: NruQ3dce0\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: miQAAAAJmtTIfH0Y\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":76093,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"42396d18444156e640c37476c2b41b93","sha1":"e0ec37056dab17842ce65878c708ac818f294c9d","sha256":"b09876ef72fd33779fbc608a24faeafc15b7d244ed1e418f09049a65dfa2bc3a","sha512":"a5f7c936a451a81096fb16bb1840950793a02be5a35becfbcc5f07165a53a750c30075124803e5dc7485b841da1ff06912e880afcaf8cbe4a68e642559c9583b","ssdeep":"1536:nmRm767zGkUprhf2XchTp5uF5/ytZmVIMiKk1rcwGNOCB2+TMOAen:KhzApr0cpp5S6+VYrNCB2+TMxo","tlshash":"15730280b612be2ec0055ff6c7121a2f53f4f4da0b55d1304e78a48799cba878d788ab","first_seen":"2024-12-26T20:26:09.901909Z","last_seen":"2026-06-05T22:09:33.515809Z","times_seen":394,"resource_available":false,"data":null}},"time_used":2858,"timings":{"blocked":1021,"dns":0,"connect":0,"send":0,"wait":1287,"receive":550,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"y108p.xyz/api/sport/match/list?sportId=1\u0026client=web","fqdn":"y108p.xyz","domain":"y108p.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.206","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://y108p.xyz/","date":"2025-12-03T01:32:35.429Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b227m.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 07:17:39 GMT","end":"Sat, 14 Feb 2026 07:17:38 GMT"},"fingerprint":{"sha1":"ED:01:DF:86:AC:93:0F:16:29:8B:63:B2:38:00:14:14:AA:8F:78:F5","sha256":"65:0D:45:B6:D1:80:D2:47:D3:59:93:31:D9:82:85:2F:25:2F:41:DE:B6:79:06:47:0F:9D:C3:81:B0:6D:AF:F8"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: y108p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://y108p.xyz/\r\nx-request-source: https://y108p.xyz\r\nXign: YsBpYKpM3fpA3avG1e4QNOjddel9qu2k346oP/TAcP+BBxJOrUPTOyweUQLyi0xT+QB3UnMLJwJm5xFUQTuQSGtsXKayPvSUZdYg9QzjJVP02rKM7+Oz50DjSIQksZVCl1kTzD5etfav4KjEVebzP+Gxb9uHfrG0ZhkoLQDr5/M=\r\ntimestamp: 1764725555423\r\nsign: 4b1d5t2s1u3c1166\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: rEfAYkDGbEEF5yTzpkNZQfYMBdt5bAF3\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:32:36 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1764725556=nR/u3ECZA5pQyCeLNXKPPYGpEcWyonqlfq3mAiuMymQj5zr4wRh2qM9R9UxzUohkKR01hX/ndr/g/wR59lQ5vhpR/H5Bt1Czjn+hfojNM65TJ9v9PjehSVgkDNCv8lQuruu6rSlWsgjkYPX2yNHZouFuQM1WVRIkqrC7+hzmacrgeFG19om9k1GtoWuQ6fTQ\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1763280971\r\nX-Request-Id: 296D8BF0-FFA3-440E-A238-A27D3FF42B1F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11733,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"564f0bcfef33f993a8a93fcdbc8b66a5","sha1":"a226ab3a5b144379cfa86e251c2b0196ab2d865f","sha256":"867d63cd297a203360bf014d6dc66d8cbd398160c91c439d4b8cc1d72e3bcd0f","sha512":"84bac30d6db4fc053a41875d4cf5725a7737e36b705cd29b9c02915fb603525a17e7daea7f0c03eb83db8da4b68917fe447adef3f22e5fed40dcd61cb1e4f08a","ssdeep":"192:eGRkgqChKan+RzVsB4c8E9McgeOMRzdJD3xw/U3RodmfURodCrWRodSAQnRod2/B:eG2LCX+pqB4y9qeOMpLD3gU3S8fUSsrk","tlshash":"3f32ef5281dc18e52b9c21d65d4e3f4d987eaa5b0a9ef9d5ed4ecf0c20b43fb5200e29","first_seen":"2025-12-03T01:33:08.818851Z","last_seen":"2025-12-03T01:33:08.818851Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1280,"timings":{"blocked":832,"dns":0,"connect":0,"send":0,"wait":448,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"y108p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}