{"report_id":"311a2e41-e096-4ba3-8c02-cd0273208428","version":0,"status":"done","tags":[],"date":"2026-07-14T13:14:12Z","url":{"schema":"http","addr":"kxmvip66.com","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":0,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"kxmvip66.com/","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"title":"澳门凯旋门，成就璀璨时刻 - KXM 中国官方网站","dom":{"size":8209,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"9b8aec82c58f44db0e2da822dacba093","sha1":"eefdfd7d9d562be497b46a3340f84e863714e2bf","sha256":"20d91d56e189bcd65f395b82c8aa84f1cd48af613ccd6debf532c54acec37767","sha512":"9759bda4b09593e9305259d6c50675bdc446cd86d481bb119d0acf8e61e823d2913f9d3c93f2c4132110d061428251044770766c298f6d2cfca57e06c3c26a7c","ssdeep":"192:SrnMZjBPCpnDZ0CPBfE/k1mp6rPlyJzmRF4sArtg:1jmX7Artg","tlshash":"5f02871661d3115b2922d1a66fb3171b6664d407c30bc9a97fcc15cdef89ac9c8a738c","dom_hash":"domhash27012197961c49af023d3292681d65a6","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"kxmvip66.com","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":0,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-18T13:14:12Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"kxmvip66.com","ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"domain_registered":"2026-03-31","domain_rank":0,"first_seen":"2026-07-14T12:24:59.03754Z","last_seen":"2026-07-14T12:24:59.03754Z","alert_count":108,"request_count":27,"received_data":2207324,"sent_data":13533,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}]},{"fqdn":"156.227.82.66","ip":{"addr":"156.227.82.66","port":61194,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":9,"received_data":196819,"sent_data":4984,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"sdk.51.la","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2005-01-17","domain_rank":347679,"first_seen":"2021-03-08T16:03:51Z","last_seen":"2026-07-07T13:00:30.828297Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":454,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"kxmvip66.com/skin/swiper/js/swiper-bundle.min.js","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"21b78ba7133b3d67cf8b09cd6a26d386","sha1":"ea59f37b232db6dee2694078bf21e153a09bacdd","sha256":"6f9df49fe12f77b66daba876cb33b7090b2443f570a2a4b9541cddd705440aa5","sha512":"dc48bb38f168f37930ddc3db0cb78b867fd817cb5907b56cf2c7e58b407f2847a4bab78be5ea2c0deb216052020afb782bc8b4c948a5fe52b77128a27365a392","ssdeep":"1536:TIJQfGP7LP8NEuWGKF+IlzholxU/2Bkt+9SD8jv1nTHlU9ymp8Mj0HEOS5hAsVuZ:0JCN+TXD2BkQZFU9tp8Mj0k95h5cpnv","tlshash":"02d3f8896221b57646e316db93e4c221a3b50544b80ac8f470bd4c9f597ec9813feffa","size":140562,"data":"","first_seen":"2023-06-14T11:52:48Z","last_seen":"2026-07-14T16:20:56.910192Z","times_seen":5276,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/bootstrap/js/home.js","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"16c93ef01acd14ec64c07020d638253e","sha1":"9c7b9d1a61977675c7f128bf2e27093d3cfe37f6","sha256":"f0795e9620ff382d585e15e40f303b394863fc5fa3dbdecd140adcbc4e51ffd2","sha512":"218d41ff60e128ff13105f9d376cfac1b80401527884da7b6179bab1fe8e9aa9e5959873bc5385798c8a5c6fb7aedce8e68b17112833cc16c096e0dc214d35ea","ssdeep":"96:6P7fgtAVMsSMCM1vUrp8KtQJQ1l/2o3RV0uRC6v6qyS+KQkIF:6P7fg+VSVAvUr2KaG1Zd3YuRriqyDKQH","tlshash":"91c1551a62b42433447775bb97af57c477212087b8c6ec393dfcc6080f845aa59f1aea","size":5802,"data":"","first_seen":"2025-10-09T23:37:04.756251Z","last_seen":"2026-07-14T13:14:17.8791Z","times_seen":1178,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/e/dongpo/tz/tj.js","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"1bf60b5cf9c764caf9e85228dc7bfc33","sha1":"22b0d1971d7ec1ec3bb55ff4771752db18eab9ef","sha256":"1a32c475f692c3c84f550cc194a92fff3df6368293bbec3b8e67a42bc2d92306","sha512":"681c26eab518649736ea2c6302120b5a61e0b0749375c8933c7c890b6195de0c6e09a4184c9af8c5fd0f5e5eeda63ba803574bee4c44737899ccd18ce14c97c9","ssdeep":"","tlshash":"8601f11f7c25e13463921c2d23bbdadcf5ad2016101dc80654dec4ad6c34ff9042ab4c","size":808,"data":"","first_seen":"2026-03-03T01:17:34.078046Z","last_seen":"2026-07-14T13:14:17.899267Z","times_seen":736,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e534a5cbd2df3aaed4e2bb405780d2a7","sha1":"bd4ac483c7629ef832aaa724291e5f3c97013e14","sha256":"4df2c5608d78458b37f68c0612223902a6b6ea8d31ff8124ed0eff7589fc03be","sha512":"4a5e434560cf6e8e9c071dd0cc5e8c2442dafdfbcba638c0c7e90bdc5a74deee42bbd2a2a1b7452addb1a807443c6c4db4eb30e1cb2629ebe39320e9c7d36662","ssdeep":"","tlshash":"d4f0dcae9c51e178abc338ac9bafda88c16e1026110ecc03a9d9c5ce3c38fc8042134c","size":492,"data":"","first_seen":"2025-05-26T01:34:30.601443Z","last_seen":"2026-07-14T13:14:17.905676Z","times_seen":306,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"156.227.82.66:61194/static/js/link.js","fqdn":"156.227.82.66","domain":"156.227.82.66","tld":""},"ip":{"addr":"156.227.82.66","port":61194,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"bf5f267e4a7265764a98c048168a4b17","sha1":"b25d35d1da8e51a5b64858f256ad37e80863e375","sha256":"940b573990b136b8e1e0e026bde106c8ffdebf8610dd8983c02eaae3bf70b765","sha512":"c9ad04a64c937140717b618c5f97b2f8cf8c216cbba39f092f7ee4a02f8aaa8f47f8d3ab1dd9fdb82c4f5289b4b6384ae548dbd352e48a1b19e3dab44fbf2d73","ssdeep":"","tlshash":"8731c058e6d038260e1748a7595b2c04b5a3400f7c0aec43f69d4ac4dfb172e4b7ace4","size":1742,"data":"","first_seen":"2026-07-14T12:25:05.270386Z","last_seen":"2026-07-14T13:14:17.901106Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/e/dongpo/tz/tz.js","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"55a0a29ffe5995b25043ec5374a1fc07","sha1":"f90152d6f33878a1fb4dc90592ec1366a95a9a57","sha256":"c0f2d27aacf5c3d40d0dee1d2c56d0f7702578ff43d77f1d33d8d056658631c7","sha512":"8b1fc1c423fba549634792946353443d4a98b47e8fc8e62996ec3e2ff73e140e5a04e9e7224738666dea295ade9f2fdb05b55784855e7a2173cb592c2b88a216","ssdeep":"","tlshash":"7d215c7fae631154d11a91692bba676c3a3a001b6701c8307afcbe685f52f429847bd4","size":1158,"data":"","first_seen":"2026-07-02T05:57:33.789198Z","last_seen":"2026-07-14T13:14:17.885497Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/bootstrap/js/bootstrap.bundle.min.js","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"21d4551af5cc4ed4d818bdbdfea8c358","sha1":"df272a07ed30eaf8025b699c45736ba9d284e4d4","sha256":"35f4547d9364111aca4850347356bc5660a994f0d8b694d88f995098a7b547fa","sha512":"4dcd22faf4688265f834deedb8b6d07c1c5af0991f512031485573994df59d5747ca21c494f3f2d9c59f15a7260892b0d15aa8bebcca85d7764d24cc740c69da","ssdeep":"1536:/SwJiEbnTl6R2t49CFliFCIg/yWszSraJd5qUFH9tZwcE+iYZMgZdj:6wfs+SSO5q4tZwcEVYZFj","tlshash":"2383b5593244b8730ade85b68037430bf2265998b14b812cb57cadde2a7dcc67277f78","size":80821,"data":"","first_seen":"2025-06-18T01:20:12.005242Z","last_seen":"2026-07-14T16:19:02.709629Z","times_seen":2575,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"kxmvip66.com/skin/bootstrap/css/module.css","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.899Z","timestamp":1784034817899,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/bootstrap/css/module.css HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 24 Jul 2025 12:07:14 GMT\r\nvary: Accept-Encoding\r\netag: W/\"688221f2-28112\"\r\nexpires: Wed, 15 Jul 2026 01:13:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":164114,"size_decoded":32530,"mime_type":"text/css","magic":"ASCII text, with very long lines (65518)","md5":"67e45932bedd92dd7bc2a7de1653677e","sha1":"b15f3b2e370d9a7c2c40ea991c8f4a839617702d","sha256":"6e25cdc64273a412026df8a7b3510d9ba7dd6cd75653dd3eb884371b4ace73e8","sha512":"d6130c594f82eefca5109421095dc8c0603b44c4c714bdb8956e64278c9c1625263a531a1ad401fa344f180c2f1cbe95af8246c9e33dc6a28316ab243f448591","ssdeep":"1536:qiVj2AhHm0CfrtrPr7AhhTQbdS6U8H2GXVxICl1gGqotJFFp4L/Xzbv9ALVTFCew:sAhhTQg6U8p45s5Q","tlshash":"c6f397309984202cf11bc5eae5d0abef32649801f663077ef66370a6d6c21ef577674a","first_seen":"2025-10-09T23:37:04.753197Z","last_seen":"2026-07-14T13:14:17.872244Z","times_seen":1167,"resource_available":false,"data":null}},"time_used":523,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":523,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/cover/kxmvip66com/departments3-7.webp","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.934Z","timestamp":1784034817934,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/cover/kxmvip66com/departments3-7.webp HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 37494\r\nlast-modified: Tue, 31 Mar 2026 21:09:09 GMT\r\netag: \"69cc37f5-9276\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37494,"size_decoded":37934,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 562x374, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"6123cd5b58b719ca86373f64db7f8f76","sha1":"dfdd243288f33829973552a35b1c03ae2c48d88c","sha256":"57983ed16af74422d7d4a173cfd875fe7e5887f84cb1d0c2b9ad0744405bb1ba","sha512":"7bc723faba28a04a3d445273e3e95e8d28065fbf2f9ee1a7330f211b11054e03dad1f58b6c6c82f0ddf7e24e3b2a757409a0f454e1036ea9cb91a387205dc197","ssdeep":"768:wGf3nDdVvRl5FM9q5mZU+/cC+JmXC1GJHXfss/ypy29MR:wITdpnoTUM0oy18HXkQy4z","tlshash":"09f2f1e552729d808d6ef38b8bc6c11af1f0e8bd07158b33e7bd995e07469d2f442191","first_seen":"2026-07-14T12:25:05.264124Z","last_seen":"2026-07-14T13:14:17.872978Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1546,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":749,"receive":797,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/cover/kxmvip66com/judge1-7.webp","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.939Z","timestamp":1784034817939,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/cover/kxmvip66com/judge1-7.webp HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 93020\r\nlast-modified: Tue, 31 Mar 2026 21:09:09 GMT\r\netag: \"69cc37f5-16b5c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":93020,"size_decoded":93461,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 656x369, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"fb79b5ca51c025b3d967c2dcef4725fe","sha1":"d356ca4432dce81d88ef84801154864699b0d3ef","sha256":"bd1705d115eda421e2b2491e0790ea5bdc5a067a16defa4d41db139a4b3609c0","sha512":"9349a5b9f16d54fee4371097eed989861c1a74c6789bf73b4430b54fe88ba896f5b4ed514bccec3e456c277453dee7e3f25bb4c8890d94fdea9b7b4657b77440","ssdeep":"1536:GLXsHn8uOO8UorLcv3TdFh+dc7f+LQZmoUITXf8kwXkGSGxxS+5YtoxB7:qsHnROjUorgv3TdFh+dO10W0knGNpYuX","tlshash":"b39312a843c7d842d838662f3f343b05e13a6ef4d91b29c6467ed63542863526372fe5","first_seen":"2026-07-14T12:25:05.255874Z","last_seen":"2026-07-14T13:14:17.874186Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1793,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":744,"receive":1049,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/cover/kxmvip66com/judge2-7.webp","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.940Z","timestamp":1784034817940,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/cover/kxmvip66com/judge2-7.webp HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 68266\r\nlast-modified: Tue, 31 Mar 2026 21:09:09 GMT\r\netag: \"69cc37f5-10aaa\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":68266,"size_decoded":68707,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 742x494, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2c376296fe20331c992b8dd9fcce1670","sha1":"45548f14fd31dd745d655753ee3640ba10b16eee","sha256":"0ea201d75894a56fc881ada6ea1db05de5433d51019c60722abad62d9fc24a10","sha512":"24e3000be5580391eea21e9bf17b93da1d5b439fe25da7475972c7dcfa08a5fb4954818a9e6bfae62eeff9ab1d6c37ead5f25466a11e7ffa8baa2bbfdf388de8","ssdeep":"1536:nElkyDOaxbCzkwP4pzQsGbh6iTMZf4TS+wKDUQSqF2xp6ED9:wkyDOsuz4pQsk5MZf4TS+7DjEp39","tlshash":"34630235369e81ba8e5b30f9002a76bbcef460830de33dda45a5738699c1697ec67017","first_seen":"2026-07-14T12:25:05.296541Z","last_seen":"2026-07-14T13:14:17.875156Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1793,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":744,"receive":1049,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"156.227.82.66:61194/","fqdn":"156.227.82.66","domain":"156.227.82.66","tld":""},"ip":{"addr":"156.227.82.66","port":61194,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:38.766Z","timestamp":1784034818766,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Jul 2026 03:07:03 GMT","end":"Fri, 17 Jul 2026 19:07:02 GMT"},"fingerprint":{"sha1":"EF:76:80:9A:D8:A0:C4:0B:CB:63:2A:A9:E6:A2:21:9A:E2:4F:39:85","sha256":"83:16:2C:4D:25:BD:83:B8:09:36:3C:BE:E0:EC:FB:17:57:92:B2:45:98:3E:26:F9:76:6F:60:32:42:F2:4E:F6"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 156.227.82.66:61194\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:40 GMT\r\ncontent-type: text/html\r\nlast-modified: Tue, 24 Feb 2026 12:58:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699da065-2022\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8226,"size_decoded":3050,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"37e7d1f52c08e5cba53549061a088fc5","sha1":"28c3261f8d0f8046ea8bfbcc0ad0e27c80b4dd5f","sha256":"16fe2998b51bd69b9259cb4d1045e4053b99d36368c45efc805240deebc66f0b","sha512":"e64d59f26fc94e14d5b925894cfcdeace55b2bdc48a749ef9b1a7043df551479d55529bf533bc94d68d5f5f071d501c5cfef7fa3eb13fdde26bdcfeb5f3cc85e","ssdeep":"192:irnMZjBPCpnDZ0CPBfE/k1mp6rPlyJzmRF4sArt+:ljmX7Art+","tlshash":"d602761661d3115b292291a66fb3171b6664d407c20bc9a97fcc15cdef89ac9c8a738c","first_seen":"2026-03-01T01:18:02.551716Z","last_seen":"2026-07-14T13:14:17.875975Z","times_seen":361,"resource_available":true,"data":null}},"time_used":1990,"timings":{"blocked":0,"dns":0,"connect":1249,"send":0,"wait":245,"receive":0,"ssl":496},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/fontawesome/css/all.min.css","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.901Z","timestamp":1784034817901,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/fontawesome/css/all.min.css HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 01 Jul 2025 14:17:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6863ede4-1907e\"\r\nexpires: Wed, 15 Jul 2026 01:13:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":102526,"size_decoded":23308,"mime_type":"text/css","magic":"ASCII text, with very long lines (52276)","md5":"c43cd173eeeba2f72aa6b431d06b8c07","sha1":"427a692f7f39eabb3d5b8510aee2743025daf813","sha256":"c880eb3d25c765d399840aa204fec22b3230310991089f14781f09a35ed80b8a","sha512":"02f6f6422b83104bc1e1b64961d7edda63635528417ed2dd3c6f0527457b8ab4cb43c528d2a70fc61e0f96aec6e6d1a6d2b53ed523e1568b6d78ba41111c1393","ssdeep":"1536:vwMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPG9ZpgmLCq:P709gMGFiyPG9ZimLCq","tlshash":"4fa3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2024-01-04T18:36:36Z","last_seen":"2026-07-14T16:30:36.632945Z","times_seen":12845,"resource_available":false,"data":null}},"time_used":781,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":781,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/cover/kxmvip66com/hero-7.webp","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.930Z","timestamp":1784034817930,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/cover/kxmvip66com/hero-7.webp HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 60106\r\nlast-modified: Tue, 31 Mar 2026 21:09:08 GMT\r\netag: \"69cc37f4-eaca\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60106,"size_decoded":60546,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 675x450, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"1152d543e3269e97cee14589b08c9e91","sha1":"85221e20f4dd29ef25b140189092446ae8902f0a","sha256":"388172590e0a6d2f17ce1658c59d9cecee5d745e734eae84ba82225e1119fe19","sha512":"89b9087f3c3bbc22e24c6afa04509a7cfa1473cfff92fcad58d3e38e9ed381d125a3f5edc703c8e3824d73d15cd2df78b9e78f8a14a73a02374fdfe40b5a8d91","ssdeep":"1536:0oU/Q7XJIhw8IGxK8saav6OH/82xbHPU2UBaeTJlt9z:Dl7fMK8sa4tT74JXV","tlshash":"f94302f39ed40b1eb619adb045850d8d83d9238108b9028c7fe279eb76303b797b624d","first_seen":"2026-07-14T12:25:05.292219Z","last_seen":"2026-07-14T13:14:17.877392Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1016,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":753,"receive":263,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/cover/kxmvip66com/departments2-7.webp","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.933Z","timestamp":1784034817933,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/cover/kxmvip66com/departments2-7.webp HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 124168\r\nlast-modified: Tue, 31 Mar 2026 21:09:08 GMT\r\netag: \"69cc37f4-1e508\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":124168,"size_decoded":124610,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 607x402, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0d075053714ab73ff5fb977b624dc1d7","sha1":"286822b0d11fa5ce5e222143fb12589185b89155","sha256":"b0ceedcc3134b4c748f752eaea8d9894115cc0d397a4f4aab4f1b1780536a91c","sha512":"2263c234bbf003ca9b214e1b19108261db570f3d63b07d7fb50b2fcbb2a1603beba711c93f78879ee6255ddbcfc3bc215330103412b5db1708ef46c9af3ebc41","ssdeep":"3072:M1gmt+7gH41OlMy5WvcQI4CATP5NXrvMeRSDwBdGQEBPuwGT9W:M1gm2W41AYkQfDnMe0wqkzT9W","tlshash":"14c31292e41ed636c54e7f8fb80bb21a3fa745dcf94ae1604010f0bde2f6a128424d76","first_seen":"2026-07-14T12:25:05.294511Z","last_seen":"2026-07-14T13:14:17.878556Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1798,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":750,"receive":1048,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/bootstrap/js/home.js","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.921Z","timestamp":1784034817921,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/bootstrap/js/home.js HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 14 Jul 2025 03:49:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68747e66-16aa\"\r\nexpires: Wed, 15 Jul 2026 01:13:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5802,"size_decoded":2266,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"16c93ef01acd14ec64c07020d638253e","sha1":"9c7b9d1a61977675c7f128bf2e27093d3cfe37f6","sha256":"f0795e9620ff382d585e15e40f303b394863fc5fa3dbdecd140adcbc4e51ffd2","sha512":"218d41ff60e128ff13105f9d376cfac1b80401527884da7b6179bab1fe8e9aa9e5959873bc5385798c8a5c6fb7aedce8e68b17112833cc16c096e0dc214d35ea","ssdeep":"96:6P7fgtAVMsSMCM1vUrp8KtQJQ1l/2o3RV0uRC6v6qyS+KQkIF:6P7fg+VSVAvUr2KaG1Zd3YuRriqyDKQH","tlshash":"91c1551a62b42433447775bb97af57c477212087b8c6ec393dfcc6080f845aa59f1aea","first_seen":"2025-10-09T23:37:04.756251Z","last_seen":"2026-07-14T13:14:17.8791Z","times_seen":1178,"resource_available":true,"data":null}},"time_used":761,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":761,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/cover/kxmvip66com/departments6-7.webp","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.937Z","timestamp":1784034817937,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/cover/kxmvip66com/departments6-7.webp HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 105182\r\nlast-modified: Tue, 31 Mar 2026 21:09:09 GMT\r\netag: \"69cc37f5-19ade\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":105182,"size_decoded":105624,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 721x480, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b83c003f30fe22eeff5861253ff7f2ff","sha1":"31377f498ef94f19e83634cf007761bc342f6d00","sha256":"2b8f0fbcadde321dec6ba2b76802a7d40be5e9858b6a524f36f1d11ca4689289","sha512":"6d448ead659b2af7f88bad426e4d5edd167665e3cafc9bdcea90bcd8d7455180a5c3a60d050a3da93f4b9a0b7d8ae437704873384c7a01821fc2e6022debfcc1","ssdeep":"3072:z+h5+Ln4Y/ZQw7C+FqhoRhTeZm/fxx2wBV:+wUYiaTFqhoHeK2wBV","tlshash":"bea313c249938c2c8ad255990e679ce54ebc8bf3ec36bf018bd795cc0550584efae5ca","first_seen":"2026-07-14T12:25:05.246811Z","last_seen":"2026-07-14T13:14:17.879855Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1796,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":747,"receive":1049,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/cover/kxmvip66com/footer-7.webp","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:38.709Z","timestamp":1784034818709,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/cover/kxmvip66com/footer-7.webp HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 119996\r\nlast-modified: Tue, 31 Mar 2026 21:09:09 GMT\r\netag: \"69cc37f5-1d4bc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":119996,"size_decoded":120438,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 680x453, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d8c50ef6629a71330b58b5ba4299ec08","sha1":"1e3a7df72aa8739b0c98afbcf033c265038962f9","sha256":"291cb5f32cef3df2086421d0de1cd108aa3df38e4cc557f577a62b8e34fc7fe4","sha512":"fc5e3a35cbde441789c1b4abf0b241514353f44804725bd7dc9b4ef9f798e0e0ec316d990a84ff6b12330498f86b575114ab69d2a2ce68e11f56db84cf4b8b23","ssdeep":"3072:/4Nx+M8F+C2Wd1lOVAzDl5gL9XfP4W+9gWsmHYIFY6V665DjS:QTJoHROtP4WUsm4tUPa","tlshash":"e9c3123c82a39dccce618c16dd7f777d402c0649079f962691d642d535f392a736ba38","first_seen":"2026-07-14T12:25:05.301117Z","last_seen":"2026-07-14T13:14:17.880486Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1021,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":499,"receive":522,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/ico/favicon7.ico","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:39.867Z","timestamp":1784034819867,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/ico/favicon7.ico HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:39 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 16958\r\nlast-modified: Tue, 08 Jul 2025 19:42:24 GMT\r\netag: \"686d74a0-423e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16958,"size_decoded":17400,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel","md5":"8f8443b45f6d99f4bc756e2f73662b41","sha1":"cdfd906b9daee3eb00ab28eea70b707242bf6b07","sha256":"ef5ddb495b2d2a4f88e3fdb442e3bb0dfd2090b0c788fb1ef6e91f06e070c593","sha512":"4afe820d897ff7b11d1aa5489cf3e58b9fb47af725ea83fedb536c3954ee6e2d7977efeb8a54eee1e6161de13ca775db1a2db99ef86f81ed8eaa0aa4947a6bae","ssdeep":"192:BFx9GVVbETq9G4/axnh5S4h8ja0i/WCdYIeokRrn9yubb1z/:D4wY/wjS4hV0i/WCirokFD9z/","tlshash":"f2720d49aa497202fa067bf0cbfd4ba1846ecd1d58f48c1f1db5bf6636662b7706c600","first_seen":"2026-04-15T00:19:07.097305Z","last_seen":"2026-07-14T13:14:17.88207Z","times_seen":17,"resource_available":false,"data":null}},"time_used":261,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":261,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"156.227.82.66:61194/static/picture/jinshapc.png","fqdn":"156.227.82.66","domain":"156.227.82.66","tld":""},"ip":{"addr":"156.227.82.66","port":61194,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://156.227.82.66:61194/","date":"2026-07-14T13:13:40.866Z","timestamp":1784034820866,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Jul 2026 03:07:03 GMT","end":"Fri, 17 Jul 2026 19:07:02 GMT"},"fingerprint":{"sha1":"EF:76:80:9A:D8:A0:C4:0B:CB:63:2A:A9:E6:A2:21:9A:E2:4F:39:85","sha256":"83:16:2C:4D:25:BD:83:B8:09:36:3C:BE:E0:EC:FB:17:57:92:B2:45:98:3E:26:F9:76:6F:60:32:42:F2:4E:F6"}}},"request":{"raw":"GET /static/picture/jinshapc.png HTTP/1.1\r\nHost: 156.227.82.66:61194\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.227.82.66:61194/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Feb 2026 09:51:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699d74b1-a334\"\r\nexpires: Thu, 13 Aug 2026 13:13:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41780,"size_decoded":42328,"mime_type":"image/png","magic":"PNG image data, 295 x 113, 8-bit/color RGBA, non-interlaced","md5":"1d2140363e0fda69f41537010f37ac74","sha1":"9f3791b6ade0a7966dee0253cb698564490e9440","sha256":"65ff8549228320f54f3d93e45194314c43c7cea541241876a57633bb5ac94f92","sha512":"75dd491fe42a57dee94c06e5e389323f0b32a584f3d0223845ea8f945ac9cff401e65cc381f4e8973dd78c14655abfff000186a770df78acddff35e6bb69fa86","ssdeep":"768:fUD/+JUtuV8Sp+uA5mBhYhXXy7I1VzKT26hq34ZhMNg1de0nGtXIIq5y7RYLIXK9:j2SYd1Xy7wVG66BvMNg60KXrsLB","tlshash":"3113f1a116d7074d278849fcda334deec406ab285d19b93ec5f68f34e3846c4d083a66","first_seen":"2025-01-31T12:39:53.036928Z","last_seen":"2026-07-14T13:56:37.349958Z","times_seen":802,"resource_available":false,"data":null}},"time_used":492,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":492,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"156.227.82.66:61194/static/picture/tycpc.png","fqdn":"156.227.82.66","domain":"156.227.82.66","tld":""},"ip":{"addr":"156.227.82.66","port":61194,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://156.227.82.66:61194/","date":"2026-07-14T13:13:40.873Z","timestamp":1784034820873,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Jul 2026 03:07:03 GMT","end":"Fri, 17 Jul 2026 19:07:02 GMT"},"fingerprint":{"sha1":"EF:76:80:9A:D8:A0:C4:0B:CB:63:2A:A9:E6:A2:21:9A:E2:4F:39:85","sha256":"83:16:2C:4D:25:BD:83:B8:09:36:3C:BE:E0:EC:FB:17:57:92:B2:45:98:3E:26:F9:76:6F:60:32:42:F2:4E:F6"}}},"request":{"raw":"GET /static/picture/tycpc.png HTTP/1.1\r\nHost: 156.227.82.66:61194\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.227.82.66:61194/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Feb 2026 09:51:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699d74b1-4d7b\"\r\nexpires: Thu, 13 Aug 2026 13:13:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19835,"size_decoded":20378,"mime_type":"image/png","magic":"PNG image data, 162 x 60, 8-bit/color RGBA, non-interlaced","md5":"9cccfc8ca4e4f50e4155a906a42666cb","sha1":"6687ef39ed3ba532124b8155234e819655ac0827","sha256":"38fa753bd6894fd8b0fdd94ba7e7bd9da32cb1e58017c44ce0147afba97b4841","sha512":"4e5e74b92841a16efc4cad516894bdaa1eca4ccdca290bcb36bbaa68cbe2011a6d12005f5bc2946532bbddc4e73161589ab3a296a734b78ad12aaa540bed9cca","ssdeep":"384:nC4JlgpsDv49JmGFnsvbCU5jAEVzJ0smbzRgZGme584WLMM0tq5PHcMV:Ccw9J9FybCUTzJ0smbZhwPH5","tlshash":"ba92e1cc99b518a51940f1dc2f338a48cfe9112c29e58776b1d377a2d94ae6f307c60b","first_seen":"2025-02-07T02:11:03.006958Z","last_seen":"2026-07-14T13:56:37.352921Z","times_seen":798,"resource_available":false,"data":null}},"time_used":975,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":975,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/e/dongpo/tz/tz.js","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.916Z","timestamp":1784034817916,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /e/dongpo/tz/tz.js HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 21:39:41 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a555b1d-486\"\r\nexpires: Wed, 15 Jul 2026 01:13:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1158,"size_decoded":1019,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"55a0a29ffe5995b25043ec5374a1fc07","sha1":"f90152d6f33878a1fb4dc90592ec1366a95a9a57","sha256":"c0f2d27aacf5c3d40d0dee1d2c56d0f7702578ff43d77f1d33d8d056658631c7","sha512":"8b1fc1c423fba549634792946353443d4a98b47e8fc8e62996ec3e2ff73e140e5a04e9e7224738666dea295ade9f2fdb05b55784855e7a2173cb592c2b88a216","ssdeep":"","tlshash":"7d215c7fae631154d11a91692bba676c3a3a001b6701c8307afcbe685f52f429847bd4","first_seen":"2026-07-02T05:57:33.789198Z","last_seen":"2026-07-14T13:14:17.885497Z","times_seen":6,"resource_available":true,"data":null}},"time_used":765,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":765,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/cover/kxmvip66com/departments1-7.webp","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.932Z","timestamp":1784034817932,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/cover/kxmvip66com/departments1-7.webp HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 54216\r\nlast-modified: Tue, 31 Mar 2026 21:09:08 GMT\r\netag: \"69cc37f4-d3c8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54216,"size_decoded":54656,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 554x395, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"14a0375cf710cab2991e307879a8819f","sha1":"3de351da086a4b95305b820270097dae6517a840","sha256":"f486253f2c5aa0fcaadf2df319a07c9f47cf0d3d6ca5b48da11a394a367a20ad","sha512":"0a5e02b64fc8263ef4acd4abf51705d6077e20e0f4975956abd0f39f72b6bab08c9ce569c49299c48d9c304210e6eedc9b7db5186e1945fcd72b6a6241a4f927","ssdeep":"1536:oBDm/O0aXGWuKUa9B+5DJU+WAcnswaO3FwmPOiJGQhRK:oBDm/bCluKUu+5XWNnZ3FZGiM","tlshash":"fa3302a7ca6f4109644e98be443eba7f6597ef1bd047d3023e345026348da5b2a77c14","first_seen":"2026-07-14T12:25:05.274104Z","last_seen":"2026-07-14T13:14:17.886753Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1276,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":751,"receive":525,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/cover/kxmvip66com/departments4-7.webp","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.935Z","timestamp":1784034817935,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/cover/kxmvip66com/departments4-7.webp HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 53024\r\nlast-modified: Tue, 31 Mar 2026 21:09:09 GMT\r\netag: \"69cc37f5-cf20\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":53024,"size_decoded":53464,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 621x414, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7ca57d2d5522e89c41d8f9ac9af01623","sha1":"5c96edcf29eefb9e5fcc63c5de59de5eda7a87f0","sha256":"f3af7e4f269af53e93c6ac274fa1ab0b0a3af64227fcbf22cc31a99357d5ed0c","sha512":"fc32d8ca99563c3fa0785ae5988d92fdd5ef8e39e70e9aa55db1593e00757390a140cab72472782a6f8158e64ce992e70f9ef581591ff14f546df7cfd2ba03f3","ssdeep":"1536:IJqolnIfMrnFLDT/kc7Xzc68qrmcdGNC/cq:IBn0qnFHTMH+rRb/cq","tlshash":"d43302a746812be1f3d9871e292dd6907a21816c0d6dcb1d1fb4ac6acd22c7f3a4cf11","first_seen":"2026-07-14T12:25:05.304726Z","last_seen":"2026-07-14T13:14:17.888755Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1547,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":748,"receive":799,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/cover/kxmvip66com/judge4-7.webp","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.942Z","timestamp":1784034817942,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/cover/kxmvip66com/judge4-7.webp HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 92912\r\nlast-modified: Tue, 31 Mar 2026 21:09:09 GMT\r\netag: \"69cc37f5-16af0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":92912,"size_decoded":93353,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 751x500, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"163581e8fa2cf4cd52bf68440e0d0057","sha1":"e45a192cd480626638affa90cf95940dba8564bd","sha256":"b7f535ab6351ea4eb9c228a7d23cc9584f5b6caa1995c968891f592c5a87f7a0","sha512":"1008eb42fe612bc022450e01a5f8acf9037040e94fc8c63f7732036ea7c520129a3ccdb2f5a34a47f2dd226d2289d892bd456e6edfec1942ec3decb83446b47c","ssdeep":"1536:K6fZh1bnFS1TIbE2F7yffFm3cI0IBx9tAZnifOJgjaanJfyCu6WIxsuH2896AkCW:Hb1Ls10bP7CfFUcYBztW3AJqmLdW89Z8","tlshash":"8e9313c87ad6990ee4e621f4362855bbf3aa6467c843af2c45e1d7ec35b24c451cfac0","first_seen":"2026-07-14T12:25:05.29876Z","last_seen":"2026-07-14T13:14:17.889902Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1790,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":741,"receive":1049,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/fontawesome/webfonts/fa-solid-900.woff2","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:38.753Z","timestamp":1784034818753,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/fontawesome/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/skin/fontawesome/css/all.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:38 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 158220\r\nlast-modified: Fri, 13 Dec 2024 00:50:06 GMT\r\netag: \"675b84be-26a0c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":158220,"size_decoded":158662,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 158220, version 775.1280","md5":"4a6591ab5460ae5cbff1ecbd6e52193a","sha1":"7cd8afd6501962fda35d66f0e4c3b8815ac471d8","sha256":"aa75998623a391e61c6901794ace832e3ecdd288b56d608f21bea0411acc0b8e","sha512":"96c5d3283b71613b595b6b0420333bef5d64451af05c59dde27ec5b3e7cfe6e9549c604cddfbcb79cbc0fd4cd6f2e22a130c9a220b1b7ef933ac9df8c8e695d6","ssdeep":"3072:RauSB5FANIRLpsBaBrJGNG3ECNQztRvHHqkqLrlF:guSqN6ptrJGo3POh9KT9F","tlshash":"0ef312a710c6b95684a3a51b336adeb52c3ed363fcb6cd73be340114689da9c2e4d190","first_seen":"2024-12-19T10:41:23.153533Z","last_seen":"2026-07-14T16:09:25.765935Z","times_seen":31592,"resource_available":false,"data":null}},"time_used":979,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":455,"receive":524,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"156.227.82.66:61194/static/picture/365pc.png","fqdn":"156.227.82.66","domain":"156.227.82.66","tld":""},"ip":{"addr":"156.227.82.66","port":61194,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://156.227.82.66:61194/","date":"2026-07-14T13:13:40.868Z","timestamp":1784034820868,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Jul 2026 03:07:03 GMT","end":"Fri, 17 Jul 2026 19:07:02 GMT"},"fingerprint":{"sha1":"EF:76:80:9A:D8:A0:C4:0B:CB:63:2A:A9:E6:A2:21:9A:E2:4F:39:85","sha256":"83:16:2C:4D:25:BD:83:B8:09:36:3C:BE:E0:EC:FB:17:57:92:B2:45:98:3E:26:F9:76:6F:60:32:42:F2:4E:F6"}}},"request":{"raw":"GET /static/picture/365pc.png HTTP/1.1\r\nHost: 156.227.82.66:61194\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.227.82.66:61194/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Feb 2026 09:51:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699d74b1-2255\"\r\nexpires: Thu, 13 Aug 2026 13:13:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8789,"size_decoded":9332,"mime_type":"image/png","magic":"PNG image data, 189 x 44, 8-bit/color RGBA, non-interlaced","md5":"e0c9d379cd4926e815abd7d25c32f5e4","sha1":"e9a1fb55262d96495f14da278c7242cc3fda956b","sha256":"7b50586f667edbeb0c3d573a44d40742354c385a2d7ae1971aa4b0173c11173d","sha512":"519aaeff0baab73e269e86413df78c8563728cb4b1f17e448877c4853a726df366f201b9e869078a4fa460517530a84b5ae9da4290511aeb4d0b93aecb9ac99c","ssdeep":"192:6ZTS99EegUNgEBTJ35PgUUxiKlqSvxV5mG5pqghmCoTHV0:2YzgogEr35Y7cK1YGmAMT+","tlshash":"1e02a0bc5a62079b3d1aa9f8172c54f1fdd070eb411f7c99947d201b0c68a1c83af4a3","first_seen":"2025-01-31T12:39:53.02929Z","last_seen":"2026-07-14T13:56:37.351732Z","times_seen":803,"resource_available":false,"data":null}},"time_used":735,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":735,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"156.227.82.66:61194/static/picture/xpjpc.png","fqdn":"156.227.82.66","domain":"156.227.82.66","tld":""},"ip":{"addr":"156.227.82.66","port":61194,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://156.227.82.66:61194/","date":"2026-07-14T13:13:40.870Z","timestamp":1784034820870,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Jul 2026 03:07:03 GMT","end":"Fri, 17 Jul 2026 19:07:02 GMT"},"fingerprint":{"sha1":"EF:76:80:9A:D8:A0:C4:0B:CB:63:2A:A9:E6:A2:21:9A:E2:4F:39:85","sha256":"83:16:2C:4D:25:BD:83:B8:09:36:3C:BE:E0:EC:FB:17:57:92:B2:45:98:3E:26:F9:76:6F:60:32:42:F2:4E:F6"}}},"request":{"raw":"GET /static/picture/xpjpc.png HTTP/1.1\r\nHost: 156.227.82.66:61194\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.227.82.66:61194/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Feb 2026 09:51:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699d74b1-5800\"\r\nexpires: Thu, 13 Aug 2026 13:13:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22528,"size_decoded":22814,"mime_type":"image/png","magic":"PNG image data, 183 x 55, 8-bit/color RGBA, non-interlaced","md5":"c53d923594566be7e0e41e8d720c0ac0","sha1":"e16a4b701d10291bbff90178e8b0d5f576e00821","sha256":"021994557d1d9642fdc16a0d8f6e471bec81bea7f366de6ef631f536c165418b","sha512":"554f7d6d44d26905610a65e21bd157ec30fef501c356e97787deca22f9089216f59e284f0effab7b18da89134af594d4ffd5eed889b1b5a4d5a5412456b9832e","ssdeep":"384:QfchEzlZmrXTjUDkJe2tERBxq2ceTdr1lFJ3d2Oo+UQSYJshjRHXvcQ:QfchEzrmrXTjUhP42cKpFJ3lo+UHYa//","tlshash":"fba2e0f1f36ff1b54a924d554cf8e2b080978942e088ee6135cb204acade8d31d993e7","first_seen":"2023-05-07T20:04:35Z","last_seen":"2026-07-14T13:56:37.352315Z","times_seen":942,"resource_available":false,"data":null}},"time_used":734,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":734,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"156.227.82.66:61194/static/picture/wnspc.png","fqdn":"156.227.82.66","domain":"156.227.82.66","tld":""},"ip":{"addr":"156.227.82.66","port":61194,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://156.227.82.66:61194/","date":"2026-07-14T13:13:40.871Z","timestamp":1784034820871,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Jul 2026 03:07:03 GMT","end":"Fri, 17 Jul 2026 19:07:02 GMT"},"fingerprint":{"sha1":"EF:76:80:9A:D8:A0:C4:0B:CB:63:2A:A9:E6:A2:21:9A:E2:4F:39:85","sha256":"83:16:2C:4D:25:BD:83:B8:09:36:3C:BE:E0:EC:FB:17:57:92:B2:45:98:3E:26:F9:76:6F:60:32:42:F2:4E:F6"}}},"request":{"raw":"GET /static/picture/wnspc.png HTTP/1.1\r\nHost: 156.227.82.66:61194\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.227.82.66:61194/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Feb 2026 09:51:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"699d74b1-1eb7\"\r\nexpires: Thu, 13 Aug 2026 13:13:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7863,"size_decoded":8406,"mime_type":"image/png","magic":"PNG image data, 172 x 60, 8-bit/color RGBA, non-interlaced","md5":"6e6f3e6c749737e6c347ec25d39b3eb1","sha1":"076c805bf394c7996a58202e333827837c8b1378","sha256":"391138ddf53bc321563b3d17fe0f37f5b40efba65fc661dbfa239a2b2184ec65","sha512":"b4621a8e30b49a48b1b13e9582c260b02d42ab2cc2509d59e56cf85028eec3dd165e255dff5c61e689ad8b4eaabe74852185efb2764da5c0ec1133a2ccb02a3d","ssdeep":"192:FQSFq7yL2y34yuuSzYUfBY2kCf9pDnA3+O07Zu86U9S0aN:zFjLX3u1YU5sCzA3hEu86sSLN","tlshash":"26f1ae6b1553fcb469dda7e92063af6082136f48b0077a12fb2b29748135fe5f44aa13","first_seen":"2023-09-28T01:03:26Z","last_seen":"2026-07-14T13:56:37.35449Z","times_seen":826,"resource_available":false,"data":null}},"time_used":733,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":733,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/bootstrap/css/bootstrap.min.css","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.897Z","timestamp":1784034817897,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/bootstrap/css/bootstrap.min.css HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 01 Jul 2025 14:17:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6863ede4-38a52\"\r\nexpires: Wed, 15 Jul 2026 01:13:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":232018,"size_decoded":32331,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65342)","md5":"50c95aae1a6c1e089c11681d1e1906f8","sha1":"a65e4fd8db9bd0440de2d6d73c9e7cd00fce4a8d","sha256":"cd1826581e4f2b80af4f1e05897b316c7698441063cffaefbbdeec382ee4cd72","sha512":"7f0edff9370c8d36fb6e96cb25994ff20d98e17702c85656f2ecbc1ec459b07fd2c1b330d2994a1c51ebf7d0cdde5d3856c60dc2fce27145ffeaababbc8c5bc7","ssdeep":"1536:v9xnXGi9GfJkfvq5wlP7cQZDR9uvV982sYRElV6V6pz600I41r:HnXp9GfrV98II6V6pz600I41r","tlshash":"d03482d6f590317d9ca7c1499681fefd896fa985cb120aa6f003776807cabd30962dcc","first_seen":"2025-06-19T07:12:41.126365Z","last_seen":"2026-07-14T16:19:02.726769Z","times_seen":2592,"resource_available":false,"data":null}},"time_used":264,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":264,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/swiper/js/swiper-bundle.min.js","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.920Z","timestamp":1784034817920,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/swiper/js/swiper-bundle.min.js HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 02 Jul 2025 15:58:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6865571e-22512\"\r\nexpires: Wed, 15 Jul 2026 01:13:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":140562,"size_decoded":40121,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65283)","md5":"21b78ba7133b3d67cf8b09cd6a26d386","sha1":"ea59f37b232db6dee2694078bf21e153a09bacdd","sha256":"6f9df49fe12f77b66daba876cb33b7090b2443f570a2a4b9541cddd705440aa5","sha512":"dc48bb38f168f37930ddc3db0cb78b867fd817cb5907b56cf2c7e58b407f2847a4bab78be5ea2c0deb216052020afb782bc8b4c948a5fe52b77128a27365a392","ssdeep":"1536:TIJQfGP7LP8NEuWGKF+IlzholxU/2Bkt+9SD8jv1nTHlU9ymp8Mj0HEOS5hAsVuZ:0JCN+TXD2BkQZFU9tp8Mj0k95h5cpnv","tlshash":"02d3f8896221b57646e316db93e4c221a3b50544b80ac8f470bd4c9f597ec9813feffa","first_seen":"2023-06-14T11:52:48Z","last_seen":"2026-07-14T16:20:56.910192Z","times_seen":5276,"resource_available":true,"data":null}},"time_used":762,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":762,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/cover/kxmvip66com/about-7.webp","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.931Z","timestamp":1784034817931,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/cover/kxmvip66com/about-7.webp HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 115048\r\nlast-modified: Tue, 31 Mar 2026 21:09:08 GMT\r\netag: \"69cc37f4-1c168\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":115048,"size_decoded":115490,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 641x426, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"fd270112c35bd4d59a39441c4f4a711b","sha1":"f5115a1f740d3ed2a54cf472fa9d240fdecbef59","sha256":"826d5cc70fd5d037b507a001da49dbc0251862ef69cde332def6acf7fd434a78","sha512":"6adf436134ee50ba11e75e0afb1486b678e431ef72267b501f9f123621f6c63f6111f870222429e5dea01c33fb87a015607fc22553e09e4b33a159ff318e5d07","ssdeep":"1536:XTk7BAr0RITncJ5B4WembenmY3RQmu18Wd8WPG8JqAmxO+yZaJHEQt6H5r8mGmUu:XT4qcXSN/lumu1nMkqAmfLkx8m+qKkl","tlshash":"72b31298aa8076b0016d554b3730da7d7b76c083397192ad5b22a780f6cae643f0f47f","first_seen":"2026-07-14T12:25:05.261235Z","last_seen":"2026-07-14T13:14:17.895458Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1800,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":752,"receive":1048,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/cover/kxmvip66com/judge3-7.webp","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.941Z","timestamp":1784034817941,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/cover/kxmvip66com/judge3-7.webp HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 54380\r\nlast-modified: Tue, 31 Mar 2026 21:09:09 GMT\r\netag: \"69cc37f5-d46c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":54380,"size_decoded":54820,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 782x521, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"6b1b07e4044d7e223eaf3b8298f62ece","sha1":"57bd4157b7b9b1e1ae3b504472c666911c338f36","sha256":"b9c58af92eca01cdd767f114780edd074ba79d68f7e535d9aa923b08ba66fb31","sha512":"e12c60c81099b221aa4c7c8a53f9948983a6b1b5b9f42939bc5e562f2cd073ff453e91f6cea8f362050462d914e6bf86091b86834ebae5173f47e8a0613b757a","ssdeep":"768:ch1vqYEccGcUN1chm+nnbMNJ1Y13E7SvDNaiHyzGTlHrFeQHvlddU1pROCoIrp:c3qVccwYmgb107SbN3SzGTlHTdrAOC71","tlshash":"c333024b5c96712900df0ca8782419aa5d415fe4b396cf7fb39ef9a08d5868338b701e","first_seen":"2026-07-14T12:25:05.278161Z","last_seen":"2026-07-14T13:14:17.89609Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1543,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":743,"receive":800,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:38.997Z","timestamp":1784034818997,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-14T16:18:33.588625Z","times_seen":17241575,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"156.227.82.66:61194/static/picture/1552215839168.png","fqdn":"156.227.82.66","domain":"156.227.82.66","tld":""},"ip":{"addr":"156.227.82.66","port":61194,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://156.227.82.66:61194/","date":"2026-07-14T13:13:40.876Z","timestamp":1784034820876,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Jul 2026 03:07:03 GMT","end":"Fri, 17 Jul 2026 19:07:02 GMT"},"fingerprint":{"sha1":"EF:76:80:9A:D8:A0:C4:0B:CB:63:2A:A9:E6:A2:21:9A:E2:4F:39:85","sha256":"83:16:2C:4D:25:BD:83:B8:09:36:3C:BE:E0:EC:FB:17:57:92:B2:45:98:3E:26:F9:76:6F:60:32:42:F2:4E:F6"}}},"request":{"raw":"GET /static/picture/1552215839168.png HTTP/1.1\r\nHost: 156.227.82.66:61194\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.227.82.66:61194/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 07 Jul 2026 09:25:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a4cc600-b63e\"\r\nexpires: Thu, 13 Aug 2026 13:13:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":46654,"size_decoded":46901,"mime_type":"image/png","magic":"PNG image data, 1125 x 630, 8-bit colormap, non-interlaced","md5":"3dda79b55c5295df032d46aa45a92091","sha1":"b943ea4cfedc16aaaeb004c35655279758a79d7d","sha256":"f4e477a563baefc7c098aa5d645cd9e01b357764c9e8b40da49b348d91065f39","sha512":"c67334c095889d88d11c3741ba2a350976091d6150a1f5a537c67ca689a55dac3ccc6ce46b6a40051cb463fd4cd97e4e2de13beb7252b550994c06d5ba370f15","ssdeep":"768:s2+3QKxRbzHyMivDCxNx6xCdeU//NCOtOGMP3ClUIEFIbbpez4L8ph18pXQmVRI/:strxRbeMJh//NCbalDE+pezt18ZQ6i","tlshash":"552302be9841a0c3ec485233df2b3c1a79efe9b75a3f7586205994181d721ca0154fdd","first_seen":"2024-02-21T00:22:35Z","last_seen":"2026-07-14T13:56:37.355549Z","times_seen":719,"resource_available":false,"data":null}},"time_used":973,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":973,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/bootstrap/js/bootstrap.bundle.min.js","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.918Z","timestamp":1784034817918,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/bootstrap/js/bootstrap.bundle.min.js HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 01 Jul 2025 15:41:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"686401bc-13bb5\"\r\nexpires: Wed, 15 Jul 2026 01:13:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":80821,"size_decoded":24588,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65299)","md5":"21d4551af5cc4ed4d818bdbdfea8c358","sha1":"df272a07ed30eaf8025b699c45736ba9d284e4d4","sha256":"35f4547d9364111aca4850347356bc5660a994f0d8b694d88f995098a7b547fa","sha512":"4dcd22faf4688265f834deedb8b6d07c1c5af0991f512031485573994df59d5747ca21c494f3f2d9c59f15a7260892b0d15aa8bebcca85d7764d24cc740c69da","ssdeep":"1536:/SwJiEbnTl6R2t49CFliFCIg/yWszSraJd5qUFH9tZwcE+iYZMgZdj:6wfs+SSO5q4tZwcEVYZFj","tlshash":"2383b5593244b8730ade85b68037430bf2265998b14b812cb57cadde2a7dcc67277f78","first_seen":"2025-06-18T01:20:12.005242Z","last_seen":"2026-07-14T16:19:02.709629Z","times_seen":2575,"resource_available":true,"data":null}},"time_used":764,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":764,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/e/dongpo/tz/tj.js","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.922Z","timestamp":1784034817922,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /e/dongpo/tz/tj.js HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:37 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 808\r\nlast-modified: Fri, 20 Feb 2026 16:17:53 GMT\r\netag: \"69988931-328\"\r\nexpires: Wed, 15 Jul 2026 01:13:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":808,"size_decoded":1327,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (554)","md5":"1bf60b5cf9c764caf9e85228dc7bfc33","sha1":"22b0d1971d7ec1ec3bb55ff4771752db18eab9ef","sha256":"1a32c475f692c3c84f550cc194a92fff3df6368293bbec3b8e67a42bc2d92306","sha512":"681c26eab518649736ea2c6302120b5a61e0b0749375c8933c7c890b6195de0c6e09a4184c9af8c5fd0f5e5eeda63ba803574bee4c44737899ccd18ce14c97c9","ssdeep":"","tlshash":"8601f11f7c25e13463921c2d23bbdadcf5ad2016101dc80654dec4ad6c34ff9042ab4c","first_seen":"2026-03-03T01:17:34.078046Z","last_seen":"2026-07-14T13:14:17.899267Z","times_seen":736,"resource_available":true,"data":null}},"time_used":1022,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":760,"receive":262,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/cover/kxmvip66com/judge5-7.webp","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.943Z","timestamp":1784034817943,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/cover/kxmvip66com/judge5-7.webp HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 189348\r\nlast-modified: Tue, 31 Mar 2026 21:09:09 GMT\r\netag: \"69cc37f5-2e3a4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":189348,"size_decoded":189790,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 770x513, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"2f453124ec43b619ae42cc94ce7e599e","sha1":"193c03b0c60961a1072bb4cf94a342808070c975","sha256":"2fa82a30e930e4a345c7ae0ab91e7981201d2d7619fdf1ed702c8df6c056a1a7","sha512":"ac09f5ffb997d57e208629b156b8a593146f14dc89e6ff4d90cb042d6101dfbee70a82f584bc43cc078ad1a2dddd5b7611b1d2bccf875ee66b960c05b02c2aaf","ssdeep":"3072:Ac/lIiDIgVRt648e6Y8S83PWgOETsjFH1M54iedfHue24EDORkfiunvk:Ac/WihHP6/ZW9/M+imH52w7","tlshash":"4b0412c25df79ecdc6c62894c4738e26abd15b98724618a8f0d242ea7d8530ffc07d98","first_seen":"2026-07-14T12:25:05.250886Z","last_seen":"2026-07-14T13:14:17.900086Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1790,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":740,"receive":1050,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"156.227.82.66:61194/static/js/link.js","fqdn":"156.227.82.66","domain":"156.227.82.66","tld":""},"ip":{"addr":"156.227.82.66","port":61194,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://156.227.82.66:61194/","date":"2026-07-14T13:13:40.861Z","timestamp":1784034820861,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Jul 2026 03:07:03 GMT","end":"Fri, 17 Jul 2026 19:07:02 GMT"},"fingerprint":{"sha1":"EF:76:80:9A:D8:A0:C4:0B:CB:63:2A:A9:E6:A2:21:9A:E2:4F:39:85","sha256":"83:16:2C:4D:25:BD:83:B8:09:36:3C:BE:E0:EC:FB:17:57:92:B2:45:98:3E:26:F9:76:6F:60:32:42:F2:4E:F6"}}},"request":{"raw":"GET /static/js/link.js HTTP/1.1\r\nHost: 156.227.82.66:61194\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.227.82.66:61194/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:40 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 14 Jul 2026 08:39:39 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a55f5cb-6ce\"\r\nexpires: Wed, 15 Jul 2026 01:13:40 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1742,"size_decoded":1170,"mime_type":"application/javascript","magic":"ASCII text","md5":"bf5f267e4a7265764a98c048168a4b17","sha1":"b25d35d1da8e51a5b64858f256ad37e80863e375","sha256":"940b573990b136b8e1e0e026bde106c8ffdebf8610dd8983c02eaae3bf70b765","sha512":"c9ad04a64c937140717b618c5f97b2f8cf8c216cbba39f092f7ee4a02f8aaa8f47f8d3ab1dd9fdb82c4f5289b4b6384ae548dbd352e48a1b19e3dab44fbf2d73","ssdeep":"","tlshash":"8731c058e6d038260e1748a7595b2c04b5a3400f7c0aec43f69d4ac4dfb172e4b7ace4","first_seen":"2026-07-14T12:25:05.270386Z","last_seen":"2026-07-14T13:14:17.901106Z","times_seen":2,"resource_available":true,"data":null}},"time_used":245,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":245,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"156.227.82.66:61194/static/picture/dfpc.png","fqdn":"156.227.82.66","domain":"156.227.82.66","tld":""},"ip":{"addr":"156.227.82.66","port":61194,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://156.227.82.66:61194/","date":"2026-07-14T13:13:40.874Z","timestamp":1784034820874,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 11 Jul 2026 03:07:03 GMT","end":"Fri, 17 Jul 2026 19:07:02 GMT"},"fingerprint":{"sha1":"EF:76:80:9A:D8:A0:C4:0B:CB:63:2A:A9:E6:A2:21:9A:E2:4F:39:85","sha256":"83:16:2C:4D:25:BD:83:B8:09:36:3C:BE:E0:EC:FB:17:57:92:B2:45:98:3E:26:F9:76:6F:60:32:42:F2:4E:F6"}}},"request":{"raw":"GET /static/picture/dfpc.png HTTP/1.1\r\nHost: 156.227.82.66:61194\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://156.227.82.66:61194/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 07 Jul 2026 09:25:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a4cc606-880d\"\r\nexpires: Thu, 13 Aug 2026 13:13:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34829,"size_decoded":35334,"mime_type":"image/png","magic":"PNG image data, 299 x 79, 8-bit/color RGBA, non-interlaced","md5":"cd8c9178b347f37c9bef76b8f675e3e0","sha1":"1e14408dd2512718208a674236ebbcb4442d3bef","sha256":"488ecf2fc34918b7a5e0c41b0538b6a6907d7f2f84e5df8e367b4b25f5efe454","sha512":"01b8e067c463405404750d9d892b5f6c1dbfd74d19800e7acf0bfcac4d2ed9d0ab7769788b68e518d4e2c31185829696b620b25d562655848747ac4df98395c6","ssdeep":"768:1KEXfnummCpkmHFV6NACX1aXu45xX6piNtn8MMIpO2jQ115gd8Wy:1Kmfn/mm0XcX/96wNtnDO2jQDOdFy","tlshash":"10f202dbfb6b16e89d851b6c21966c0c02c7869bc7fa94f1943a0c3256dce05a97cf90","first_seen":"2026-04-08T23:53:33.224031Z","last_seen":"2026-07-14T13:56:37.355049Z","times_seen":218,"resource_available":false,"data":null}},"time_used":974,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":974,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-14T13:13:35.165Z","timestamp":1784034815165,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:37 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23245,"size_decoded":7182,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (17501), with no line terminators","md5":"b6ec1fa3d6244eaaed5868f038a2e58a","sha1":"c4daa7baf48f3aae28113a5473116215509cf3ff","sha256":"d1c3455d685de59e60843d35c2c67538c40a4a83b76127fee8aa05236b5492f3","sha512":"366fd90f9d4ad5a9423e26234977d42aab91c8292992fbf00e1653c1fe4db7dc540910bfd153a0f8127f26cecf5a1c431854ff935767743fde1d5e0bf869302b","ssdeep":"192:/GmHOQeTi842M1+SbrvulQvYyxZGXXK/M9iSjopZoat4UHLL1RYBeppRgPj7z:/G2ne+yMMCrmsgnNiSjoYsn5eHz","tlshash":"e9a2e9767481787f02ab69edf3a0a78e30e3919ec9774a0667f497c80bd5c82cc5164e","first_seen":"2026-07-14T12:25:05.28452Z","last_seen":"2026-07-14T13:14:17.902521Z","times_seen":2,"resource_available":true,"data":null}},"time_used":2454,"timings":{"blocked":-1,"dns":350,"connect":1285,"send":0,"wait":293,"receive":0,"ssl":526},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/swiper/css/swiper-bundle.min.css","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.900Z","timestamp":1784034817900,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/swiper/css/swiper-bundle.min.css HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 08 Jul 2025 00:36:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"686c681a-4691\"\r\nexpires: Wed, 15 Jul 2026 01:13:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18065,"size_decoded":5358,"mime_type":"text/css","magic":"ASCII text, with very long lines (17812)","md5":"ea28ae0aaf82709381c57d6a7daa7a05","sha1":"a7c528dc9018aeefed9a52337168decb220e2f61","sha256":"af8545de3876815292506711e1369bff9dfe57ec7e04c45c3e1bdac48a11f3b2","sha512":"9c63402a957e06b7c365a6cf5f53baaba991953e7bfda99d8feeaf177db6a2782a28004b1d82df2dcde362d5556e4891f6da300d63cf13d816144dadb1920f66","ssdeep":"192:1VmUJbiKne0JlXZHZ+Sme+jexS4nxep/a2GZb0Q5nfufKlAYfg5fyeesedOJ9A5Q:1gUbe0JdZHZ+W+SFnZ24tlWfF4XYz","tlshash":"d08245a85340282753274f364b71cbb9dd7444d20f9389ae91c0ee48d7f6db9132f6a9","first_seen":"2023-06-14T11:52:48Z","last_seen":"2026-07-14T16:20:56.893036Z","times_seen":5915,"resource_available":false,"data":null}},"time_used":522,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":522,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/logo/kxmvip66com/logo.webp","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.928Z","timestamp":1784034817928,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/logo/kxmvip66com/logo.webp HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:37 GMT\r\ncontent-type: image/webp\r\ncontent-length: 4602\r\nlast-modified: Tue, 31 Mar 2026 21:09:08 GMT\r\netag: \"69cc37f4-11fa\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4602,"size_decoded":5041,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 400x140, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"87a594089f252b87bd3607186761a7b6","sha1":"32234bdcee8d4d37597fe8ea88c8d7099d05a40a","sha256":"c3fc6d9df554af0b1dd094541c5f61fe83c6858f550ccc196952de872f2c41f0","sha512":"5553343e3738a0a142d472923e683f4d8d01c41479eb0a7ce3725adc1bc7f2f94eb80d23d9b1fbc07b48c6f53ca79d9fb8b8c86c9caffcaee444087109885686","ssdeep":"96:5kSovc9807U+pH2FoS1LUa7UGBQpGXrOEHBIobTn:5gUe07U+pWNLt7UGBbrOEHBjTn","tlshash":"09918c20c360994b7ccf48781488adb0d43f4e93bde694da0d5ea26380602ced45acaf","first_seen":"2026-07-14T12:25:05.289658Z","last_seen":"2026-07-14T13:14:17.904249Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1016,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":754,"receive":262,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kxmvip66.com/skin/cover/kxmvip66com/departments5-7.webp","fqdn":"kxmvip66.com","domain":"kxmvip66.com","tld":"com"},"ip":{"addr":"154.89.77.211","port":443,"asn":142286,"as":"LUOGELANG FRANCE LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kxmvip66.com/","date":"2026-07-14T13:13:37.936Z","timestamp":1784034817936,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"blh0707.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 04:54:48 GMT","end":"Sat, 29 Aug 2026 04:54:47 GMT"},"fingerprint":{"sha1":"24:73:47:D4:57:61:B8:5E:44:0A:55:6B:B5:BB:8C:B4:C8:95:E9:D3","sha256":"FB:3B:45:81:8A:97:38:F3:F1:7F:3F:DE:85:A5:C1:59:CE:FE:2F:A6:0C:9D:FD:8E:F2:CC:AD:CB:BE:81:44:ED"}}},"request":{"raw":"GET /skin/cover/kxmvip66com/departments5-7.webp HTTP/1.1\r\nHost: kxmvip66.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://kxmvip66.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 14 Jul 2026 13:13:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 78706\r\nlast-modified: Tue, 31 Mar 2026 21:09:09 GMT\r\netag: \"69cc37f5-13372\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":78706,"size_decoded":79147,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 694x462, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9c288e4d46278b290ce534a582ec5b9a","sha1":"620fa6ef81b4eec2f2980e49ce95fac669771da8","sha256":"f1ea66c13052efe172c0eb7d110e411087cb3f5f1529f914a89775f61b8e0a25","sha512":"db0fde11d39463c31a9f07bb068e2b36c4a8f63766bec888d943996c45496fab10e5db4a702e6a3fda654e36c15cb555b359130f76e43583586f1497ee0cf961","ssdeep":"1536:AgberENzHFjraY9KOf+Hk03a3dCv+AUpPzKhIAh5c9IsOeWIuiwp3Jvc:Agbe4NzqLE0ErAU2IAhi9IHe9k8","tlshash":"f373129aa5a79bf260d881273c703f696dd4908d75e105c388bf87cc77411326bfa3a6","first_seen":"2026-07-14T12:25:05.265627Z","last_seen":"2026-07-14T13:14:17.904911Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1796,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":748,"receive":1048,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-14","alert":"Phishing Block","trigger":"kxmvip66.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-14","alert":"Sinkholed","trigger":"kxmvip66.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}}]}