{"report_id":"26a6d5e1-4d65-4aaf-befb-e881c1496138","version":0,"status":"done","tags":[],"date":"2026-07-17T15:37:57Z","url":{"schema":"http","addr":"treehope.cc","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":0,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"treehope.cc/#/no-wallet","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"title":"USDC Savings","dom":{"size":6416,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1244)","md5":"6c97016b8ab0bf2a080a3695204797df","sha1":"fc4c2ff731116739992ac6cbd45b9e6e6927fafa","sha256":"bb7629cfbc43a4d714e81b508d96e279c83bb530f5071c26e6638be396deef94","sha512":"3cf5e58357e619d4b022a96fd9d15325369ed52837e8969c0bbe838a55b2d02b1c6e5d57bb2b237cd7d566189b51bac39f5611a7be7927b24bc05f79f3f3c845","ssdeep":"192:WHfT7K3O8AivLZj4ZCxfZ/2nfD3bH+Me9dB1nYAYDdMfw:063QZCxJ2crYdBMI","tlshash":"9ed1b8b35de08827236345e6dae7b414be229317c80a5860b9cc41e94fe1ff588cb775","dom_hash":"domhash4b2dadc8a84def067818e18aab079d8f","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"treehope.cc","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":0,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-21T15:37:57Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"treehope.cc","ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":12,"received_data":2551235,"sent_data":6147,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"webapi.shedeadmin.cyou","ip":{"addr":"45.204.13.176","port":443,"asn":132813,"as":"HK AISI CLOUD COMPUTING LIMITED","country":"United States","country_code":"US"},"domain_registered":"2026-04-02","domain_rank":0,"first_seen":"2026-04-15T13:44:14.863373Z","last_seen":"2026-07-17T15:37:08.487286Z","alert_count":0,"request_count":7,"received_data":5113,"sent_data":3848,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"treehope.cc/","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"faccd6da804a622952268958b267dae7","sha1":"194085ffd6c585ff1061361418532e56a514ec91","sha256":"be0e6c50f08c3d439dcdcbc9aa52e6b5ce5fc3005a1487e0ed3508b96bc02972","sha512":"6372fd8bdec2d72455a6c118f187c2e1e4a8ab6d37a38a42856d6b5c44ac43348a8586eb90e86a711de13b54e17670884091bfb7e7f3250f4282205e34e7ea49","ssdeep":"","tlshash":"2711abfe195aa0296303404e976b7801642250a9000a185173ccdb9dbb9af6dd0cbb8d","size":1034,"data":"","first_seen":"2026-07-17T15:37:13.696564Z","last_seen":"2026-07-17T15:48:13.535602Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"cd7a34e714de94d5c29b8ac5acdde24b","sha1":"b722bccb435490630d97ef88cafeb02d92f70fd0","sha256":"312ebfdc50a0e168cff60c206811b02e944263a7d9060c2685509dacfacd7f71","sha512":"a724bc648a508c24e5bb1788e1f02b47030893bbb0b80a99e380d95480095983a35d8ec11193c53f0a67db47a289ab608fcbc9dbca846bfdd5d61a8832290f43","ssdeep":"","tlshash":"58e07d48ff28c7f316ce28ab516e770858d104d58c1b58024cebccc86935ed87291527","size":314,"data":"","first_seen":"2023-03-11T11:23:25Z","last_seen":"2026-07-17T18:19:14.429699Z","times_seen":40111,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"528dd01eb509d1fc3c68b48e165c9d77","sha1":"8d702f33d869eb8c53cf75c17014f96385322395","sha256":"b508dff20bdbd9138e31aa48c45bc501805e509d2fd4709b39c4a60cd5c6b43a","sha512":"4c1edeec560f431005363ff5291acc80c1c42edf7c9a6d6e4fde2f7539b6a35a8e36f0bc228503263277bf5df4525dc579575faadca614c32e5dfa885a2d343b","ssdeep":"","tlshash":"78a012bb71b851710cd51ba7a40455e01c20123105052c101c8d5151c011c171d394c0","size":84,"data":"","first_seen":"2023-04-07T06:55:59Z","last_seen":"2026-07-17T18:19:14.430246Z","times_seen":41781,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/assets/vendor-64f46974.js","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"3abf93235f8805aa2deb613de1c2e022","sha1":"3d00674e75280d0c645aab6e995dadb83c2e5e29","sha256":"4d5b7079708762a681efb01593bd187df376929eb2119a74fff768d1cbf01344","sha512":"87d7887c903a132b9189f0b75fdd99897fafd08a343443ded10b564a4120b21a2e703818267814284a0545a8337ffc61e44dc17efd049a48d30898388d199208","ssdeep":"12288:5RnbvFkQvVb8mXXdRLYNmD/ahCVawlVaPeJZ3J/pooTqr9szo/UXRdBE7m+jYhSr:5RnbvFjoiXTLxahCVlSG3WtYioSstI","tlshash":"f31528c97292f06147ab24e240bb0106f3396e59740e84a4f1ad98eb7d79d89d277f3c","size":889410,"data":"","first_seen":"2025-12-30T23:38:20.64961Z","last_seen":"2026-07-17T15:48:13.52573Z","times_seen":35,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/#/no-wallet","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"dcd79ed7f4bc026b4db96e1ae9b8fb97","sha1":"598a212ecf4898b9b2892412e9e83a400d5a008b","sha256":"cbb9e541e67567a3dc61831e08ec402a53984cff58a096f1a48597da3df62c77","sha512":"24a9faf9ea6f0ccd4e9af46a3ca424ff87b2b37001b079c8c4e0b0081d9a844d4e6bfc81c73a2243776d58f8bb1304f4d572975c70a3139c4d2125e5da54c9a7","ssdeep":"","tlshash":"95d0a7d5b1861e605745575524ef15e4a138842a76444716cd9c990c2a520f88333f98","size":224,"data":"","first_seen":"2025-04-13T20:28:04.831233Z","last_seen":"2026-07-17T15:48:13.553044Z","times_seen":51,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/assets/index-f7f18b99.js","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"632c2a0e4323d35de2a1a64a2204d5c0","sha1":"26096f17233c9115c74bbcf702a94ec33d371464","sha256":"03bdc7e0bf5ecf525c858281dbc7fd7a5b697c92f39517a254582e11bf1c26de","sha512":"c403370ff6fe408d864fe33c0154846366665c51a7bc7341c33ee1d5842aea35a19dbd17648b004cbe8fb100ad2c91e3874e89e97f232e1f1db4be4003d12c4b","ssdeep":"768:Dh6Amtg+wESe/Ffxx8cLulaMb3MLaJeX5MI9MHjcz8LaLUq8DGL09Z2aSFn/edzA:89x8b8dtcLaAqzO2A329jj6q8q","tlshash":"1ea33a99940b0fff68be0888a91a540021691fd75d8dccd3b7bf9e5627f9ce8624d318","size":103677,"data":"","first_seen":"2026-07-17T15:37:13.688267Z","last_seen":"2026-07-17T15:48:13.519476Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/#/no-wallet","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"3b8169908f63877e8e60a39198f276ad","sha1":"c168a52fac932c30ce26c29354094eb425561757","sha256":"e4ef5cf4ec0d569c9f0e48a159f32fb1b0db370020139adba6a80ea708200830","sha512":"0ccb1f75e1f25c2fed565176bbd9e0f2a216bd3b2e2df3f161a3aca8ba607ad435353e94382ba33db3d13c24f42c57a87299e3e45c68e6a3ed88adbe83d10cea","ssdeep":"","tlshash":"47c08cc9a1c22e006602651155bf35f4a024402a71481b178ee4d8982f230f88233ed8","size":156,"data":"","first_seen":"2025-04-13T20:28:04.833363Z","last_seen":"2026-07-17T15:48:13.534338Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/#/no-wallet","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"c0e88513b499aae066f13f6f0edfedab","sha1":"12fd9320e7be26e9257e2a1a39a698a5e2706292","sha256":"3ffd5a1fea533c35c122aeb0a36f3d4a37022e0a14c83167faeaa819b3ee8cfd","sha512":"36b57e74aa71e21ec5489637f206796e8b9097db32c59e4ffbbdd7eb11ce35c2f754178f996bd6e11abc560cdddd3af7cde3fc1847c1a455120b5c26ee4fb838","ssdeep":"","tlshash":"17c08cc8b0c6ad001602e45111bf25e4a024802770481b128d98e8483e220f48233e9c","size":139,"data":"","first_seen":"2023-08-29T11:10:58Z","last_seen":"2026-07-17T16:25:05.152063Z","times_seen":1587,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/#/no-wallet","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"7746993e8adb9277ba5afa2584910974","sha1":"8e7e6d562fd56f594b40b6657156d483d7426e40","sha256":"833dc15f120cad89d5c0680edae217dbad02010e42af351959607df4170074ee","sha512":"10ee66e22fa45386057f1385e179955ad4fd4d53363c0aebe68aa9ba0547bf409a286e53ab6e678e5d0c3485d6cabcdd359f359c5258160b50a0a5a5496d6e6d","ssdeep":"","tlshash":"39c08cc5a0c22e101646641010bf28e49024402674481b028c98d8482e220b08233e9c","size":140,"data":"","first_seen":"2023-04-13T07:32:13Z","last_seen":"2026-07-17T16:25:05.149365Z","times_seen":4326,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/charting_library/charting_library.min.js","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8573e89d9ec535663d75f21b1f08109c","sha1":"a8d9eea0b157ceeffc38d4254e6f6abc9d697d10","sha256":"cb0c6c9f1771d252eee7caa043bdd7cfffbd52c2cc4b18b7be7c4554ed069151","sha512":"55d728fa1e0682725f94b17387c6790792d3d34b43652a00097876118575bd6cefa20916d80674519005d72f20ecbb745e9645516c056e6f9bb6691d5efbcb33","ssdeep":"192:9fdWSo7ktFUnoBelr6lw2LfnzuIQPlaJ1i10K+Ei/ISJhvHIheu5Ph3Ffam:vWS2ktFUnoIlD2LfnqIJimK+5/ISJhvu","tlshash":"6e224f58ed2478720acb54f0427f180f8239e278d84944ed3cc4e6ec59fd44a6a6fbb8","size":10858,"data":"","first_seen":"2023-08-16T00:37:19Z","last_seen":"2026-07-17T16:03:29.88298Z","times_seen":1303,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/#/no-wallet","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"b8386832cc93e46fc46069426d0d9a6f","sha1":"db9105233a4b1959e2e6e3bcf4ba4dd63ac6f0f0","sha256":"4c8947d852a9e811635dc26d84bcb5c054c59e187f68ebc12f238633f324e059","sha512":"e33203f2768b1106a9cad29916534daca7774e454be07871504970692ba99d821b43c1916d8d670eb7586bdfe85de41a6bf198ab51f43b913e3fa5db89259716","ssdeep":"","tlshash":"9be0abb33174c0249481512b19dd242bf3c6a1714c4c4f2aa4c896195e4dca8307c491","size":408,"data":"","first_seen":"2026-04-15T13:43:49.238245Z","last_seen":"2026-07-17T15:48:13.532738Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/assets/en-58a8e4bb.js","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"f210e0521dd1a39a567f73c5393b14ef","sha1":"e37ce7d8f362c334614552cd06f9ae8ebb41d715","sha256":"74d95f273ffe66bc6b95677b5232e4ff6a38569e654a212aaba807d64fe7a195","sha512":"f17471be51f2561f2e00ffb67d5c1cd2ef0f710f06a9cce49418558f8107a06a1c39d443c66d3ddb587239daa219efaa73bf31e0f10ceeb2317e8d1562c91c00","ssdeep":"768:+GtZcEw/o7rKONAFsifnAMC2rAaAMxXF6+6sP4u9w1mwO6fpk7aOLFit7:iponKONebE2rdxXKsP4ewqLFip","tlshash":"7313d6897e1a889a04f35376b4ce6e5120f60ac18256881f4fedc9fd53d2b67a363734","size":41578,"data":"","first_seen":"2026-07-17T15:37:13.684939Z","last_seen":"2026-07-17T15:48:13.523911Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/#/no-wallet","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"9d379fc52463f2b630c6894900da5180","sha1":"b33fecceae6c1ef97518c6ad7159534d78e7b2f7","sha256":"6c3288c6af4396096b1a8a927fbfaf05ac8cc29658fc97d13cf036ba6bb38ab3","sha512":"49b43b0c253e26c135bd5009d73c537cf2e78342ef6b116ce6efbd3627152ac804449ec5cbe637a544b5557b52a50213a19dfcf33158a4f6b0a8ff91d79372d5","ssdeep":"","tlshash":"61c012c5a0da29102951595424bf28e8a024c026b55c6b169de4dda829e64fcc627d98","size":190,"data":"","first_seen":"2024-07-11T15:08:28Z","last_seen":"2026-07-17T16:25:05.139925Z","times_seen":1339,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/#/no-wallet","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"51e586f9b3825943ee5e3bb9ca606ad3","sha1":"ca2bf67804939fb4d9bc9afb5f7470e36e0037f4","sha256":"63aa8568c2b31ae59842bdf28b74c1b266b81d186c72ee64d0ec371f48d458de","sha512":"ddd3f2c11759fdf632e9c6b4021c8755cee3bddff9efb9071dfef3f844bde35ef421169ce982ff1c69f7402dc70f428d776bba513a73136631b0a8b09e44c12f","ssdeep":"","tlshash":"a7c08cc6a0d22d001616641014af24e89024402670485f128c94d84c2e220f09233ea8","size":142,"data":"","first_seen":"2025-04-13T20:28:04.830126Z","last_seen":"2026-07-17T15:48:13.546788Z","times_seen":57,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/#/no-wallet","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"a12beb8c3bea6886db7346b336af5549","sha1":"d816d03c631617eb32b27baac48feb2c2495ced9","sha256":"a4d1b2dbfcfa038ac5b5e980ea2f3fdc31948863bfca2849320183410f831fc4","sha512":"0ac7131f62c6f4834a04a8f1824d28bbc3f95975bdf2d1b90b026db770f6320d735e910aced8d25ce7ce198de07b5af06c957855d3b8f62ccba1cca16810658b","ssdeep":"","tlshash":"d6c08cc4a0c22d001642691014af28e4d024a026b0485b168c98dc892e630b09237ea8","size":142,"data":"","first_seen":"2025-04-13T20:28:04.827015Z","last_seen":"2026-07-17T15:48:13.534993Z","times_seen":51,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"treehope.cc/assets/vendor-72ef657d.css","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:28.964Z","timestamp":1784302648964,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treehope.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 15:03:33 GMT","end":"Sat, 10 Oct 2026 15:03:32 GMT"},"fingerprint":{"sha1":"83:70:6A:56:C6:57:05:A8:E8:42:1D:9E:63:FE:13:11:B1:8C:42:42","sha256":"D4:EB:37:F6:35:73:85:42:78:9B:09:16:72:7B:58:BA:55:59:41:02:D5:B5:FC:F2:85:89:AB:73:BB:74:21:E5"}}},"request":{"raw":"GET /assets/vendor-72ef657d.css HTTP/1.1\r\nHost: treehope.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_session_90e22643=81e0f2c230122a68cb6afa3ef61999e7\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:29 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 17 Jul 2026 04:21:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a59add8-16997\"\r\nexpires: Sat, 18 Jul 2026 03:37:29 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":92567,"size_decoded":38098,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65022), with no line terminators","md5":"b40940e3efd47e3e653fe1fbec0ab363","sha1":"3911d44e1bceb07e83746e6bc68de9dbb587b11a","sha256":"72ef657df5906e9f23040a4ceb49985bf894ddcb4324d7d873a0c20b15d3e864","sha512":"f3706c9146b2091fb1a864ab4180d0a1538e801686af21bab4c7231421859a99fba7dd694632faaf1c457fb06711fcb16809e2221fe692c16390e7e98ccbf4d5","ssdeep":"1536:ZTIyNBi3MFYaQj73rx3WqyrtpqoSWEDZEnX73:ZdN0rxmNH9yDWr3","tlshash":"0193c5a5e9c4a1fc6f26f6659b4766d8f13cf661cc01daa0f109512d0fc7bf50223a2a","first_seen":"2024-01-05T03:21:29Z","last_seen":"2026-07-17T16:25:05.121387Z","times_seen":309,"resource_available":false,"data":null}},"time_used":911,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":911,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"wss","addr":"wss://webapi.shedeadmin.cyou/ws/7c8334ec-a702-4bc4-ad52-7c5c09b52e0e","fqdn":"webapi.shedeadmin.cyou","domain":"shedeadmin.cyou","tld":"cyou"},"ip":{"addr":"45.204.13.176","port":443,"asn":132813,"as":"HK AISI CLOUD COMPUTING LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:30.880Z","timestamp":1784302650880,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.shedeadmin.cyou","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 14 Jun 2026 06:10:34 GMT","end":"Sat, 12 Sep 2026 06:10:33 GMT"},"fingerprint":{"sha1":"D8:CE:55:F7:7A:07:7F:4F:CA:88:16:39:B9:D4:14:77:5E:A0:58:0D","sha256":"5B:A3:23:15:C3:75:DA:A0:3C:75:40:CD:DA:F2:06:0F:4A:8D:08:8E:A6:A0:3C:2C:D0:75:DC:D0:A0:E9:6E:5F"}}},"request":{"raw":"GET /ws/7c8334ec-a702-4bc4-ad52-7c5c09b52e0e HTTP/1.1\r\nHost: webapi.shedeadmin.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://treehope.cc\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: h3RlPLwSfWqRfgvkljENCw==\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 \r\nServer: nginx\r\nDate: Fri, 17 Jul 2026 15:37:32 GMT\r\nConnection: upgrade\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nAccess-Control-Allow-Origin: https://treehope.cc\r\nAccess-Control-Allow-Credentials: true\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: 8FBzi1XSBR/skHrNMKMDtICQRn8=\r\nSec-WebSocket-Extensions: permessage-deflate\r\nX-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1; mode=block\r\nSet-Cookie: server_session_90e22643=debb74fda974983b1be2bf74af214405; Max-Age=864000; httponly; path=/\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":545,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T18:40:23.841109Z","times_seen":17321112,"resource_available":true,"data":null}},"time_used":2299,"timings":{"blocked":-1,"dns":766,"connect":1019,"send":0,"wait":257,"receive":0,"ssl":257},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.shedeadmin.cyou/api/common/getCoinList","fqdn":"webapi.shedeadmin.cyou","domain":"shedeadmin.cyou","tld":"cyou"},"ip":{"addr":"45.204.13.176","port":443,"asn":132813,"as":"HK AISI CLOUD COMPUTING LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:30.885Z","timestamp":1784302650885,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.shedeadmin.cyou","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 14 Jun 2026 06:10:34 GMT","end":"Sat, 12 Sep 2026 06:10:33 GMT"},"fingerprint":{"sha1":"D8:CE:55:F7:7A:07:7F:4F:CA:88:16:39:B9:D4:14:77:5E:A0:58:0D","sha256":"5B:A3:23:15:C3:75:DA:A0:3C:75:40:CD:DA:F2:06:0F:4A:8D:08:8E:A6:A0:3C:2C:D0:75:DC:D0:A0:E9:6E:5F"}}},"request":{"raw":"OPTIONS /api/common/getCoinList HTTP/1.1\r\nHost: webapi.shedeadmin.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://treehope.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:31 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://treehope.cc\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nset-cookie: server_session_90e22643=debb74fda974983b1be2bf74af214405; Max-Age=864000; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":758,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T18:40:23.841109Z","times_seen":17321112,"resource_available":true,"data":null}},"time_used":776,"timings":{"blocked":0,"dns":0,"connect":259,"send":0,"wait":255,"receive":0,"ssl":262},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/resource/images/light/nowallet.png?2.0.1784262104680","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:32.295Z","timestamp":1784302652295,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treehope.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 15:03:33 GMT","end":"Sat, 10 Oct 2026 15:03:32 GMT"},"fingerprint":{"sha1":"83:70:6A:56:C6:57:05:A8:E8:42:1D:9E:63:FE:13:11:B1:8C:42:42","sha256":"D4:EB:37:F6:35:73:85:42:78:9B:09:16:72:7B:58:BA:55:59:41:02:D5:B5:FC:F2:85:89:AB:73:BB:74:21:E5"}}},"request":{"raw":"GET /resource/images/light/nowallet.png?2.0.1784262104680 HTTP/1.1\r\nHost: treehope.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_session_90e22643=81e0f2c230122a68cb6afa3ef61999e7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 15 Jul 2026 20:28:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a57ed66-8c14\"\r\nexpires: Sun, 16 Aug 2026 15:37:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35860,"size_decoded":35279,"mime_type":"image/png","magic":"PNG image data, 800 x 356, 8-bit/color RGB, non-interlaced","md5":"a3877c3de6991724167020f4746cd343","sha1":"96568f8b5ed09a56ac2f9fece74d54bc7629d57d","sha256":"e63c8b25303ff05fad80631688c5638be2edd6c29bc8b92670ba4780a8fab25d","sha512":"7aeb267846808fa244c76e55be3dc5f337bfc6d8e82b6e1a5af73553985bf6e4b3ca6e26064c94bc8cd227bebb3bdb01ba46dc534cabc90ebabf488ef3569cea","ssdeep":"768:/N1IBFqG0kSI5ta4rUSlWUbsylujjXL+GFCTh:/NCqTkdECAUIPXSGmh","tlshash":"18f2f102fe7af081f32ce1f3a5662f77562e111ddf86e62672dad45e01011b62b91c8d","first_seen":"2025-04-13T20:28:04.816981Z","last_seen":"2026-07-17T15:48:13.521944Z","times_seen":51,"resource_available":false,"data":null}},"time_used":307,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/assets/vendor-64f46974.js","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:28.961Z","timestamp":1784302648961,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treehope.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 15:03:33 GMT","end":"Sat, 10 Oct 2026 15:03:32 GMT"},"fingerprint":{"sha1":"83:70:6A:56:C6:57:05:A8:E8:42:1D:9E:63:FE:13:11:B1:8C:42:42","sha256":"D4:EB:37:F6:35:73:85:42:78:9B:09:16:72:7B:58:BA:55:59:41:02:D5:B5:FC:F2:85:89:AB:73:BB:74:21:E5"}}},"request":{"raw":"GET /assets/vendor-64f46974.js HTTP/1.1\r\nHost: treehope.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_session_90e22643=81e0f2c230122a68cb6afa3ef61999e7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:29 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 17 Jul 2026 04:21:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a59add8-d9242\"\r\nexpires: Sat, 18 Jul 2026 03:37:29 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":889410,"size_decoded":293507,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"3abf93235f8805aa2deb613de1c2e022","sha1":"3d00674e75280d0c645aab6e995dadb83c2e5e29","sha256":"4d5b7079708762a681efb01593bd187df376929eb2119a74fff768d1cbf01344","sha512":"87d7887c903a132b9189f0b75fdd99897fafd08a343443ded10b564a4120b21a2e703818267814284a0545a8337ffc61e44dc17efd049a48d30898388d199208","ssdeep":"12288:5RnbvFkQvVb8mXXdRLYNmD/ahCVawlVaPeJZ3J/pooTqr9szo/UXRdBE7m+jYhSr:5RnbvFjoiXTLxahCVlSG3WtYioSstI","tlshash":"f31528c97292f06147ab24e240bb0106f3396e59740e84a4f1ad98eb7d79d89d277f3c","first_seen":"2025-12-30T23:38:20.64961Z","last_seen":"2026-07-17T15:48:13.52573Z","times_seen":35,"resource_available":true,"data":null}},"time_used":607,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":607,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.shedeadmin.cyou/api/common/getAllSetting","fqdn":"webapi.shedeadmin.cyou","domain":"shedeadmin.cyou","tld":"cyou"},"ip":{"addr":"45.204.13.176","port":443,"asn":132813,"as":"HK AISI CLOUD COMPUTING LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:30.878Z","timestamp":1784302650878,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.shedeadmin.cyou","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 14 Jun 2026 06:10:34 GMT","end":"Sat, 12 Sep 2026 06:10:33 GMT"},"fingerprint":{"sha1":"D8:CE:55:F7:7A:07:7F:4F:CA:88:16:39:B9:D4:14:77:5E:A0:58:0D","sha256":"5B:A3:23:15:C3:75:DA:A0:3C:75:40:CD:DA:F2:06:0F:4A:8D:08:8E:A6:A0:3C:2C:D0:75:DC:D0:A0:E9:6E:5F"}}},"request":{"raw":"OPTIONS /api/common/getAllSetting HTTP/1.1\r\nHost: webapi.shedeadmin.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://treehope.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:31 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://treehope.cc\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nset-cookie: server_session_90e22643=debb74fda974983b1be2bf74af214405; Max-Age=864000; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":758,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T18:40:23.841109Z","times_seen":17321112,"resource_available":true,"data":null}},"time_used":769,"timings":{"blocked":-1,"dns":0,"connect":254,"send":0,"wait":255,"receive":0,"ssl":260},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/platform/dev/logo_144.png?2.0.1784262104680","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:31.370Z","timestamp":1784302651370,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treehope.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 15:03:33 GMT","end":"Sat, 10 Oct 2026 15:03:32 GMT"},"fingerprint":{"sha1":"83:70:6A:56:C6:57:05:A8:E8:42:1D:9E:63:FE:13:11:B1:8C:42:42","sha256":"D4:EB:37:F6:35:73:85:42:78:9B:09:16:72:7B:58:BA:55:59:41:02:D5:B5:FC:F2:85:89:AB:73:BB:74:21:E5"}}},"request":{"raw":"GET /platform/dev/logo_144.png?2.0.1784262104680 HTTP/1.1\r\nHost: treehope.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_session_90e22643=81e0f2c230122a68cb6afa3ef61999e7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:31 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 15 Jul 2026 20:28:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a57ed66-2d32\"\r\nexpires: Sun, 16 Aug 2026 15:37:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11570,"size_decoded":12113,"mime_type":"image/png","magic":"PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced","md5":"fdd7a218dedb0263d27a6435da11542b","sha1":"bf7248dd9587a2c1cb51b8684e1f4fcd8152a003","sha256":"cad630682903d9666ac28124e82cc7976b322b3ea4bc97e7617d237ef96c72a2","sha512":"9e0f96f5aa4d094e40d3b9fc10db3061fd9692e5cb3aec90c32df53321e3585a68dbf2c7653609e157abc9b536ae0f57851ec828aaa643f14a58c6b7b23f38ec","ssdeep":"192:lMeCiTeHh6bYpuwELfp030Q9tIpqQ8Q8ixYp7y1ak6fmbCiSG6vOwtC6MiEpaofg:yFPfg1PQ9mqQ8diedypLf6GwtCZiqfSp","tlshash":"9332b0d4b1cd51ed128cc8a99bcd998a98ef66640be3de16d8e71532730c6601f0fc97","first_seen":"2026-04-15T13:43:49.222729Z","last_seen":"2026-07-17T15:48:13.530673Z","times_seen":8,"resource_available":false,"data":null}},"time_used":306,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.shedeadmin.cyou/api/common/type/defi_activity_type","fqdn":"webapi.shedeadmin.cyou","domain":"shedeadmin.cyou","tld":"cyou"},"ip":{"addr":"45.204.13.176","port":443,"asn":132813,"as":"HK AISI CLOUD COMPUTING LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:32.300Z","timestamp":1784302652300,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.shedeadmin.cyou","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 14 Jun 2026 06:10:34 GMT","end":"Sat, 12 Sep 2026 06:10:33 GMT"},"fingerprint":{"sha1":"D8:CE:55:F7:7A:07:7F:4F:CA:88:16:39:B9:D4:14:77:5E:A0:58:0D","sha256":"5B:A3:23:15:C3:75:DA:A0:3C:75:40:CD:DA:F2:06:0F:4A:8D:08:8E:A6:A0:3C:2C:D0:75:DC:D0:A0:E9:6E:5F"}}},"request":{"raw":"OPTIONS /api/common/type/defi_activity_type HTTP/1.1\r\nHost: webapi.shedeadmin.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang,language\r\nOrigin: https://treehope.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:32 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://treehope.cc\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang, language\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nset-cookie: server_session_90e22643=debb74fda974983b1be2bf74af214405; Max-Age=864000; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":768,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T18:40:23.841109Z","times_seen":17321112,"resource_available":true,"data":null}},"time_used":262,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":262,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/assets/index-f9e3ea83.css","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:28.966Z","timestamp":1784302648966,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treehope.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 15:03:33 GMT","end":"Sat, 10 Oct 2026 15:03:32 GMT"},"fingerprint":{"sha1":"83:70:6A:56:C6:57:05:A8:E8:42:1D:9E:63:FE:13:11:B1:8C:42:42","sha256":"D4:EB:37:F6:35:73:85:42:78:9B:09:16:72:7B:58:BA:55:59:41:02:D5:B5:FC:F2:85:89:AB:73:BB:74:21:E5"}}},"request":{"raw":"GET /assets/index-f9e3ea83.css HTTP/1.1\r\nHost: treehope.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_session_90e22643=81e0f2c230122a68cb6afa3ef61999e7\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:29 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 17 Jul 2026 04:21:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a59add8-4a822\"\r\nexpires: Sat, 18 Jul 2026 03:37:29 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":305186,"size_decoded":66669,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65022), with no line terminators","md5":"76a596bf31d95734b75f3c2fd596270f","sha1":"dad0b76523dfc892499d482b9589f7a63657b2e4","sha256":"f9e3ea8358733d3dd3552e724846d75a1161be2a811a0882dded10796ce2a19b","sha512":"0ac7f0193f2865dfb5ad9805e6459536fc2523fed530e971b0f0a74b995a39e565639bd7a0322332e01f8c25d3a69da374e43c056ae123a12dd70d892fd90771","ssdeep":"6144:n+B/9S/Jk4UkZ8w71ZACkFDS3vyf58rBeV05Tz:+B/54NZ8w71ZACkFDS3vyf58rBeV05Tz","tlshash":"0254c6a9a590117c6f27aa7597ce9ad8f23ce6719c118de8f20160094fc3ff92363617","first_seen":"2026-07-17T15:37:13.695733Z","last_seen":"2026-07-17T15:48:13.517842Z","times_seen":4,"resource_available":false,"data":null}},"time_used":910,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":910,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/resource/fonts/Arial.ttf","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:30.526Z","timestamp":1784302650526,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treehope.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 15:03:33 GMT","end":"Sat, 10 Oct 2026 15:03:32 GMT"},"fingerprint":{"sha1":"83:70:6A:56:C6:57:05:A8:E8:42:1D:9E:63:FE:13:11:B1:8C:42:42","sha256":"D4:EB:37:F6:35:73:85:42:78:9B:09:16:72:7B:58:BA:55:59:41:02:D5:B5:FC:F2:85:89:AB:73:BB:74:21:E5"}}},"request":{"raw":"GET /resource/fonts/Arial.ttf HTTP/1.1\r\nHost: treehope.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://treehope.cc/assets/index-f9e3ea83.css\r\nCookie: server_session_90e22643=81e0f2c230122a68cb6afa3ef61999e7\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:30 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 1047012\r\nlast-modified: Wed, 15 Jul 2026 20:28:22 GMT\r\netag: \"6a57ed66-ff9e4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1047012,"size_decoded":1047469,"mime_type":"application/octet-stream","magic":"TrueType Font data, digitally signed, 25 tables, 1st \"DSIG\", 58 names, Unicode, � 2017 The Monotype Corporation. All Rights Reserved. ","md5":"ffe66dbfc4b07f36ef38dd621ad2c7cc","sha1":"e032b102cfc37c3226d17e1b462edea5fbf8fe1c","sha256":"c1216a01b3cc4e94df72577a6f618154058a1d8999ed58fa31ab7e54c7e4be4b","sha512":"3c7952b71c8117938c5284efca0e0b3e8c20d7b84c74a4890f76a72af3b26295786b0f7c33d9b6c980527b4c4c8dad628d1f5e7e5f202d11076367f082349bb3","ssdeep":"24576:NoQIQRjo/Y7wjgTmKJ4WxA7EAD4OBfDamXKE6AMra:NHIQJo/Y7wjgTm0PxAwJHE6hG","tlshash":"f125be0bf3929f0fe3902b38c9a5d761939b76189b2743b73d8c5858ecc85a45e487d2","first_seen":"2023-07-29T15:16:45Z","last_seen":"2026-07-17T16:45:38.334455Z","times_seen":2096,"resource_available":false,"data":null}},"time_used":623,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":306,"receive":317,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/platform/dev/favicon.ico?2.0.1784262104680","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:31.372Z","timestamp":1784302651372,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treehope.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 15:03:33 GMT","end":"Sat, 10 Oct 2026 15:03:32 GMT"},"fingerprint":{"sha1":"83:70:6A:56:C6:57:05:A8:E8:42:1D:9E:63:FE:13:11:B1:8C:42:42","sha256":"D4:EB:37:F6:35:73:85:42:78:9B:09:16:72:7B:58:BA:55:59:41:02:D5:B5:FC:F2:85:89:AB:73:BB:74:21:E5"}}},"request":{"raw":"GET /platform/dev/favicon.ico?2.0.1784262104680 HTTP/1.1\r\nHost: treehope.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_session_90e22643=81e0f2c230122a68cb6afa3ef61999e7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:31 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 1691\r\nlast-modified: Wed, 15 Jul 2026 20:28:22 GMT\r\netag: \"6a57ed66-69b\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1691,"size_decoded":2131,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32 with PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced, 24 bits/pixel","md5":"731afff3078b6dd00903de8789e4edab","sha1":"472a8126da10a801e1de4c568615339026956f8c","sha256":"155041e4e0e0c2f2f0da832bb85aaea1dad62ef14ae3fd5488c1d9e1798fce16","sha512":"d2dfe6245916ca7836cbf83079a8571ce5047287e7c70a358e86d656a23b834ad2501af4beff2472bd048e534dd7064fe88a8c5b4daac0c111cb0a08bb1c1ce7","ssdeep":"","tlshash":"42311ac3277a0c5c8df57644a5c323e962d16d35adc9577f382990a1010cb65376324b","first_seen":"2026-04-15T13:43:49.225418Z","last_seen":"2026-07-17T15:48:13.522988Z","times_seen":8,"resource_available":false,"data":null}},"time_used":305,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":305,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.shedeadmin.cyou/api/common/getMt5Amount?coin=xau","fqdn":"webapi.shedeadmin.cyou","domain":"shedeadmin.cyou","tld":"cyou"},"ip":{"addr":"45.204.13.176","port":443,"asn":132813,"as":"HK AISI CLOUD COMPUTING LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:31.952Z","timestamp":1784302651952,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.shedeadmin.cyou","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 14 Jun 2026 06:10:34 GMT","end":"Sat, 12 Sep 2026 06:10:33 GMT"},"fingerprint":{"sha1":"D8:CE:55:F7:7A:07:7F:4F:CA:88:16:39:B9:D4:14:77:5E:A0:58:0D","sha256":"5B:A3:23:15:C3:75:DA:A0:3C:75:40:CD:DA:F2:06:0F:4A:8D:08:8E:A6:A0:3C:2C:D0:75:DC:D0:A0:E9:6E:5F"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xau HTTP/1.1\r\nHost: webapi.shedeadmin.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://treehope.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:32 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://treehope.cc\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nset-cookie: server_session_90e22643=debb74fda974983b1be2bf74af214405; Max-Age=864000; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":758,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T18:40:23.841109Z","times_seen":17321112,"resource_available":true,"data":null}},"time_used":256,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.shedeadmin.cyou/api/common/getMt5Amount?coin=xag","fqdn":"webapi.shedeadmin.cyou","domain":"shedeadmin.cyou","tld":"cyou"},"ip":{"addr":"45.204.13.176","port":443,"asn":132813,"as":"HK AISI CLOUD COMPUTING LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:31.952Z","timestamp":1784302651952,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.shedeadmin.cyou","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 14 Jun 2026 06:10:34 GMT","end":"Sat, 12 Sep 2026 06:10:33 GMT"},"fingerprint":{"sha1":"D8:CE:55:F7:7A:07:7F:4F:CA:88:16:39:B9:D4:14:77:5E:A0:58:0D","sha256":"5B:A3:23:15:C3:75:DA:A0:3C:75:40:CD:DA:F2:06:0F:4A:8D:08:8E:A6:A0:3C:2C:D0:75:DC:D0:A0:E9:6E:5F"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xag HTTP/1.1\r\nHost: webapi.shedeadmin.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://treehope.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:32 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://treehope.cc\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nset-cookie: server_session_90e22643=debb74fda974983b1be2bf74af214405; Max-Age=864000; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":758,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T18:40:23.841109Z","times_seen":17321112,"resource_available":true,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/assets/en-58a8e4bb.js","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:31.953Z","timestamp":1784302651953,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treehope.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 15:03:33 GMT","end":"Sat, 10 Oct 2026 15:03:32 GMT"},"fingerprint":{"sha1":"83:70:6A:56:C6:57:05:A8:E8:42:1D:9E:63:FE:13:11:B1:8C:42:42","sha256":"D4:EB:37:F6:35:73:85:42:78:9B:09:16:72:7B:58:BA:55:59:41:02:D5:B5:FC:F2:85:89:AB:73:BB:74:21:E5"}}},"request":{"raw":"GET /assets/en-58a8e4bb.js HTTP/1.1\r\nHost: treehope.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_session_90e22643=81e0f2c230122a68cb6afa3ef61999e7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:32 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 17 Jul 2026 04:21:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a59add8-a26c\"\r\nexpires: Sat, 18 Jul 2026 03:37:32 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":41580,"size_decoded":13144,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (41557)","md5":"f210e0521dd1a39a567f73c5393b14ef","sha1":"e37ce7d8f362c334614552cd06f9ae8ebb41d715","sha256":"74d95f273ffe66bc6b95677b5232e4ff6a38569e654a212aaba807d64fe7a195","sha512":"f17471be51f2561f2e00ffb67d5c1cd2ef0f710f06a9cce49418558f8107a06a1c39d443c66d3ddb587239daa219efaa73bf31e0f10ceeb2317e8d1562c91c00","ssdeep":"768:+GtZcEw/o7rKONAFsifnAMC2rAaAMxXF6+6sP4u9w1mwO6fpk7aOLFit7:iponKONebE2rdxXKsP4ewqLFip","tlshash":"7313d6897e1a889a04f35376b4ce6e5120f60ac18256881f4fedc9fd53d2b67a363734","first_seen":"2026-07-17T15:37:13.684939Z","last_seen":"2026-07-17T15:48:13.523911Z","times_seen":4,"resource_available":true,"data":null}},"time_used":308,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.shedeadmin.cyou/api/common/type/defi_activity_type","fqdn":"webapi.shedeadmin.cyou","domain":"shedeadmin.cyou","tld":"cyou"},"ip":{"addr":"45.204.13.176","port":443,"asn":132813,"as":"HK AISI CLOUD COMPUTING LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:32.302Z","timestamp":1784302652302,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.shedeadmin.cyou","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 14 Jun 2026 06:10:34 GMT","end":"Sat, 12 Sep 2026 06:10:33 GMT"},"fingerprint":{"sha1":"D8:CE:55:F7:7A:07:7F:4F:CA:88:16:39:B9:D4:14:77:5E:A0:58:0D","sha256":"5B:A3:23:15:C3:75:DA:A0:3C:75:40:CD:DA:F2:06:0F:4A:8D:08:8E:A6:A0:3C:2C:D0:75:DC:D0:A0:E9:6E:5F"}}},"request":{"raw":"OPTIONS /api/common/type/defi_activity_type HTTP/1.1\r\nHost: webapi.shedeadmin.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang,language\r\nOrigin: https://treehope.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:32 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://treehope.cc\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang, language\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nset-cookie: server_session_90e22643=debb74fda974983b1be2bf74af214405; Max-Age=864000; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":768,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T18:40:23.841109Z","times_seen":17321112,"resource_available":true,"data":null}},"time_used":262,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":262,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/charting_library/charting_library.min.js","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:28.946Z","timestamp":1784302648946,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treehope.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 15:03:33 GMT","end":"Sat, 10 Oct 2026 15:03:32 GMT"},"fingerprint":{"sha1":"83:70:6A:56:C6:57:05:A8:E8:42:1D:9E:63:FE:13:11:B1:8C:42:42","sha256":"D4:EB:37:F6:35:73:85:42:78:9B:09:16:72:7B:58:BA:55:59:41:02:D5:B5:FC:F2:85:89:AB:73:BB:74:21:E5"}}},"request":{"raw":"GET /charting_library/charting_library.min.js HTTP/1.1\r\nHost: treehope.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_session_90e22643=81e0f2c230122a68cb6afa3ef61999e7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:29 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 15 Jul 2026 20:28:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a57ed66-2a6a\"\r\nexpires: Sat, 18 Jul 2026 03:37:29 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10858,"size_decoded":3702,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10857)","md5":"8573e89d9ec535663d75f21b1f08109c","sha1":"a8d9eea0b157ceeffc38d4254e6f6abc9d697d10","sha256":"cb0c6c9f1771d252eee7caa043bdd7cfffbd52c2cc4b18b7be7c4554ed069151","sha512":"55d728fa1e0682725f94b17387c6790792d3d34b43652a00097876118575bd6cefa20916d80674519005d72f20ecbb745e9645516c056e6f9bb6691d5efbcb33","ssdeep":"192:9fdWSo7ktFUnoBelr6lw2LfnzuIQPlaJ1i10K+Ei/ISJhvHIheu5Ph3Ffam:vWS2ktFUnoIlD2LfnqIJimK+5/ISJhvu","tlshash":"6e224f58ed2478720acb54f0427f180f8239e278d84944ed3cc4e6ec59fd44a6a6fbb8","first_seen":"2023-08-16T00:37:19Z","last_seen":"2026-07-17T16:03:29.88298Z","times_seen":1303,"resource_available":true,"data":null}},"time_used":309,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/assets/index-f7f18b99.js","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:28.952Z","timestamp":1784302648952,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treehope.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 15:03:33 GMT","end":"Sat, 10 Oct 2026 15:03:32 GMT"},"fingerprint":{"sha1":"83:70:6A:56:C6:57:05:A8:E8:42:1D:9E:63:FE:13:11:B1:8C:42:42","sha256":"D4:EB:37:F6:35:73:85:42:78:9B:09:16:72:7B:58:BA:55:59:41:02:D5:B5:FC:F2:85:89:AB:73:BB:74:21:E5"}}},"request":{"raw":"GET /assets/index-f7f18b99.js HTTP/1.1\r\nHost: treehope.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_session_90e22643=81e0f2c230122a68cb6afa3ef61999e7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:29 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 17 Jul 2026 04:21:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a59add8-194fd\"\r\nexpires: Sat, 18 Jul 2026 03:37:29 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":103677,"size_decoded":28644,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65526), with no line terminators","md5":"632c2a0e4323d35de2a1a64a2204d5c0","sha1":"26096f17233c9115c74bbcf702a94ec33d371464","sha256":"03bdc7e0bf5ecf525c858281dbc7fd7a5b697c92f39517a254582e11bf1c26de","sha512":"c403370ff6fe408d864fe33c0154846366665c51a7bc7341c33ee1d5842aea35a19dbd17648b004cbe8fb100ad2c91e3874e89e97f232e1f1db4be4003d12c4b","ssdeep":"768:Dh6Amtg+wESe/Ffxx8cLulaMb3MLaJeX5MI9MHjcz8LaLUq8DGL09Z2aSFn/edzA:89x8b8dtcLaAqzO2A329jj6q8q","tlshash":"1ea33a99940b0fff68be0888a91a540021691fd75d8dccd3b7bf9e5627f9ce8624d318","first_seen":"2026-07-17T15:37:13.688267Z","last_seen":"2026-07-17T15:48:13.519476Z","times_seen":4,"resource_available":true,"data":null}},"time_used":606,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":606,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/platform/dev/config.js?1784302650662","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://treehope.cc/","date":"2026-07-17T15:37:30.665Z","timestamp":1784302650665,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treehope.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 15:03:33 GMT","end":"Sat, 10 Oct 2026 15:03:32 GMT"},"fingerprint":{"sha1":"83:70:6A:56:C6:57:05:A8:E8:42:1D:9E:63:FE:13:11:B1:8C:42:42","sha256":"D4:EB:37:F6:35:73:85:42:78:9B:09:16:72:7B:58:BA:55:59:41:02:D5:B5:FC:F2:85:89:AB:73:BB:74:21:E5"}}},"request":{"raw":"GET /platform/dev/config.js?1784302650662 HTTP/1.1\r\nHost: treehope.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_session_90e22643=81e0f2c230122a68cb6afa3ef61999e7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:30 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 382\r\nlast-modified: Wed, 15 Jul 2026 20:28:22 GMT\r\netag: \"6a57ed66-17e\"\r\nexpires: Sat, 18 Jul 2026 03:37:30 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":382,"size_decoded":901,"mime_type":"application/javascript","magic":"ASCII text","md5":"2fc55ee12818f4bd5a294b65221dbbb3","sha1":"409dfdce1d6abfdf54113d9995870bc4663a895f","sha256":"c2fb2aff1bc7340c09d6a094ef7aef9dfb1fe24489d0121bc24d35e0c96facec","sha512":"03f6cd4d80e3a2ed4304417679070a43dcc848c0abc896e48b1bce1c80fb27c473441febc4130caaa2356423c58233329f19a66c40d36a144f8599c51923b724","ssdeep":"","tlshash":"dae068b33174c0289480552b29dc242bf3c7b1728d4d4f2ee8d956196e4ddac307c492","first_seen":"2026-04-15T13:43:49.206994Z","last_seen":"2026-07-17T15:48:13.520815Z","times_seen":8,"resource_available":false,"data":null}},"time_used":485,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":485,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"treehope.cc/","fqdn":"treehope.cc","domain":"treehope.cc","tld":"cc"},"ip":{"addr":"72.244.91.137","port":443,"asn":3257,"as":"GTT Communications Inc.","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T15:37:27.732Z","timestamp":1784302647732,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"treehope.cc","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 15:03:33 GMT","end":"Sat, 10 Oct 2026 15:03:32 GMT"},"fingerprint":{"sha1":"83:70:6A:56:C6:57:05:A8:E8:42:1D:9E:63:FE:13:11:B1:8C:42:42","sha256":"D4:EB:37:F6:35:73:85:42:78:9B:09:16:72:7B:58:BA:55:59:41:02:D5:B5:FC:F2:85:89:AB:73:BB:74:21:E5"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: treehope.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 15:37:28 GMT\r\ncontent-type: text/html\r\nlast-modified: Fri, 17 Jul 2026 04:21:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a59add8-14c5\"\r\nset-cookie: server_session_90e22643=81e0f2c230122a68cb6afa3ef61999e7; Max-Age=864000; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5317,"size_decoded":2345,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1094)","md5":"29589eb64b087bbd34f08858a8f9859c","sha1":"57a85d0820399653de58d3cfd5be8989cf29fd43","sha256":"16da0672c907cd0339cbf383bd70fcedbf05e258e5d3ebe02087365106c4dba7","sha512":"0992ec9f72be16346a4b14baf1c4300db04a5cf92d16bec70da8313e9c0d56e9db228b6684dea810efbe686dae55ae042f3b4d824ff989d0b75e5c59785e328a","ssdeep":"96:AsCDDzD55yKuc67lkDDoDrD8DDeDDIt/DDIDD1r6TCZydHRH/gnDD2mUsGKAiowy:AdHdL67lO8/iwsZmHZCxfc/2nfD3bpu0","tlshash":"b6b160b358f4c82a2391117bebdbf0045a624293851a5868b4cd51ed4fe4fe5c8cbbb1","first_seen":"2026-07-17T15:37:13.687251Z","last_seen":"2026-07-17T15:48:13.531718Z","times_seen":4,"resource_available":true,"data":null}},"time_used":930,"timings":{"blocked":0,"dns":3,"connect":305,"send":0,"wait":307,"receive":0,"ssl":314},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}