{"report_id":"2f6ccbc4-a2b6-4df6-aeb0-5c9ff556bdb0","version":6,"status":"done","tags":[],"date":"2026-02-02T15:25:11Z","url":{"schema":"http","addr":"kk-1.sgrew.club","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":0,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"kk-1.sgrew.club/#/pages/login/index","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"title":"kk-1.sgrew.club/#/","dom":{"size":140272,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (40058)","md5":"49ac5c02cc30aabea77827dda21f1d29","sha1":"abcc286abdd07c20a4571f2b3ee9d2680717f6be","sha256":"e768f548bf1c37b3e5f337321e447eeec273ca37b307f2359d5205b071452afe","sha512":"c313a39805197ed0b5749647595624833e59fee3d4aba14a0ee3dc0af4813151e6e90a5e5fedd8866b5bda75d42eb41f56372e7ac455e2642b520ba0a9956120","ssdeep":"3072:vKsp0NVr7fnaM/51fuPlIHGvXNWPf1f4yH9sUnbauJ9BxEuMa8Qc1tblK1mklU5F:virr7fnF5lHJ/vbQ","tlshash":"94d374b2bac9184dae27cd85d195b3bdbe6f69a383428cc7e71137358f806d3221161d","dom_hash":"domhash036d9a7840a031079731660d7a315c07","first_seen":"2026-02-02T12:56:10.150779Z","last_seen":"2026-02-02T15:25:14.984488Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"kk-1.sgrew.club","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":0,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-09T15:25:11Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"tkq-1.bvnnpe.fit","ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"domain_registered":"2025-10-11","domain_rank":0,"first_seen":"2026-02-02T12:56:03.416085Z","last_seen":"2026-02-02T12:56:03.416085Z","alert_count":0,"request_count":4,"received_data":2751,"sent_data":2153,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"111.231.169.247","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2026-01-28T12:24:09.896795Z","alert_count":0,"request_count":1,"received_data":578,"sent_data":446,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"kk-1.sgrew.club","ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"domain_registered":"2026-01-23","domain_rank":0,"first_seen":"2026-02-02T12:56:03.405309Z","last_seen":"2026-02-02T12:56:03.405309Z","alert_count":22,"request_count":22,"received_data":1841266,"sent_data":10268,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"kk-1.sgrew.club/","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"93368157fb131b56a45d6f60f8b40342","sha1":"ea2a25edb7b00c3e0a06650f02fded5bd87dfa20","sha256":"c48d4859bc082aa591168f7d7230bef438ecc2b3074e707c83864e11ec1a891f","sha512":"366c90d022f7fd6718d76460de51a154cf6cf8bf8e3aefa2e0e736cbba24ec53506485331abd3c3c2a7e6ae00c9a3b957a9aa675ecdd389afca7863ad8365908","ssdeep":"","tlshash":"c8e068c260a6294c02208016304ac1031bb608729ec149613c4c67a58fb9f4bc46e859","size":352,"data":"","first_seen":"2023-03-07T01:10:06Z","last_seen":"2026-08-20T12:08:05.694736Z","times_seen":7201,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/js/chunk-vendors.ac14cb58.js","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"359c5bc44ec254362af1cb965ecae80a","sha1":"b138835f66fc6e0e1828b4250405338f98fb2a6a","sha256":"99110f4bbfeeda04d7b4191cc25d78de88a898be0aecdb7939690ce496e853bd","sha512":"1900304648b688c601c68e70ff966b839ff34f04349f7aa72be5c6ef9eb061e9846a5ccae40667e57a46003bdeac7745fce2378ea46fa7ceba53e902770a733c","ssdeep":"6144:+AE2TfRcZbgRN+dDJcnmFB5vm++KSDheBKvIzqaN1Zwm0She5eVa2/55hoTPGo:+P2T57N+VJcSyKuvIz0SMeVdB5qTPGo","tlshash":"bd05088df286b0b60be760b5403f220bb2376959b40a84d4f675e4d4ad7894e2237f7d","size":824345,"data":"","first_seen":"2026-02-02T12:56:10.188006Z","last_seen":"2026-02-02T15:25:14.986038Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/js/index.e827d028.js","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"59bb0d2844976ccde4086b7af5658006","sha1":"049be8496ba151c01d9adc8518fe1d660434730d","sha256":"13bac900944d54307acd9f019fe1aa1d09dd4e81a83ab95c66c22bfb7a25c1c3","sha512":"678abb51a549e4f476358ae0c8620f1f97547e38612b4cb98b435f85ccd78aef11baf2ee7b5df9331010226c0bc23c2aaff9e0f06ffbe67d2f8cbf98b7000ca4","ssdeep":"3072:YDyMTHpHYF8caa3ioE0p6YPVJ7lMouwDzWDNJUI8hnMk:YDyGYF8caa3ioE0pfS785N","tlshash":"6504d6c2f6c5246e8f865f85e06b3bfcf67b1c724242e8c3d590bf755e8a982121562c","size":188068,"data":"","first_seen":"2026-02-02T12:56:10.17717Z","last_seen":"2026-02-02T15:25:15.000981Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/js/pages-home-index.71680f5b.js","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"db5dcf0a0a37c465daed5c553467fb7d","sha1":"792fba8ef5a1e3bc6050db3b5ee9453b8c3067c5","sha256":"74b97c5c5e08a70a82b428c35acad480e265665d696e81135f57ac1e0b818c77","sha512":"5c789b976e61a3dfa7cb74cd35c3a6654ed29fd2c6c45507da6db16990b79aabed17ffd5b2d07e8d303413184cc9a8772c4a6ec93dbe0d9db5faa42dfb4f5252","ssdeep":"768:yv8sG5h+aM3daN7DG+CMdImACV3cW/L/xA:yv8sih+TaN7DJCMdImAi7je","tlshash":"90e21a38b087b05b5983a06434775909bc362e1ba455e5c0d7f5aef28de9a8f1336f4c","size":33315,"data":"","first_seen":"2026-02-02T12:56:10.156886Z","last_seen":"2026-02-02T15:25:15.005163Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/js/pages-goods-category~pages-home-index~pages-login-index~pages-login-register~pages-records-index~pag~571b6469.668ade41.js","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a2b67d22f7298ae65379a32abd3b6a42","sha1":"02b52cb4fd75798ed392ff65763d5a6aa53fad18","sha256":"3e005a11c23c8735dfb555088ea2904d6e138f3d6b20260465743c4f6006f57d","sha512":"47fcb9f1e79c2708be098fcbde9c03e964c85a8626430663a950765898d408acc779ac50dafdc17343fffaab488735ab34855d477410c93385067ed0811443df","ssdeep":"192:6wRSlSY++VcvVk+8ym/BqRs+QVO4qRs5Pjzdejrt46Pa+0eollaKq13:64Sl8MSkJym/gTQERqdejrt46KaKe","tlshash":"a742f914f1cfb8a509e34414216b1b0d503a7f6d8874a8c5fbe599f749e5a8c129fb38","size":12865,"data":"","first_seen":"2026-02-02T12:56:10.169911Z","last_seen":"2026-02-02T15:25:15.003949Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/js/pages-account-bank~pages-account-bills~pages-account-index~pages-account-message~pages-account-passw~3e1f6352.96b8b058.js","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"98ed23c81b8541b58c1258d60d8f2401","sha1":"1d5b7439c7bef03a97c34f86ef6b8031b4ce3331","sha256":"6375529a1e05910e2dd78aa36db6cf2fe01db1759dda9db23fab6e19fc56e134","sha512":"69a4569a669ca869ee40c803277bcb697bbd00a2ea4bf776119e92bf62774d5f442ae5bc2862019a9b4804a8ea9e590692ba18dfa59b0ad066dd80f6819604d8","ssdeep":"1536:vFhzsYId0FHoMqu7NdEAaM2Ol51hwJX2RcJZHYpN7xCIx/+eJF4cL3nnisGQaOmt:vDsp0NVr7fnaMj51hwJX2RcJZHYpN7xE","tlshash":"d543fae6e10c0cd17f7bcc8f6244235f6549ff62d8969cc8f166564c8ce27a021a9b7a","size":56485,"data":"","first_seen":"2026-02-02T12:56:10.195737Z","last_seen":"2026-02-02T15:25:15.002616Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/js/pages-login-index.0688ac83.js","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"34b1fc5377151165cdae87cf67d60b0d","sha1":"763d3a0f8ec3d2b4c3bb254552343b2c1d847d8e","sha256":"5487d796df356b733e655178806b2e640f17edf3953f6bde2a3d6ed97fd55789","sha512":"0f558c16ced8775e223bc1e4871e0e75fe0287e22b2731b50d13890130c8ca3ce6c951927990aadbca02c74069234450ba8477e6d91afc30b42dd86195f51852","ssdeep":"384:5vvSHPXS11eRKjI6C5LuhwfDK3cW/LpFCOg6LM2:5v8XY8+I6QLU3cW/L/xg+M2","tlshash":"06c21b35708bb88b0d53982420ab510e5c663f6f9424e9d19bf1aab54db5f8e0336f5c","size":27761,"data":"","first_seen":"2026-02-02T12:56:10.186382Z","last_seen":"2026-02-02T15:25:14.995198Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"3d5272693eb411e5b8b13a243f76c720","sha1":"6a586ab8e0a4bf12bbc60eea6ca9f2418625a22c","sha256":"9582f31f9eb892b8823a780e579d464d54e26d97d65dc327d2b2bdd92d47c4b8","sha512":"03fc5614f48fc9a2e3c4a30626fdbacde74c1fda09ffa9d1cde0393d31cd5fe1588e270c241f4cedb473c6e5cc224ff16c141468a29519ea6159accf3e3a18f1","ssdeep":"","tlshash":"a4c08c8350e2080c8210861b848880050b8808b04f9308a22cd85b7ecc9ae88c8f804c","size":148,"data":"","first_seen":"2023-03-07T01:10:06Z","last_seen":"2026-06-07T08:18:02.151537Z","times_seen":15899,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/js/chunk-vendors.ac14cb58.js","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:24:52.672Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/static/js/chunk-vendors.ac14cb58.js HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:24:54 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-c9419\"\r\nexpires: Tue, 03 Feb 2026 03:24:54 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":824345,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65192), with no line terminators","md5":"359c5bc44ec254362af1cb965ecae80a","sha1":"b138835f66fc6e0e1828b4250405338f98fb2a6a","sha256":"99110f4bbfeeda04d7b4191cc25d78de88a898be0aecdb7939690ce496e853bd","sha512":"1900304648b688c601c68e70ff966b839ff34f04349f7aa72be5c6ef9eb061e9846a5ccae40667e57a46003bdeac7745fce2378ea46fa7ceba53e902770a733c","ssdeep":"6144:+AE2TfRcZbgRN+dDJcnmFB5vm++KSDheBKvIzqaN1Zwm0She5eVa2/55hoTPGo:+P2T57N+VJcSyKuvIz0SMeVdB5qTPGo","tlshash":"bd05088df286b0b60be760b5403f220bb2376959b40a84d4f675e4d4ad7894e2237f7d","first_seen":"2026-02-02T12:56:10.188006Z","last_seen":"2026-02-02T15:25:14.986038Z","times_seen":2,"resource_available":true,"data":null}},"time_used":2488,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2488,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/assets/31Zd0xdMARL._AC_UL320_.8677650b.jpg","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.953Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/assets/31Zd0xdMARL._AC_UL320_.8677650b.jpg HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:01 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-d7f1\"\r\nexpires: Wed, 04 Mar 2026 15:25:01 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55281,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 448x439, components 3","md5":"8677650bf846b5052c7993fd94f7589d","sha1":"4c53754b0e82a971357507fd0b2824c6d4288494","sha256":"0a225c327ea500bae30d010b4c08133b9a770596f106bc83e7fca603faaf14f6","sha512":"5fce86a8e39ec75aaabf5c371da49648848ba051224a23105cac875097533fb0aae16cd42a347aaeea773f0252927126ed09182463e79b8a1a6e73e77af3bf5e","ssdeep":"1536:pjdzOfNQqPS7DVzfglnBuxgkaOMF18UiHmz7SAQO7:xdzQFYVz2nBuq18UiGz+AQO7","tlshash":"8043f1416b2832a1ff61ce2ba2c33f4535a2e6467aa252390fb34871cb61c5b7fc455c","first_seen":"2026-02-02T12:56:10.197153Z","last_seen":"2026-02-02T15:25:14.987251Z","times_seen":2,"resource_available":false,"data":null}},"time_used":876,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":876,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/assets/81On4W8SmKL._AC_UL320_.29811aa2.jpg","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.961Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/assets/81On4W8SmKL._AC_UL320_.29811aa2.jpg HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:01 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-c6b3\"\r\nexpires: Wed, 04 Mar 2026 15:25:01 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":50867,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 448x437, components 3","md5":"29811aa264eccb05e32a36598663dcd2","sha1":"20f5640a2dd329ab573850b9cd983d5600486884","sha256":"041a910b6098605390d299a77ca87340534d4f4e226f146d005c93e326b2e101","sha512":"c04cf3745f1a8ff4b0485ceb08986849f3bc86707bbb4533639ab504f46dd56ade91c0f02b7e05afe5cacba2efbb9398f5a4a40b1869f15a9e2feceeaedeea0f","ssdeep":"1536:rDhlCd4uZsVF2Bjr6epiROb+NywQREwb6j:3QnsC6Re/3Nbi","tlshash":"aa33022a2141d7f9d2ca20d177a4a24500d1c8b9e345268b2c3e9de57feee9cf4f02b5","first_seen":"2026-02-02T12:56:10.182956Z","last_seen":"2026-02-02T15:25:14.988877Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1520,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1520,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/assets/61NjoN8kgBL._AC_UL320_.2f400de2.jpg","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.958Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/assets/61NjoN8kgBL._AC_UL320_.2f400de2.jpg HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:01 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-801d\"\r\nexpires: Wed, 04 Mar 2026 15:25:01 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32797,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 448x439, components 3","md5":"2f400de27866f2b423d1123b9e2f8277","sha1":"df4525670b4858e276e3c8fd20d1a2285afe4df4","sha256":"29df9f72d0f9247f53c3677ed77e2ce9ccc18491acbe87d05051a39f3ad9d0de","sha512":"f655cfd206e857ea44be3bbc021afe021daa9c8f3acda0b8515f8e0403b388c0e3616add5173985caa6e3857f7ead291440d41c15214aeb25610caa6f984008a","ssdeep":"768:KCt0iAT02VCtNsC3/AIEDXp4lDj+PDzUE8uQ:+3I2VkNrAIiGl/+ffU","tlshash":"0ee2f1ccbe693f27c2d6f0b6e9a4032545ab83e1d08ec5ae00bf6f64e064891dc0168d","first_seen":"2026-02-02T12:56:10.174854Z","last_seen":"2026-02-02T15:25:14.989838Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1521,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1521,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/assets/1593befdfebd015684cd01e19e74ff6b_thumb.69067f03.jpg","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.968Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/assets/1593befdfebd015684cd01e19e74ff6b_thumb.69067f03.jpg HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:02 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-2beb2\"\r\nexpires: Wed, 04 Mar 2026 15:25:02 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":179890,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 800x400, components 3","md5":"69067f038dead0ffd0e43ac7692d488b","sha1":"e76adacbf4b50bb1ab2b839633c2086b69cdc17e","sha256":"263b79a781c59ab9b23e3689dcef960093a20db7c529c1684f749a97ec8f27c2","sha512":"d858ec1708033dac5e3dd65fa005d6e494401b8a533052f1cf9accff6faf16d7ddaf97636167531d4bc6009853b4673777660d1b14cde46c0e9fb198a83854d4","ssdeep":"3072:nFUxDSLuCe+Zn/YZVNHcn9vn3SKncs5oCeRQoygkXg06kUaJQORwDZ75:Fb7rZn/I7cnVn3SKncfQoKZ/J6975","tlshash":"ec042376efe2c6c31d34da848f0d5e9775360a8a0191d0b63a1b531fce9bb794423918","first_seen":"2026-02-02T12:56:10.184708Z","last_seen":"2026-02-02T15:25:14.99073Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2583,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2583,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/index.883130ca.css","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:24:52.670Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/static/index.883130ca.css HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:24:54 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-1793e\"\r\nexpires: Tue, 03 Feb 2026 03:24:54 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":96574,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"2de2f2d3943b4b382a28a439daff5939","sha1":"70d04e1c3567cb4f248b29046b98386f215a4d38","sha256":"8a35934d019c2b120a31ae6c51c75b2327f22637824b2a2c2faf4ce17ae9d4d8","sha512":"eba9271e30d6e4b21954078e3ccd839a55e1dcc8212fa375c18dce42104d19a92655c2f289401525b0c9565971a31573b928666515a3ca89b1801bbd48c1de95","ssdeep":"1536:OlIApuK7hmVmb2RS1Wu3xdynGJ7eh/nrhlvbc:VApuK7hmVrS1Wu3iG41nrPI","tlshash":"f393f73719012e39e52bcd26b6c1ab5a1e61c033e15307adfba47628cbcf9c9167b345","first_seen":"2025-07-20T12:48:29.443135Z","last_seen":"2026-08-18T15:46:02.333677Z","times_seen":5239,"resource_available":false,"data":null}},"time_used":2487,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2487,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/tabBar/starting.png","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.089Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/static/tabBar/starting.png HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:01 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-a65\"\r\nexpires: Wed, 04 Mar 2026 15:25:01 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2661,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 84 x 84, 8-bit/color RGBA, non-interlaced","md5":"fa8e1bfec0353cd15263b81d3a666114","sha1":"4abd5722321a3cd6eebbdf67855133d78e97187f","sha256":"4bc81d76d643fdfc7742c958a7483a1fa33b83833486c3f35beb522570e10df2","sha512":"cc396fb14bd82c6c52f559458458d019d616967e1028e551e781a75273f2659a0986ff3bbc7cb5b89b36f7fa51e29fbc3b26f6476ebb5706e08cf04a98441eed","ssdeep":"","tlshash":"f651e9d6f211618045dafe961ced94276d270d40a1f2e1217dcbcacb18d09b11eff08b","first_seen":"2024-10-04T01:47:46Z","last_seen":"2026-07-05T21:46:17.881899Z","times_seen":79,"resource_available":false,"data":null}},"time_used":1735,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1735,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/assets/cdb046675de0df966d1ed12ac381e2c2_thumb.0ff7e3b7.jpeg","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.967Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/assets/cdb046675de0df966d1ed12ac381e2c2_thumb.0ff7e3b7.jpeg HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:01 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-230aa\"\r\nexpires: Wed, 04 Mar 2026 15:25:01 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":143530,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 800x449, components 3","md5":"0ff7e3b7a7ab4c67c4cc8e328589132a","sha1":"9ce5a5adc9a596cfa50650d825b7ebc0a0e0cf9d","sha256":"2a75244e01b38c358d4cf7a55ad94c302ea1fbe2a76eb89cb0a58eb067631e59","sha512":"df6e3a92c292e3caaee2514837db924e365079f8281fa80a0c13af15fbb1d56b9bf71fbbad5cf98386faf94f298f077365ee7da8e3e83c012f43275612fe71e6","ssdeep":"3072:CnJb5IKNdfKf3oGI/vIHAUMspYZmOEMKk9OlI:CFKKNdfsXIn0AUM6YZmOEu","tlshash":"04e312b497ec64d0ed4d243d519e207f3a17842e84192eafbad4f942fd3f38349a6190","first_seen":"2026-02-02T12:56:10.199247Z","last_seen":"2026-02-02T15:25:14.993186Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2003,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2003,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tkq-1.bvnnpe.fit/index/index?lang=en","fqdn":"tkq-1.bvnnpe.fit","domain":"bvnnpe.fit","tld":"fit"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:03.610Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tk-2.bvnnpe.fit","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 10 Jan 2026 01:43:55 GMT","end":"Fri, 10 Apr 2026 01:43:54 GMT"},"fingerprint":{"sha1":"2A:2C:62:40:B8:1C:D4:D3:1F:6A:BF:63:0A:53:01:15:32:31:D3:CB","sha256":"96:E7:ED:90:29:11:13:04:32:4D:24:00:8A:C7:F7:5E:C8:DA:65:CA:E6:71:2C:64:6E:89:43:27:15:E6:FA:2B"}}},"request":{"raw":"POST /index/index?lang=en HTTP/1.1\r\nHost: tkq-1.bvnnpe.fit\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/json\r\nContent-Length: 2\r\nOrigin: https://kk-1.sgrew.club\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2,"data":"{}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:04 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nset-cookie: think_lang=en; path=/\nthink_var=en; path=/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"8bae169c8354d30ed2f819c7efeca243","sha1":"2151335339b1801065fb16de845fc47023384780","sha256":"efb7376eda4b4f07483eec5fd2366aad1e5fc32bc55eedb379a41848e2c2161e","sha512":"4e666df768b0b0d894dd94cc9c624fb88df148ec242c38906048a83b2c03703a0aa67ad0d6466437cfad153fab58f4f8f7b0ba66e23add61fd2e4fdc7fa754b3","ssdeep":"","tlshash":"c3a00214152d10871416aa389c5846b5417940bf32409ba00be85a24961c098b089217","first_seen":"2026-02-02T15:25:14.99402Z","last_seen":"2026-02-02T15:25:14.99402Z","times_seen":1,"resource_available":false,"data":null}},"time_used":840,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":840,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/js/pages-login-index.0688ac83.js","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:04.439Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/static/js/pages-login-index.0688ac83.js HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:05 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-6c82\"\r\nexpires: Tue, 03 Feb 2026 03:25:05 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27778,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (26240), with no line terminators","md5":"34b1fc5377151165cdae87cf67d60b0d","sha1":"763d3a0f8ec3d2b4c3bb254552343b2c1d847d8e","sha256":"5487d796df356b733e655178806b2e640f17edf3953f6bde2a3d6ed97fd55789","sha512":"0f558c16ced8775e223bc1e4871e0e75fe0287e22b2731b50d13890130c8ca3ce6c951927990aadbca02c74069234450ba8477e6d91afc30b42dd86195f51852","ssdeep":"384:5vvSHPXS11eRKjI6C5LuhwfDK3cW/LpFCOg6LM2:5v8XY8+I6QLU3cW/L/xg+M2","tlshash":"06c21b35708bb88b0d53982420ab510e5c663f6f9424e9d19bf1aab54db5f8e0336f5c","first_seen":"2026-02-02T12:56:10.186382Z","last_seen":"2026-02-02T15:25:14.995198Z","times_seen":2,"resource_available":true,"data":null}},"time_used":809,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":809,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tkq-1.bvnnpe.fit/user/config?lang=en","fqdn":"tkq-1.bvnnpe.fit","domain":"bvnnpe.fit","tld":"fit"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:06.105Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tk-2.bvnnpe.fit","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 10 Jan 2026 01:43:55 GMT","end":"Fri, 10 Apr 2026 01:43:54 GMT"},"fingerprint":{"sha1":"2A:2C:62:40:B8:1C:D4:D3:1F:6A:BF:63:0A:53:01:15:32:31:D3:CB","sha256":"96:E7:ED:90:29:11:13:04:32:4D:24:00:8A:C7:F7:5E:C8:DA:65:CA:E6:71:2C:64:6E:89:43:27:15:E6:FA:2B"}}},"request":{"raw":"POST /user/config?lang=en HTTP/1.1\r\nHost: tkq-1.bvnnpe.fit\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAuthorization: \r\nContent-Type: application/json\r\nContent-Length: 18\r\nOrigin: https://kk-1.sgrew.club\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":18,"data":"{\"keyword\":\"kefu\"}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:06 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nset-cookie: think_lang=en; path=/\nthink_var=en; path=/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":93,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"4dc54cfef87c4c8f4f1a56ef9f16fb45","sha1":"59c7c1ef46c97db4cff3693887d82a4bfef989b8","sha256":"eb4dfa98ddf5f52692432e0066c855d182c8c0fd768e5c1f1ce1b88b32b6013b","sha512":"6c082d8ac8daff65d88bd326228e23418fae2752ebe52093696f365abfffb2a7e7bd7174e763658d3b0b9b821c51e91410b318522a0a959f2b870907537d1506","ssdeep":"","tlshash":"2bb012555a4411c104a3f084480c9645e145116759002300c68d0fb485390dcb199936","first_seen":"2026-02-02T15:25:14.996134Z","last_seen":"2026-02-02T15:25:14.996134Z","times_seen":1,"resource_available":false,"data":null}},"time_used":709,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":709,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/favicon.ico","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:24:55.068Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:24:55 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-08-20T15:05:15.50417Z","times_seen":552480,"resource_available":true,"data":null}},"time_used":3171,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":2365,"receive":806,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"111.231.169.247","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:24:58.206Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 26 Aug 2025 11:47:17 GMT","end":"Fri, 25 Sep 2026 11:47:16 GMT"},"fingerprint":{"sha1":"47:A7:6C:09:6B:1D:CA:2D:7D:39:2E:C1:7F:15:DE:5D:F2:C4:0F:77","sha256":"EA:73:37:83:D0:38:44:D9:3C:0B:26:F0:DD:D1:22:2F:36:F7:F2:86:A1:B0:58:52:DE:4E:0A:21:D6:89:E7:3E"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:24:59 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Mon, 02 Feb 2026 15:54:59 GMT\r\ncache-control: max-age=1800\r\nset-cookie: __uni__uid=rBEQUmmAwcsrf1IGA1wjAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-08-20T12:08:05.658645Z","times_seen":20295,"resource_available":false,"data":null}},"time_used":2688,"timings":{"blocked":891,"dns":138,"connect":301,"send":0,"wait":905,"receive":0,"ssl":451},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/tabBar/records.png","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.087Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/static/tabBar/records.png HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:00 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-6a3\"\r\nexpires: Wed, 04 Mar 2026 15:25:00 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1699,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 84 x 84, 8-bit/color RGBA, non-interlaced","md5":"d96532dcc0a2b8ba37c1209c1535af6d","sha1":"40628321af712ac7ebe4329056676f6785b29545","sha256":"e2e2e5e38eb166ff7958ac5b73d6a683fa626b911b6caef9f315de4f87867976","sha512":"2aba240887f630c35ea88d9379192517607ee515e23d1b5e9c0b34355a740299321da3c8fd83a9e37d60ed8bfbf79e78c25d40d0134ca31375b71d5011808b5f","ssdeep":"","tlshash":"6f31d8acfef13286448d54053cef90b3d962cc408ad0bb61b687c81655741b687de8cb","first_seen":"2024-10-04T01:47:46Z","last_seen":"2026-07-05T21:46:17.910519Z","times_seen":83,"resource_available":false,"data":null}},"time_used":790,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":790,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/tabBar/service.png","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.091Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/static/tabBar/service.png HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:01 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-990\"\r\nexpires: Wed, 04 Mar 2026 15:25:01 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2448,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 84 x 84, 8-bit/color RGBA, non-interlaced","md5":"b0643213d41c059816f5bba230f0a1b2","sha1":"9ab93bf41b9a582e39b9fb80c1c3d731e29a23cd","sha256":"bb6f0bdbe9e1e4ad776983a2f7043cebdf5583d8d763f71aee768b504e790305","sha512":"a697172332996232e96d0e6415af689c44fac1fd18c8f6d0c7c40e1705db6224878f0c8c44492e1f600efdb882e011c369ff2a6cc85f22489aaf5712f3493155","ssdeep":"","tlshash":"485108eeea37b242d342a2a7b5c240074016cc88c5f96122bd99814f8d391fa88ab5c7","first_seen":"2024-10-04T01:47:46Z","last_seen":"2026-07-05T21:46:17.878615Z","times_seen":82,"resource_available":false,"data":null}},"time_used":1734,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1734,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/js/index.e827d028.js","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:24:52.673Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/static/js/index.e827d028.js HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:24:54 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-2dea4\"\r\nexpires: Tue, 03 Feb 2026 03:24:54 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":188068,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64867), with no line terminators","md5":"59bb0d2844976ccde4086b7af5658006","sha1":"049be8496ba151c01d9adc8518fe1d660434730d","sha256":"13bac900944d54307acd9f019fe1aa1d09dd4e81a83ab95c66c22bfb7a25c1c3","sha512":"678abb51a549e4f476358ae0c8620f1f97547e38612b4cb98b435f85ccd78aef11baf2ee7b5df9331010226c0bc23c2aaff9e0f06ffbe67d2f8cbf98b7000ca4","ssdeep":"3072:YDyMTHpHYF8caa3ioE0p6YPVJ7lMouwDzWDNJUI8hnMk:YDyGYF8caa3ioE0pfS785N","tlshash":"6504d6c2f6c5246e8f865f85e06b3bfcf67b1c724242e8c3d590bf755e8a982121562c","first_seen":"2026-02-02T12:56:10.17717Z","last_seen":"2026-02-02T15:25:15.000981Z","times_seen":2,"resource_available":true,"data":null}},"time_used":4763,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4763,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/js/pages-account-bank~pages-account-bills~pages-account-index~pages-account-message~pages-account-passw~3e1f6352.96b8b058.js","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.075Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/static/js/pages-account-bank~pages-account-bills~pages-account-index~pages-account-message~pages-account-passw~3e1f6352.96b8b058.js HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:00 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-dca5\"\r\nexpires: Tue, 03 Feb 2026 03:25:00 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":56485,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (55905), with no line terminators","md5":"98ed23c81b8541b58c1258d60d8f2401","sha1":"1d5b7439c7bef03a97c34f86ef6b8031b4ce3331","sha256":"6375529a1e05910e2dd78aa36db6cf2fe01db1759dda9db23fab6e19fc56e134","sha512":"69a4569a669ca869ee40c803277bcb697bbd00a2ea4bf776119e92bf62774d5f442ae5bc2862019a9b4804a8ea9e590692ba18dfa59b0ad066dd80f6819604d8","ssdeep":"1536:vFhzsYId0FHoMqu7NdEAaM2Ol51hwJX2RcJZHYpN7xCIx/+eJF4cL3nnisGQaOmt:vDsp0NVr7fnaMj51hwJX2RcJZHYpN7xE","tlshash":"d543fae6e10c0cd17f7bcc8f6244235f6549ff62d8969cc8f166564c8ce27a021a9b7a","first_seen":"2026-02-02T12:56:10.195737Z","last_seen":"2026-02-02T15:25:15.002616Z","times_seen":2,"resource_available":true,"data":null}},"time_used":792,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":792,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/js/pages-goods-category~pages-home-index~pages-login-index~pages-login-register~pages-records-index~pag~571b6469.668ade41.js","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.078Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/static/js/pages-goods-category~pages-home-index~pages-login-index~pages-login-register~pages-records-index~pag~571b6469.668ade41.js HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:00 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-3241\"\r\nexpires: Tue, 03 Feb 2026 03:25:00 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12865,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (11877), with no line terminators","md5":"a2b67d22f7298ae65379a32abd3b6a42","sha1":"02b52cb4fd75798ed392ff65763d5a6aa53fad18","sha256":"3e005a11c23c8735dfb555088ea2904d6e138f3d6b20260465743c4f6006f57d","sha512":"47fcb9f1e79c2708be098fcbde9c03e964c85a8626430663a950765898d408acc779ac50dafdc17343fffaab488735ab34855d477410c93385067ed0811443df","ssdeep":"192:6wRSlSY++VcvVk+8ym/BqRs+QVO4qRs5Pjzdejrt46Pa+0eollaKq13:64Sl8MSkJym/gTQERqdejrt46KaKe","tlshash":"a742f914f1cfb8a509e34414216b1b0d503a7f6d8874a8c5fbe599f749e5a8c129fb38","first_seen":"2026-02-02T12:56:10.169911Z","last_seen":"2026-02-02T15:25:15.003949Z","times_seen":2,"resource_available":true,"data":null}},"time_used":791,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":791,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/js/pages-home-index.71680f5b.js","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.079Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/static/js/pages-home-index.71680f5b.js HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:00 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-8223\"\r\nexpires: Tue, 03 Feb 2026 03:25:00 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":33315,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (31282), with no line terminators","md5":"db5dcf0a0a37c465daed5c553467fb7d","sha1":"792fba8ef5a1e3bc6050db3b5ee9453b8c3067c5","sha256":"74b97c5c5e08a70a82b428c35acad480e265665d696e81135f57ac1e0b818c77","sha512":"5c789b976e61a3dfa7cb74cd35c3a6654ed29fd2c6c45507da6db16990b79aabed17ffd5b2d07e8d303413184cc9a8772c4a6ec93dbe0d9db5faa42dfb4f5252","ssdeep":"768:yv8sG5h+aM3daN7DG+CMdImACV3cW/L/xA:yv8sih+TaN7DJCMdImAi7je","tlshash":"90e21a38b087b05b5983a06434775909bc362e1ba455e5c0d7f5aef28de9a8f1336f4c","first_seen":"2026-02-02T12:56:10.156886Z","last_seen":"2026-02-02T15:25:15.005163Z","times_seen":2,"resource_available":true,"data":null}},"time_used":791,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":791,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tkq-1.bvnnpe.fit/index/index?lang=en","fqdn":"tkq-1.bvnnpe.fit","domain":"bvnnpe.fit","tld":"fit"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.973Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tk-2.bvnnpe.fit","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 10 Jan 2026 01:43:55 GMT","end":"Fri, 10 Apr 2026 01:43:54 GMT"},"fingerprint":{"sha1":"2A:2C:62:40:B8:1C:D4:D3:1F:6A:BF:63:0A:53:01:15:32:31:D3:CB","sha256":"96:E7:ED:90:29:11:13:04:32:4D:24:00:8A:C7:F7:5E:C8:DA:65:CA:E6:71:2C:64:6E:89:43:27:15:E6:FA:2B"}}},"request":{"raw":"OPTIONS /index/index?lang=en HTTP/1.1\r\nHost: tkq-1.bvnnpe.fit\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type\r\nReferer: https://kk-1.sgrew.club/\r\nOrigin: https://kk-1.sgrew.club\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:03 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T15:30:33.742415Z","times_seen":17993318,"resource_available":true,"data":null}},"time_used":4358,"timings":{"blocked":1757,"dns":189,"connect":772,"send":0,"wait":844,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tkq-1.bvnnpe.fit/user/config?lang=en","fqdn":"tkq-1.bvnnpe.fit","domain":"bvnnpe.fit","tld":"fit"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:05.262Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tk-2.bvnnpe.fit","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 10 Jan 2026 01:43:55 GMT","end":"Fri, 10 Apr 2026 01:43:54 GMT"},"fingerprint":{"sha1":"2A:2C:62:40:B8:1C:D4:D3:1F:6A:BF:63:0A:53:01:15:32:31:D3:CB","sha256":"96:E7:ED:90:29:11:13:04:32:4D:24:00:8A:C7:F7:5E:C8:DA:65:CA:E6:71:2C:64:6E:89:43:27:15:E6:FA:2B"}}},"request":{"raw":"OPTIONS /user/config?lang=en HTTP/1.1\r\nHost: tkq-1.bvnnpe.fit\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type\r\nReferer: https://kk-1.sgrew.club/\r\nOrigin: https://kk-1.sgrew.club\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:05 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T15:30:33.742415Z","times_seen":17993318,"resource_available":true,"data":null}},"time_used":840,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":840,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/images/banner.png","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:05.284Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/static/images/banner.png HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:05 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-bdb5\"\r\nexpires: Wed, 04 Mar 2026 15:25:05 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48565,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 1080x542, components 3","md5":"0b71470fccb6f7ffa07d6b0633484633","sha1":"6c24aeb303ed1ec9b4f2b74ae3da5b75355ab5c2","sha256":"c95b9de5f7f34731fa0822353a01541ba8eb937d628db83755713ce0334fb591","sha512":"cd33dd1e7235df9e7855961589ab99117ee6b900191b9c50d98cfa2e16489a9d48967bc5a2b08b5d04d6da68cf7efbfb68e1a120b01d44b86ebb0e8ba390da42","ssdeep":"768:2hYzfqJXlYyV+vU2VI4A8KrDgnJ9yfKg+xEB+mHsvYSHbNKFBTaGAeh+Q2xRpGT/:QYzSJX9V+vUtT8oDgJ9IMvxHbAFBLM/+","tlshash":"9823f19487ae170cee8c673fa6e74a07f51afd94f944d69b224d01103d3f76019385aa","first_seen":"2026-02-02T12:56:10.160485Z","last_seen":"2026-02-02T15:25:15.007225Z","times_seen":2,"resource_available":false,"data":null}},"time_used":787,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":787,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/tabBar/account.png","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.092Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/static/tabBar/account.png HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:01 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-7dc\"\r\nexpires: Wed, 04 Mar 2026 15:25:01 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2012,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 84 x 84, 8-bit/color RGBA, non-interlaced","md5":"1cb2978005f3ba6966060a475f90d7d2","sha1":"04a5c0e1a0eee1a40825564ae6d4ec9d7851b25d","sha256":"a3ed113eb77356ea02c1f62f99acaaa73cc57341ad3c4694203b74376ffb6ea2","sha512":"cfe8d912a82c55111a9eb36c1eeda9ca4a57ed9bb47ad31601a766b338e7d66ea669dfdc5e4a7134bdff8d13cd9e97ca7b69463729eadc2ac5c67134ae5f2145","ssdeep":"","tlshash":"4241eac6fb10959741abb5c23cf9902355236cc0cad0f072fcc7c05202a4aa546759df","first_seen":"2024-10-04T01:47:46Z","last_seen":"2026-07-05T21:46:17.930851Z","times_seen":83,"resource_available":false,"data":null}},"time_used":1734,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1734,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/assets/41YpgJjcD+L._AC_UL320_.763bfcf4.jpg","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.956Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/assets/41YpgJjcD+L._AC_UL320_.763bfcf4.jpg HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:01 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-5ca2\"\r\nexpires: Wed, 04 Mar 2026 15:25:01 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23714,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 448x434, components 3","md5":"763bfcf4ebaf969fbd7828450f51148e","sha1":"6696776ffc679c13f4e7657900f1a9233d459e01","sha256":"9b45eee3f95c8aa02364b2090d0a1bcfbcefcf03e06e7134ea83619ed306739c","sha512":"487c2911898d90f4195e2e4ae2b49063d3492c906b3a7f8004a6d661a64fac3a4a6608887ac03efcc771ae01b972e70255ef87707ba017273fd45afb25718b0a","ssdeep":"384:d7GPh30IjK/FwSIMMwOM+abv22USqOgmbm6jMIJhHzx43B7yRacwChTtmWr/nM7K:dihc2SxMwOrabe2eiltJdEEp98Gr6SII","tlshash":"90b2c0f8eb5581c9fee62b3216a27b537b16c746c72b1d2af2f600b48d020f5c5961e1","first_seen":"2026-02-02T12:56:10.172514Z","last_seen":"2026-02-02T15:25:15.009331Z","times_seen":2,"resource_available":false,"data":null}},"time_used":877,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":877,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-02T15:24:50.120Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:24:52 GMT\r\ncontent-type: text/html\r\ncontent-length: 811\r\nlast-modified: Wed, 10 Dec 2025 05:32:56 GMT\r\netag: \"69390608-32b\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":811,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (519), with CRLF line terminators","md5":"8eaa01434b7d262c2e21e38b5974ff0b","sha1":"e50f9b26b09b001aaa0a470d77966507d2e592fc","sha256":"ff1fbe6cf5ae04d564e21f786f93e12f17cd0a96ce1396d4d2b345538de61cdf","sha512":"619e2ec09aca3dae0f868638a05ea7e9651d49d24b61901d6e86b4bdcb70f9881436825e8b963263f486f8d58b5973af84a2e86b34b10ba6ed20c38596ec7c19","ssdeep":"","tlshash":"c50141c64c20e44d132086a174f6e11e8dea48b9e9908c103ddc66ed4ff0b8ece6f810","first_seen":"2026-02-02T12:56:10.193044Z","last_seen":"2026-02-02T15:25:15.010343Z","times_seen":2,"resource_available":false,"data":null}},"time_used":4094,"timings":{"blocked":1697,"dns":39,"connect":816,"send":0,"wait":700,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/static/tabBar/home.png","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.084Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/static/tabBar/home.png HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:00 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-8d6\"\r\nexpires: Wed, 04 Mar 2026 15:25:00 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2262,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 84 x 84, 8-bit/color RGBA, non-interlaced","md5":"e045dcf406648b0c76b7f6978d998e03","sha1":"d8e8d2545e6e087bbc4b572efce26402e0871355","sha256":"dee4351393cd84f900784cb228e4638f8667525b2664f5d5ce7c99aae42f6330","sha512":"6de25c8a710d3f6f2b482f8547de559d2e5ff4559ec3d933954a7445f77ea94ddbf6f5bf43ceb4bd4fab6dd9f580ee5f6f7528d5c98b9caeb6996522b7c7b45e","ssdeep":"","tlshash":"2841f99dfc814114961af8a45ee5d0234d231881d9e8f28bb5cfd8898db55312d680cb","first_seen":"2024-10-04T01:47:46Z","last_seen":"2026-07-05T21:46:17.871071Z","times_seen":81,"resource_available":false,"data":null}},"time_used":790,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":790,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kk-1.sgrew.club/h5/assets/91fhUhNXQrL._AC_UL320_.26e48842.jpg","fqdn":"kk-1.sgrew.club","domain":"sgrew.club","tld":"club"},"ip":{"addr":"154.9.25.89","port":443,"asn":979,"as":"NETLAB-SDN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kk-1.sgrew.club/","date":"2026-02-02T15:25:00.962Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"kk-1.sgrew.club","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 28 Jan 2026 11:21:13 GMT","end":"Tue, 28 Apr 2026 11:21:12 GMT"},"fingerprint":{"sha1":"6C:D9:F4:F1:34:93:9F:AB:C7:A8:C4:E1:6F:C0:14:A6:55:9C:F5:B5","sha256":"CF:05:F5:07:F8:2C:4E:FB:C4:48:4C:33:0C:52:41:0A:79:0B:DE:46:A1:BA:7C:C9:70:11:E3:EE:F8:A6:28:28"}}},"request":{"raw":"GET /h5/assets/91fhUhNXQrL._AC_UL320_.26e48842.jpg HTTP/1.1\r\nHost: kk-1.sgrew.club\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kk-1.sgrew.club/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 02 Feb 2026 15:25:01 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 10 Dec 2025 05:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69390605-ac83\"\r\nexpires: Wed, 04 Mar 2026 15:25:01 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":44163,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 448x439, components 3","md5":"26e48842f03e54e12c7840b35e53db43","sha1":"02e266639d777cec99f8bafc1f2d140d38539c37","sha256":"395d0aeb80d904ce9925d2e24bc8b9abb12a52aa61c08e0583730e6b4339b69f","sha512":"550d2d2a535cfeeac232a23e174b04b37b1eaa87bf516a13446c87867ebe93d55cff7d3a3adebebd8028d91387a727f694c923e2dc6eaa92e7aee9a2ca0fcb98","ssdeep":"768:8MCY+oeSrU7BfKn7ZWBOLLHcn1K1lyIY2x12ISK4QoYAPvpYCOUqERpQ:8MCZ5WABzBOLLMK1lnY2xgzqEU","tlshash":"d713f1a7c38c1085682a3d32efeb718dbbd39065fb456b8a75cc740c821d5969fc306a","first_seen":"2026-02-02T12:56:10.181019Z","last_seen":"2026-02-02T15:25:15.012097Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2009,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2009,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-02","alert":"Sinkholed","trigger":"kk-1.sgrew.club","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}