{"report_id":"2e62f9bf-0e49-46b3-b17e-160f58598d66","version":0,"status":"done","tags":[],"date":"2026-08-09T03:49:48Z","url":{"schema":"http","addr":"20230911.com/","fqdn":"20230911.com","domain":"20230911.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":0,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"final":{"url":{"schema":"https","addr":"www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"title":"876qp-dl","dom":{"size":12291,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"c9b3eb4c547251060bb6d9f45530be38","sha1":"3f7fa56e2676eccbc97a8a87eb8aa75f23f0839e","sha256":"a6615b3781d63da0fd49af842c83c8e8e757827b6d9a4445e8b7228d245ad982","sha512":"a9003a79d31773cefca58d1f218bf509db9fdc5fe5d7a3fd65f58a64b0961583301794af082fa98e122815f90f3eb94ccb37d705634f188fe81bc8c96cb73e9e","ssdeep":"192:nwEI+zzCgYgdjJaJaLdzLO2l84ZektF7Zj:weK9KSOekjl","tlshash":"f042c54a44f654425492e0623fb25a0e2f51ea07d64eeb157bdc9ed89fc3ad0ec1b3c8","dom_hash":"domhash4a8349a746ad750a7d05f508d35cf862","first_seen":"2026-08-09T03:50:08.258298Z","last_seen":"2026-08-09T03:50:08.258298Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"20230911.com/","fqdn":"20230911.com","domain":"20230911.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":0,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-13T03:49:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.876daili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"os-js.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"os-js.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.google-analytiics.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.google-analytiics.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.google-analytiics.com","ip":{"addr":"172.67.133.94","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-04-10","domain_rank":0,"first_seen":"2024-05-20T10:24:10Z","last_seen":"2026-06-24T08:08:33.204066Z","alert_count":2,"request_count":1,"received_data":770,"sent_data":473,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"www.876daili.com","ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"domain_registered":"2026-05-08","domain_rank":0,"first_seen":"2026-06-24T08:08:32.522077Z","last_seen":"2026-06-24T08:08:32.522077Z","alert_count":13,"request_count":13,"received_data":2260234,"sent_data":7224,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"127.0.0.1","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":0,"sent_data":494,"comment":"","tags":null,"fingerprints":null},{"fqdn":"os-js.com","ip":{"addr":"104.21.90.19","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-01-28","domain_rank":3516067,"first_seen":"2023-01-28T07:54:28Z","last_seen":"2026-08-02T09:31:52.217494Z","alert_count":2,"request_count":1,"received_data":13285,"sent_data":464,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"20230911.com","ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"domain_registered":"2026-05-09","domain_rank":0,"first_seen":"2026-08-09T03:49:49.390711Z","last_seen":"2026-08-09T03:49:49.390711Z","alert_count":0,"request_count":1,"received_data":238,"sent_data":481,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"introduction_type":"domTimer","is_inline":false,"md5":"16708bddf1c7df93f88b22c37dda68df","sha1":"f542ae1300a83323273651c6bc72fb061ee3a2da","sha256":"61f86a56ac5eec113aaf4d440194f67d0d19b456dc69ee5a2f8080bed20bef3d","sha512":"f230529aa1198711a42bf9e5a35827ddfa8ccb75f47d050c64df6537ff8f96abe4c42eca67a981e2acb833e752415b9f995c79e491865c55af99dea29dc1e4d4","ssdeep":"","tlshash":"62e00008e0000222c88c00b8808a208880280b32e2308800a00028a2000082c0880200","size":403,"data":"","first_seen":"2026-06-24T08:08:43.929439Z","last_seen":"2026-08-09T03:50:08.293647Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"introduction_type":"domTimer","is_inline":false,"md5":"3fde24f6d8b079be9c4bab0b32bb87e7","sha1":"7387cf474230624625067637a5a4d958c0db764b","sha256":"cb45b488be1860e26ead87dc4890018c0e5444f5c27efefd6705bd201809f45e","sha512":"5f8141a7551a092b9cf7c3434ddf5fd582386b0952ea845b6ed29f53cf13822289112d9ae4eb7662c6074d08d4c9489f7aa0b95820090ab1800a25fbad4a2c20","ssdeep":"","tlshash":"02e00000c0880030c88800b88082300880000a22cbb00808a000a88000288aa0080300","size":403,"data":"","first_seen":"2026-06-24T08:08:43.928506Z","last_seen":"2026-08-09T03:50:08.29593Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"introduction_type":"scriptElement","is_inline":true,"md5":"3275d659654ac6207f43b722fdd7d573","sha1":"08bf9d94d52f7150e7621ab9a4256e45c9a150e0","sha256":"eebef96878d49a6ff0b2498a17badd1e8fa958f3a8c8d49e0a0bb23238080805","sha512":"64a8fbf06942a7d0f5978d9ad59e6743a359792fc93641a84689a8d4dac95c3f5377d7b38e00824d22f3c375637e92b0da7fee4f8878b4c0b64847b0ecad60ef","ssdeep":"","tlshash":"3fb0924a2452c2916d33b25caf8f2222a8b31512015aa869b88c71521f63476aa1998f","size":117,"data":"","first_seen":"2026-06-24T08:08:43.931183Z","last_seen":"2026-08-09T03:50:08.298605Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"introduction_type":"scriptElement","is_inline":true,"md5":"a26b2c0732eaf8bd3d0f6f8df8f886e0","sha1":"843406987367ded255a1fe44d91810b68aace1b5","sha256":"cdea471f9662e958551b5bfa6a78708fdbc91778620c0d5f3747b1378e8450a7","sha512":"1f211539ad9487f3d449eb5483e191433f3c613cd39a5ccce015aa153719c687a46445065113460a845f5c300972815029e6271b7b395055dc7ae1c429f78182","ssdeep":"","tlshash":"55f09e08e4835b47e63220365369701914d5d323380fca143e5ec9e04fcce7448ac7e9","size":608,"data":"","first_seen":"2026-06-24T08:08:43.932089Z","last_seen":"2026-08-09T03:50:08.301527Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"introduction_type":"scriptElement","is_inline":true,"md5":"6403cbc1e4d851b9f1a4b11f36740415","sha1":"0cae47008d745855c8cd67db85ba082876c6041e","sha256":"b825e18e481f908895e266cbdfa45f0830915583c74e3814dd0b53e24717ea78","sha512":"d064c64cabe4c64edf25b801a131ad869870cfa3986331bdfa5cd498c25a51f0386bb39b7eef10b73c804b547d61c005b4eaac7997e3ad39c97008db459cdc1c","ssdeep":"","tlshash":"dbe0cd0d35e900d0e9ab7072859f540d6430243f054b8a047d0c9eeddfa98bdc2c1f38","size":350,"data":"","first_seen":"2026-06-24T08:08:43.932974Z","last_seen":"2026-08-09T03:50:08.304038Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"introduction_type":"domTimer","is_inline":false,"md5":"f771a4c7b99c0d5e59a14af6fe8fca0f","sha1":"2f56d6c615d1d3ae5a803b4308b6b09419679fad","sha256":"4f7e1f751a47674a1d9bb6139160b072125f924ce85dab1915ae793f5ede8970","sha512":"53743fe3fe206d48c6381cb3a2c6e4e373696883c6a442c5c96cfc5ee41693a19813688cee95e30cc2202d1349dcda771f291f0f652145137f566a4631ef3513","ssdeep":"","tlshash":"56900002c08000000020003000a0200208088280c8a2a02088000c000080a00a23820b","size":47,"data":"","first_seen":"2025-10-22T13:32:35.549948Z","last_seen":"2026-08-09T03:50:08.305004Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"introduction_type":"eventHandler","is_inline":false,"md5":"de12331e08abb730d720e76ba412a325","sha1":"8ee2ce64d1f71544b033c59aca98141409d8a5d3","sha256":"fddc80473c6a145965528212405fec4c5d84bfbe22c1a3da71d553207e404ea4","sha512":"7604761f8e37680a61589dab085c94f5bb0696909fe5815c9a50bda28e42ebd873dea9a0ed48d4d701ee4f23696c1c6bf23bf0ecc6801ea05ac2d92ec122a89f","ssdeep":"","tlshash":"04b0124e7d3491a8c29542b76573a7259247235458a382404cd5c45ca181de2414d0a1","size":104,"data":"","first_seen":"2025-03-07T04:04:43.587436Z","last_seen":"2026-08-09T03:50:08.307271Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"introduction_type":"eval","is_inline":false,"md5":"7bc4b862c99e544b33ed97a02b0928ea","sha1":"9b68fd3af39e1677046248e3ad2e7deaac7edaee","sha256":"66a792b397e39559f2e1f44e94b176f49f7be6640019acbef36512a74db8d91f","sha512":"357ade30dccfe378dcaafe58d3c157ae480987a145f82bffe754dcd2bb7329e3b59b1a8ad8ff3208382a3eb04f1dc4d4a966533e577a27e8257e61143fafbe67","ssdeep":"96:JXj9xqRS5PAABv0ZgpzNEXWLdbFE6Szwexlo9k+LDRkTkYzIS4RYKz8p8NF/LJ2x:NBxsS1cupzNEXWh1SsezDgYzn4RYKQpl","tlshash":"91c1181831826879c5ca9236484f524ab836705a658cd080e53adca0bfbce4b8137f36","size":5858,"data":"","first_seen":"2026-05-26T21:39:35.636321Z","last_seen":"2026-08-09T03:50:08.309219Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/static/js/jquery.js","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"introduction_type":"scriptElement","is_inline":false,"md5":"a1bef64d8a355362d49bb0eaa0e83a7e","sha1":"9b1e9e4cec67e9b2af45029102a9949134b085b1","sha256":"ce1f6ab09e4a618428bcef97698081e7e4f3a023334edf2fd81f2f41cdaff0b3","sha512":"ddf133065b1c19ee01b2abc25b4354398e2d276e8d6a017e8db103403b45546f9561329e042e38f8fd48670cb07254c220d4deb313071d1b66de3cdbf906c754","ssdeep":"1536:lYRKUfAjtledhTmtaFyQHGvCXseUOgRc9izzr4yff8teLvHHEjam7WuX3yzSiLny:cUb6GvCD0932o2skAieBIaw","tlshash":"a6a3f8d9b2d67163c3b731a850af510bb17698aa784c8c50f068d8e4be74e88507bf7d","size":97883,"data":"","first_seen":"2025-10-22T13:32:35.513767Z","last_seen":"2026-08-09T03:50:08.279924Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"introduction_type":"eventHandler","is_inline":false,"md5":"f6da7f8bf43113902a876ee1722a8a4b","sha1":"f59e47e05868ddf862801850a0f8e04d3af76529","sha256":"59a3c6ce78d52b38b39d7ebac069162470b45c544714d9a1f27d9ce608e0968e","sha512":"319b5925516af982cfd8a26930b4d809b1a7aff34bcce74fc66c2580199ce20c50233da664f25175c1c0d97b81a5bd1fcf5c2b7c69ffd8f07726ce11aee4773e","ssdeep":"","tlshash":"df600000c0c0000000300000000030030c0000000cc3f030c0000c0000c0f00c33c30f","size":12,"data":"","first_seen":"2025-09-08T13:31:47.335318Z","last_seen":"2026-08-09T03:50:08.311503Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"os-js.com/layer.js","fqdn":"os-js.com","domain":"os-js.com","tld":"com"},"ip":{"addr":"104.21.90.19","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"45db933ea2028b72adf9993ddcac958f","sha1":"c62c7bf9645f5a1d82a66cf477ec2f14d92bf56d","sha256":"c4b2f8ef832643cd6bb7d80d574800d1603ba5623392607afb6df911b88a3572","sha512":"dbf4798b96ea06b35a6b4249292435dde48bdb968fb614486168b3c04e84eb436706736e0d0122068639b17f1390072cc72a5a9b0cf518149b65fd06176aa73b","ssdeep":"192:elmpoTE0z/XV+aGBEp2/XujdVkEKrNgpy35p4rmvz3n5/5y35p4rp:5qI0z/luBEpGkKpgpyHDv1/5yHC","tlshash":"4942b698245625331d663a9f185f4d0877ba2761f849681af24f64c0ffd0f6a831feac","size":12380,"data":"","first_seen":"2026-06-24T08:08:43.919077Z","last_seen":"2026-08-09T03:50:08.28266Z","times_seen":129,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/os2.js","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"introduction_type":"scriptElement","is_inline":false,"md5":"1ac49ae85e9c9df72942ebe931ff3550","sha1":"52d508a874076a08fc899d6d6d5cd1bd299a2672","sha256":"a65a521e36fda92b9a0cea8839a9d9fc37c491c41e9874270cad6348f5d8484a","sha512":"af57c051208d38d0b1888f005a2c7ab1ec5bc39a4b9c0d1e8bfca9c8f5d131580fa0bedcbfcc9c85c73cddfbafcb0712cb1af4b3f49f0f6133577dd6b1e094c1","ssdeep":"1536:zab7c4ArjofL5+SuTbREYIk61nJXVxWRj:+erUfr5gDj","tlshash":"ec53f85a72c2b13a9357b0719c8f4845f73dad29624d88898a1dd5e4b8b482cc37edfc","size":65164,"data":"","first_seen":"2026-05-26T21:39:35.587842Z","last_seen":"2026-08-09T03:50:08.290442Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"introduction_type":"eval","is_inline":false,"md5":"cbefecb633df81c007b7dba5c3179fd7","sha1":"e692f9b3c5b2dcefed00bc07e44db6c2acda4126","sha256":"59ffb7cec0e28fa1ce5c650eb9609fc9d8e5ed9fd791eaa67822ba0b82416d1b","sha512":"97c61c9b9dc7691fc10ad3c26f356a19548bb3290736eb03c9500cbd2503c70dc11c03678a166ffa902a8c1e0f9b4d9c3a2832e04b1c9116773ba654205b0501","ssdeep":"","tlshash":"7051a7613235a9fe05cf04436a2eafed39af06023581c868d456d5d8b0bce7747af5ca","size":2747,"data":"","first_seen":"2025-03-07T04:04:43.592455Z","last_seen":"2026-08-09T03:50:08.313169Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"www.876daili.com","filename":"https://www.876daili.com/?proxyAccount=27838919","line_number":64,"column_number":12}]},"http":[{"url":{"schema":"https","addr":"www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-09T03:49:21.037Z","timestamp":1786247361037,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"876daili.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 15:24:08 GMT","end":"Sat, 31 Oct 2026 15:24:07 GMT"},"fingerprint":{"sha1":"C9:18:70:62:44:9F:1D:E7:D5:9F:1B:19:80:F5:25:5A:52:2F:86:32","sha256":"95:86:2D:D9:D8:FA:1E:36:B6:B9:DB:FD:41:0C:83:E8:E5:B5:3F:ED:11:48:56:12:33:31:43:95:25:10:EF:A1"}}},"request":{"raw":"GET /index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919 HTTP/1.1\r\nHost: www.876daili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.876daili.com/?proxyAccount=27838919\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-encoding: gzip\r\ncontent-type: text/html\r\ndate: Sun, 09 Aug 2026 03:49:21 GMT\r\netag: W/\"69ff4bcf-2f2e\"\r\nlast-modified: Sat, 09 May 2026 14:59:27 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: UPDATING\r\ncontent-length: 2724\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":12078,"size_decoded":2995,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"04164a1831bffde4b0ca1146cb85ad57","sha1":"125af3fe6469254b5d3a7359148ffd009a2400e9","sha256":"abc469effcf1490d2405fc7d754624db45f686ec5a70d57248ad3c853ccae80b","sha512":"e2096a7dbaec3938c5ecfa015600693c2e52088147e9d099861cb2c6e57aaee929956f9a75dfe67c79faac99d6127c6fa6d16cc99038ae0564c98a31db410b9e","ssdeep":"96:VO7m+AxozVt2gYgdjJB3MJaLdQQO2J6h0/8C7gctk7o:6QozCgYgdjJaJaLdQQO2J6M84Ztk7o","tlshash":"9042a34a44f644426496e0623fb25a1e2f11ea07d64eeb157bdc5edc8fc3ac0dc5b388","first_seen":"2026-06-24T08:08:43.924735Z","last_seen":"2026-08-09T03:50:08.26158Z","times_seen":5,"resource_available":true,"data":null}},"time_used":258,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":257,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.876daili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/static/css/reset.css","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","date":"2026-08-09T03:49:21.325Z","timestamp":1786247361325,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"876daili.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 15:24:08 GMT","end":"Sat, 31 Oct 2026 15:24:07 GMT"},"fingerprint":{"sha1":"C9:18:70:62:44:9F:1D:E7:D5:9F:1B:19:80:F5:25:5A:52:2F:86:32","sha256":"95:86:2D:D9:D8:FA:1E:36:B6:B9:DB:FD:41:0C:83:E8:E5:B5:3F:ED:11:48:56:12:33:31:43:95:25:10:EF:A1"}}},"request":{"raw":"GET /static/css/reset.css HTTP/1.1\r\nHost: www.876daili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\ncontent-type: text/css\r\ndate: Sun, 09 Aug 2026 02:24:28 GMT\r\netag: W/\"5e05f1ce-6b0\"\r\nexpires: Sun, 09 Aug 2026 14:24:28 GMT\r\nlast-modified: Sun, 09 Aug 2026 02:24:28 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\ncontent-length: 770\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1712,"size_decoded":1117,"mime_type":"text/css","magic":"troff or preprocessor input, ASCII text, with very long lines (1499), with CRLF line terminators","md5":"b53440d7d25efe80f7b48db5fd89ac14","sha1":"5a352413a584f296feb6819f3c337d918cca4bcb","sha256":"9d1ed91c7c3ecc411b977df79f7272e4102957a0ecc319d0f60d35ca9f967611","sha512":"0cbada6c3619930e04392c7152f9bb4d9328201f3571e3c351a0d8edede4e1c60c7add6ac0ac61f32a5642bd9c8ea0d56d37948d477342ea6ee4da77f35f4c65","ssdeep":"","tlshash":"7d312122c338eca7b57bc8aa3115fe5d3a9c9292580bcb74fa327815cc550673712b6c","first_seen":"2025-09-08T13:31:47.321782Z","last_seen":"2026-08-09T03:50:08.264572Z","times_seen":15,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.876daili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/static/css/index.css","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","date":"2026-08-09T03:49:21.661Z","timestamp":1786247361661,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"876daili.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 15:24:08 GMT","end":"Sat, 31 Oct 2026 15:24:07 GMT"},"fingerprint":{"sha1":"C9:18:70:62:44:9F:1D:E7:D5:9F:1B:19:80:F5:25:5A:52:2F:86:32","sha256":"95:86:2D:D9:D8:FA:1E:36:B6:B9:DB:FD:41:0C:83:E8:E5:B5:3F:ED:11:48:56:12:33:31:43:95:25:10:EF:A1"}}},"request":{"raw":"GET /static/css/index.css HTTP/1.1\r\nHost: www.876daili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: max-age=43200\r\ncontent-type: text/css\r\ndate: Sun, 09 Aug 2026 02:24:28 GMT\r\netag: \"5e058de4-0\"\r\nexpires: Sun, 09 Aug 2026 14:24:28 GMT\r\nlast-modified: Sun, 09 Aug 2026 02:24:28 GMT\r\nserver: nginx\r\nx-cache: HIT, policy, disk\r\ncontent-length: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":316,"mime_type":"text/css","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T05:49:09.859766Z","times_seen":17794170,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.876daili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/static/picture/kf.png","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","date":"2026-08-09T03:49:21.687Z","timestamp":1786247361687,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"876daili.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 15:24:08 GMT","end":"Sat, 31 Oct 2026 15:24:07 GMT"},"fingerprint":{"sha1":"C9:18:70:62:44:9F:1D:E7:D5:9F:1B:19:80:F5:25:5A:52:2F:86:32","sha256":"95:86:2D:D9:D8:FA:1E:36:B6:B9:DB:FD:41:0C:83:E8:E5:B5:3F:ED:11:48:56:12:33:31:43:95:25:10:EF:A1"}}},"request":{"raw":"GET /static/picture/kf.png HTTP/1.1\r\nHost: www.876daili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncontent-type: image/png\r\ndate: Sun, 09 Aug 2026 03:21:17 GMT\r\netag: \"5e04a68a-9290\"\r\nexpires: Tue, 08 Sep 2026 03:21:17 GMT\r\nlast-modified: Sun, 09 Aug 2026 03:21:17 GMT\r\nserver: nginx\r\nx-cache: HIT, policy, disk\r\ncontent-length: 37520\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37520,"size_decoded":37846,"mime_type":"image/png","magic":"PNG image data, 141 x 151, 8-bit/color RGBA, non-interlaced","md5":"2eddb700d875b18568cc1ba417813089","sha1":"668aea33690c0e0b6c4c146b5fa645cd7c160fab","sha256":"a40a1efaf74dfbd26f6131968684abd9b2635e15363e55629a6f569011336a3a","sha512":"b40d526532507047f54f1433836379ee2718f25e7f48702c3ec63e89da6cf44ea4a9ee0bab76a403ff49ee7740e78569a8f27d84fa1fd2be7b42689696f73b3a","ssdeep":"768:RQVBsFg0Ntjv1iZ+x0Gu7geYaDBWkZIrlIOCTkIOk:4+g6TAiEgeYaDrZkOJt7","tlshash":"8bf2f1af88f4d6d2901da68b33844d22a6a5afd5508a9f75fdecd279348b0900c364f7","first_seen":"2025-10-22T13:32:35.540501Z","last_seen":"2026-08-09T03:50:08.268074Z","times_seen":8,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.876daili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/static/picture/btn.png","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","date":"2026-08-09T03:49:21.690Z","timestamp":1786247361690,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"876daili.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 15:24:08 GMT","end":"Sat, 31 Oct 2026 15:24:07 GMT"},"fingerprint":{"sha1":"C9:18:70:62:44:9F:1D:E7:D5:9F:1B:19:80:F5:25:5A:52:2F:86:32","sha256":"95:86:2D:D9:D8:FA:1E:36:B6:B9:DB:FD:41:0C:83:E8:E5:B5:3F:ED:11:48:56:12:33:31:43:95:25:10:EF:A1"}}},"request":{"raw":"GET /static/picture/btn.png HTTP/1.1\r\nHost: www.876daili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncontent-type: image/png\r\ndate: Sun, 09 Aug 2026 03:21:17 GMT\r\netag: \"5e04a688-50be\"\r\nexpires: Tue, 08 Sep 2026 03:21:17 GMT\r\nlast-modified: Sun, 09 Aug 2026 03:21:18 GMT\r\nserver: nginx\r\nx-cache: HIT, policy, disk\r\ncontent-length: 20670\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20670,"size_decoded":20996,"mime_type":"image/png","magic":"PNG image data, 357 x 103, 8-bit/color RGBA, non-interlaced","md5":"f84f3721a937c2762d3b9b11b1d9b20c","sha1":"16bdc633730d34142068afa59f5aa1d3a2f38ea3","sha256":"40fe2dd69d4fd579f180942a550807762a4241686aa92bb8e03bf14002d5a3f7","sha512":"c22d21904ba4002319694c5f6df079e0a745319806967ecc76469a71432605e34506b03ebee9cbc0201ae6f1c3a5ce98a6537d2e2ab7bb493a78a22c965e007a","ssdeep":"384:4MYOYm4sH0ukgGiVeDwLrjpqMRfX6QgvJUmd8vNI:KOYmlH07hiTZRRGPd8vK","tlshash":"8b92d068af54318b70a7518db0aa183ed3d9105955c57cf024dfc0df0c72ee869aedea","first_seen":"2025-09-08T13:31:47.319741Z","last_seen":"2026-08-09T03:50:08.271145Z","times_seen":13,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.876daili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/static/image/bg.jpg","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","date":"2026-08-09T03:49:21.760Z","timestamp":1786247361760,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"876daili.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 15:24:08 GMT","end":"Sat, 31 Oct 2026 15:24:07 GMT"},"fingerprint":{"sha1":"C9:18:70:62:44:9F:1D:E7:D5:9F:1B:19:80:F5:25:5A:52:2F:86:32","sha256":"95:86:2D:D9:D8:FA:1E:36:B6:B9:DB:FD:41:0C:83:E8:E5:B5:3F:ED:11:48:56:12:33:31:43:95:25:10:EF:A1"}}},"request":{"raw":"GET /static/image/bg.jpg HTTP/1.1\r\nHost: www.876daili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.876daili.com/static/css/global.css\r\nCookie: tool=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncontent-type: image/jpeg\r\ndate: Sun, 09 Aug 2026 03:21:18 GMT\r\netag: \"69ff2ff4-cb2f6\"\r\nexpires: Tue, 08 Sep 2026 03:21:18 GMT\r\nlast-modified: Sun, 09 Aug 2026 03:21:20 GMT\r\nserver: nginx\r\nx-cache: HIT, policy, disk\r\ncontent-length: 832246\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":832246,"size_decoded":832575,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 640x2339, components 3","md5":"2a6df9a76fbc9ca3bb7d06c01320a5cc","sha1":"0714ce32256d6997d5034a7ca7bd0cd1bd4ef58f","sha256":"110f77dc92652a94c46522bf61a7785bfdde70bcde5df668fa16ad53760bbe82","sha512":"34351ded4c1eed7c843988f82fe2f3dbe85bafb24c6cafe11305ee71945a9610096a0a5eb5a4066ef608d8e5dcea4ac01e4d3037d16ac64f2659701873e76912","ssdeep":"12288:xkyMN9lj5KJOT/q2V64Yem3FNUiv2ZZV4dbqjOFrlx8+e4wDmS/R4omkH1B6JMsh:xvib5KY7qFskmOx8+Ph141BMMVcCvyh","tlshash":"e005f0722feaa7d90b090a712919d8d4dbc64d2a5f9ab64730d1ce027fc5d7fba44e00","first_seen":"2026-06-24T08:08:43.926692Z","last_seen":"2026-08-09T03:50:08.274131Z","times_seen":5,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":20,"receive":55,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.876daili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"127.0.0.1:33899/","fqdn":"127.0.0.1","domain":"127.0.0.1","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","date":"2026-08-09T03:49:22.468Z","timestamp":1786247362468,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 127.0.0.1:33899\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T05:49:09.859766Z","times_seen":17794170,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/?proxyAccount=27838919","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-09T03:49:19.953Z","timestamp":1786247359953,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /?proxyAccount=27838919 HTTP/1.1\r\nHost: www.876daili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://20230911.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T05:49:09.859766Z","times_seen":17794170,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.876daili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/static/css/global.css","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","date":"2026-08-09T03:49:21.326Z","timestamp":1786247361326,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"876daili.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 15:24:08 GMT","end":"Sat, 31 Oct 2026 15:24:07 GMT"},"fingerprint":{"sha1":"C9:18:70:62:44:9F:1D:E7:D5:9F:1B:19:80:F5:25:5A:52:2F:86:32","sha256":"95:86:2D:D9:D8:FA:1E:36:B6:B9:DB:FD:41:0C:83:E8:E5:B5:3F:ED:11:48:56:12:33:31:43:95:25:10:EF:A1"}}},"request":{"raw":"GET /static/css/global.css HTTP/1.1\r\nHost: www.876daili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: max-age=43200\r\ncontent-type: text/css\r\ndate: Sun, 09 Aug 2026 02:24:28 GMT\r\netag: \"6332e619-22d\"\r\nexpires: Sun, 09 Aug 2026 14:24:28 GMT\r\nlast-modified: Sun, 09 Aug 2026 02:24:28 GMT\r\nserver: nginx\r\nx-cache: HIT, policy, disk\r\ncontent-length: 557\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":557,"size_decoded":877,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"e7f3a1f9fa16b3bce86976b5a0576af3","sha1":"ac29c8553dd843c65e281463e02b9312948764af","sha256":"9d9dac1d7655827e2a5cbbec105b7436104e1219d55540b5d7e1a75439041bb6","sha512":"5fa8dc933389c9ebadaab2eb67949af72f3341260ff4250191489da5085ebc5fe58fab7b6763d2176025561f7d2be7dc7127eb9642e49403021c2ef85373266d","ssdeep":"","tlshash":"67f08ba8b565758ce2125934eff41bb61c3814833e4f05c7c928eb90e54e009b9b30c5","first_seen":"2025-10-22T13:32:35.529289Z","last_seen":"2026-08-09T03:50:08.277113Z","times_seen":7,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.876daili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/static/js/jquery.js","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","date":"2026-08-09T03:49:21.328Z","timestamp":1786247361328,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"876daili.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 15:24:08 GMT","end":"Sat, 31 Oct 2026 15:24:07 GMT"},"fingerprint":{"sha1":"C9:18:70:62:44:9F:1D:E7:D5:9F:1B:19:80:F5:25:5A:52:2F:86:32","sha256":"95:86:2D:D9:D8:FA:1E:36:B6:B9:DB:FD:41:0C:83:E8:E5:B5:3F:ED:11:48:56:12:33:31:43:95:25:10:EF:A1"}}},"request":{"raw":"GET /static/js/jquery.js HTTP/1.1\r\nHost: www.876daili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sun, 09 Aug 2026 03:48:08 GMT\r\netag: W/\"5487a73c-17e5b\"\r\nexpires: Sun, 09 Aug 2026 15:48:08 GMT\r\nlast-modified: Sun, 09 Aug 2026 03:48:08 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":97883,"size_decoded":40017,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (32769), with CRLF line terminators","md5":"a1bef64d8a355362d49bb0eaa0e83a7e","sha1":"9b1e9e4cec67e9b2af45029102a9949134b085b1","sha256":"ce1f6ab09e4a618428bcef97698081e7e4f3a023334edf2fd81f2f41cdaff0b3","sha512":"ddf133065b1c19ee01b2abc25b4354398e2d276e8d6a017e8db103403b45546f9561329e042e38f8fd48670cb07254c220d4deb313071d1b66de3cdbf906c754","ssdeep":"1536:lYRKUfAjtledhTmtaFyQHGvCXseUOgRc9izzr4yff8teLvHHEjam7WuX3yzSiLny:cUb6GvCD0932o2skAieBIaw","tlshash":"a6a3f8d9b2d67163c3b731a850af510bb17698aa784c8c50f068d8e4be74e88507bf7d","first_seen":"2025-10-22T13:32:35.513767Z","last_seen":"2026-08-09T03:50:08.279924Z","times_seen":7,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.876daili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"os-js.com/layer.js","fqdn":"os-js.com","domain":"os-js.com","tld":"com"},"ip":{"addr":"104.21.90.19","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","date":"2026-08-09T03:49:21.663Z","timestamp":1786247361663,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"os-js.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Jun 2026 03:16:15 GMT","end":"Sat, 19 Sep 2026 04:14:47 GMT"},"fingerprint":{"sha1":"F4:A1:D9:14:60:3F:AC:49:05:55:55:54:7C:D6:65:15:EB:2A:95:2F","sha256":"EB:84:D3:67:DE:E8:9C:14:53:FC:53:10:A0:EF:CA:9E:0B:24:95:3D:C3:0F:69:75:8C:FC:6E:EF:11:AC:E7:9D"}}},"request":{"raw":"GET /layer.js HTTP/1.1\r\nHost: os-js.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.876daili.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 09 Aug 2026 03:49:22 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 24 Jun 2026 02:40:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a3b43a3-305c\"\r\nexpires: Sun, 09 Aug 2026 15:49:22 GMT\r\ncache-control: max-age=43200\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Bqoe3P8KZN8qWEOxyjafNXW61pybthUdSN2ZK1wVXKU1IJOnLXrZNXojoiu75TFsYdjovD5BdcUlTTGBe4IfLeyOTErUH63UJVHsk5g86LisIjcMkiHNBkGUq3w%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a283ca5ad8f156aa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12380,"size_decoded":4693,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1708)","md5":"45db933ea2028b72adf9993ddcac958f","sha1":"c62c7bf9645f5a1d82a66cf477ec2f14d92bf56d","sha256":"c4b2f8ef832643cd6bb7d80d574800d1603ba5623392607afb6df911b88a3572","sha512":"dbf4798b96ea06b35a6b4249292435dde48bdb968fb614486168b3c04e84eb436706736e0d0122068639b17f1390072cc72a5a9b0cf518149b65fd06176aa73b","ssdeep":"192:elmpoTE0z/XV+aGBEp2/XujdVkEKrNgpy35p4rmvz3n5/5y35p4rp:5qI0z/luBEpGkKpgpyHDv1/5yHC","tlshash":"4942b698245625331d663a9f185f4d0877ba2761f849681af24f64c0ffd0f6a831feac","first_seen":"2026-06-24T08:08:43.919077Z","last_seen":"2026-08-09T03:50:08.28266Z","times_seen":129,"resource_available":true,"data":null}},"time_used":782,"timings":{"blocked":-1,"dns":15,"connect":51,"send":0,"wait":710,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"os-js.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"os-js.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/static/picture/foot.png","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","date":"2026-08-09T03:49:21.693Z","timestamp":1786247361693,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"876daili.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 15:24:08 GMT","end":"Sat, 31 Oct 2026 15:24:07 GMT"},"fingerprint":{"sha1":"C9:18:70:62:44:9F:1D:E7:D5:9F:1B:19:80:F5:25:5A:52:2F:86:32","sha256":"95:86:2D:D9:D8:FA:1E:36:B6:B9:DB:FD:41:0C:83:E8:E5:B5:3F:ED:11:48:56:12:33:31:43:95:25:10:EF:A1"}}},"request":{"raw":"GET /static/picture/foot.png HTTP/1.1\r\nHost: www.876daili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncontent-type: image/png\r\ndate: Sun, 09 Aug 2026 03:21:17 GMT\r\netag: \"69ff2fdc-f78f\"\r\nexpires: Tue, 08 Sep 2026 03:21:17 GMT\r\nlast-modified: Sun, 09 Aug 2026 03:21:18 GMT\r\nserver: nginx\r\nx-cache: HIT, policy, disk\r\ncontent-length: 63375\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":63375,"size_decoded":63701,"mime_type":"image/png","magic":"PNG image data, 640 x 120, 8-bit/color RGB, non-interlaced","md5":"b7f292e12b64c85f648ff05b42810c7a","sha1":"fb9db36ddb7555f30507bde2070c7a16671b1e95","sha256":"c1bfa661da111818a0c54db2df918e18dc89fd890faf03c7292a298469057ab5","sha512":"5eca80c8cbb75ce84437c4ecfbbec79fb45fb409bbf86d4a1457adad88b1a8ccd2ba1081383954a6d2a07d1a5499049d84c8c356f77aefc1416d2f5e8830a491","ssdeep":"1536:ajswf4UR1K9FMeJ/1LR/8nmfBVN/EUkX3N+r65aeo16DfBTpa:/qR0zMeJdLR/8mfBf/E7XI65aem6Vs","tlshash":"3e5302582d3247f54cb97461f46d00829cf88ba838a365d870dfe4044ad76be0bf6746","first_seen":"2026-06-24T08:08:43.921676Z","last_seen":"2026-08-09T03:50:08.283751Z","times_seen":5,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.876daili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/favicon.ico","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","date":"2026-08-09T03:49:22.622Z","timestamp":1786247362622,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"876daili.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 15:24:08 GMT","end":"Sat, 31 Oct 2026 15:24:07 GMT"},"fingerprint":{"sha1":"C9:18:70:62:44:9F:1D:E7:D5:9F:1B:19:80:F5:25:5A:52:2F:86:32","sha256":"95:86:2D:D9:D8:FA:1E:36:B6:B9:DB:FD:41:0C:83:E8:E5:B5:3F:ED:11:48:56:12:33:31:43:95:25:10:EF:A1"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.876daili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919\r\nCookie: tool=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncontent-type: text/html\r\ndate: Sun, 09 Aug 2026 03:49:22 GMT\r\nserver: nginx\r\nx-cache: BYPASS, Status: 404\r\ncontent-length: 146\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":309,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-08-09T05:49:17.779304Z","times_seen":547606,"resource_available":true,"data":null}},"time_used":253,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":253,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.876daili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"20230911.com/","fqdn":"20230911.com","domain":"20230911.com","tld":"com"},"ip":{"addr":"91.92.243.106","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-09T03:49:18.802Z","timestamp":1786247358802,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"20230911.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 05:14:56 GMT","end":"Wed, 07 Oct 2026 05:14:55 GMT"},"fingerprint":{"sha1":"68:49:9E:00:23:D2:13:5F:32:D3:DE:08:31:CB:8D:8F:F5:2D:BC:E9","sha256":"F7:2C:AC:D6:D9:44:86:23:65:F9:42:96:5B:66:87:52:E4:E8:B4:2E:DC:37:4D:58:D2:C5:FD:81:E8:8F:CA:51"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 20230911.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 09 Aug 2026 03:49:19 GMT\r\ncontent-type: text/html\r\nlast-modified: Sun, 10 May 2026 13:35:14 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a008992-39b3\"\r\ncontent-encoding: gzip\r\nserver: ngx_openresty\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T05:49:09.859766Z","times_seen":17794170,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/video.mp4","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","date":"2026-08-09T03:49:22.565Z","timestamp":1786247362565,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"876daili.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 15:24:08 GMT","end":"Sat, 31 Oct 2026 15:24:07 GMT"},"fingerprint":{"sha1":"C9:18:70:62:44:9F:1D:E7:D5:9F:1B:19:80:F5:25:5A:52:2F:86:32","sha256":"95:86:2D:D9:D8:FA:1E:36:B6:B9:DB:FD:41:0C:83:E8:E5:B5:3F:ED:11:48:56:12:33:31:43:95:25:10:EF:A1"}}},"request":{"raw":"GET /video.mp4 HTTP/1.1\r\nHost: www.876daili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919\r\nCookie: tool=1\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 \r\ncontent-range: bytes 0-1125199/1125200\r\ncontent-type: video/mp4\r\ndate: Sun, 09 Aug 2026 02:09:07 GMT\r\netag: \"69ff3197-112b50\"\r\nlast-modified: Sat, 09 May 2026 13:07:35 GMT\r\nserver: nginx\r\nx-cache: HIT, policy, disk\r\ncontent-length: 1125200\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1125200,"size_decoded":1125476,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"f2b897d535a801f545916fce7902cf83","sha1":"13ff27818bf87356ac677d6630e9fac74ec7b3ad","sha256":"df3db2e917c8ab1ad90634d99aff52e4f9829730a33df845bb86fb3dc8f0cd5d","sha512":"019187f63246fd0d3254e16b5ea95cb2f6626f140239fdd2549aebf59551b2d15ea6930e31e226dfcaef944d167ba3216abbc6e0b2b6286ac8f4209abfa8d8d0","ssdeep":"24576:SebKjROb6dcqNSEpl490PvmrDzxv0DlKr4rdRqPEv:S8K1Q6dcL6lvCv0xKr4rG8","tlshash":"cd2523269ece922dccbc96728d0a233b5935ed10c12253e39d06b2b37976778ad4f135","first_seen":"2026-06-24T08:08:43.91621Z","last_seen":"2026-08-09T03:50:08.28741Z","times_seen":5,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.876daili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.876daili.com/os2.js","fqdn":"www.876daili.com","domain":"876daili.com","tld":"com"},"ip":{"addr":"109.110.170.82","port":443,"asn":0,"as":"","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","date":"2026-08-09T03:49:21.666Z","timestamp":1786247361666,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"876daili.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 02 Aug 2026 15:24:08 GMT","end":"Sat, 31 Oct 2026 15:24:07 GMT"},"fingerprint":{"sha1":"C9:18:70:62:44:9F:1D:E7:D5:9F:1B:19:80:F5:25:5A:52:2F:86:32","sha256":"95:86:2D:D9:D8:FA:1E:36:B6:B9:DB:FD:41:0C:83:E8:E5:B5:3F:ED:11:48:56:12:33:31:43:95:25:10:EF:A1"}}},"request":{"raw":"GET /os2.js HTTP/1.1\r\nHost: www.876daili.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sun, 09 Aug 2026 03:48:08 GMT\r\netag: W/\"6a07f552-fe8c\"\r\nexpires: Sun, 09 Aug 2026 15:48:08 GMT\r\nlast-modified: Sun, 09 Aug 2026 03:48:08 GMT\r\nserver: nginx\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65164,"size_decoded":26718,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (44736)","md5":"1ac49ae85e9c9df72942ebe931ff3550","sha1":"52d508a874076a08fc899d6d6d5cd1bd299a2672","sha256":"a65a521e36fda92b9a0cea8839a9d9fc37c491c41e9874270cad6348f5d8484a","sha512":"af57c051208d38d0b1888f005a2c7ab1ec5bc39a4b9c0d1e8bfca9c8f5d131580fa0bedcbfcc9c85c73cddfbafcb0712cb1af4b3f49f0f6133577dd6b1e094c1","ssdeep":"1536:zab7c4ArjofL5+SuTbREYIk61nJXVxWRj:+erUfr5gDj","tlshash":"ec53f85a72c2b13a9357b0719c8f4845f73dad29624d88898a1dd5e4b8b482cc37edfc","first_seen":"2026-05-26T21:39:35.587842Z","last_seen":"2026-08-09T03:50:08.290442Z","times_seen":17,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.876daili.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.google-analytiics.com/?id=G-G1B5M2A1V4","fqdn":"www.google-analytiics.com","domain":"google-analytiics.com","tld":"com"},"ip":{"addr":"172.67.133.94","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.876daili.com/index2.html?shareName=www.876daili.com\u0026proxyAccount=27838919","date":"2026-08-09T03:49:21.783Z","timestamp":1786247361783,"http_version":"HTTP/3","security_state":"","security_info":null,"request":{"raw":"GET /?id=G-G1B5M2A1V4 HTTP/1.1\r\nHost: www.google-analytiics.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.876daili.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 403 \r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\ndate: Sun, 09 Aug 2026 03:49:21 GMT\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qSB2a1fZX0Btzuz3bDcWGEyBWMc6wNFHq9R7sdhhySvcepbmJqMIPqjxYK%2BvUgcPXsUDC1isGj3jQncTVSYW36LyM%2BNgle6ub1HF6fTQZvHydVgJLOacSZeix08AkERj9A2TwpTejjHNntj7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncf-ray: a283ca5b7decb28a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T05:49:09.859766Z","times_seen":17794170,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.google-analytiics.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"www.google-analytiics.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}