{"report_id":"349ec258-f4f2-4145-a298-e1291c526e8e","version":6,"status":"done","tags":[],"date":"2026-03-30T12:22:49Z","url":{"schema":"http","addr":"ydnaz.ksa9noa1-sdoqd.com","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"103.250.7.203","port":0,"asn":132825,"as":"MYTEK TRADING PTY LTD","country":"Malaysia","country_code":"MY"},"final":{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"title":"Bet365","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T02:30:40.451427Z","times_seen":17982764,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"ydnaz.ksa9noa1-sdoqd.com","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"103.250.7.203","port":0,"asn":132825,"as":"MYTEK TRADING PTY LTD","country":"Malaysia","country_code":"MY"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-04T12:22:49Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"tposs.qiddfc-dqiod52d.com","ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2022-11-24","domain_rank":0,"first_seen":"2022-11-25T06:07:22Z","last_seen":"2026-03-29T01:47:43.175228Z","alert_count":0,"request_count":24,"received_data":3321724,"sent_data":11600,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"ydnaz.ksa9noa1-sdoqd.com","ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-03-30T12:22:55.806957Z","last_seen":"2026-03-30T12:22:55.806957Z","alert_count":57,"request_count":57,"received_data":11643792,"sent_data":27336,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"lf1-cdn-tos.bytegoofy.com","ip":{"addr":"163.181.243.175","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"domain_registered":"2021-01-11","domain_rank":402951,"first_seen":"2021-08-07T17:49:18Z","last_seen":"2026-03-24T03:36:48.728492Z","alert_count":0,"request_count":1,"received_data":238766,"sent_data":491,"comment":"","tags":null,"fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"0613846b8ded20dc32f9a63933c7f812","sha1":"e022c6e7e983e31791d143932cd5e4869da5fd02","sha256":"37d48c75943464be4352f8b209691fc3ee97e7212b81c19646f3f39aee72a0df","sha512":"61b67392d432ffd3ad4a2406f86a85e434047c228e55ad2b8d13018096fbc408c8934b657018359f7984b21fe74310d64d6c21eaace7397a79f9e310af755a7e","ssdeep":"","tlshash":"abc012c4b0d27a01960eab1615bf75e89029482774489f528de4dc582f1a0b09327ea8","size":186,"data":"","first_seen":"2026-03-29T01:48:00.270156Z","last_seen":"2026-04-08T20:55:08.942513Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"09795c36f598070a4877a8554cfca282","sha1":"7cbf71f9944d5cfa817855a20857ebb70dc9c7b2","sha256":"d54f185ac5a7d24a800cddccd6fa893d2d9468d64b2fe2edb4c2c4767931eed7","sha512":"35ba1e1cc5d686b838382f8593c76812f498cbd6dc156a2a863ce64f58dc167d94c1d37cf9a7e79150df6b6763a4bf47cd2d2bc0303b36bd18f19cc6115c199e","ssdeep":"","tlshash":"4cc080c570c67d0029066410117f34e89025503670481f43ccd4d8543f130b0d273e98","size":158,"data":"","first_seen":"2026-03-29T01:48:00.287404Z","last_seen":"2026-04-08T20:55:08.959791Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"a5746966fc9c08bc07dc5651c3057d2c","sha1":"8f8521e4a6721076f18ec6067754e857a026cbdc","sha256":"e579a19de508d1b8d5c12448ff9f3a2ad330cec031c194833605dcd3df85b12f","sha512":"5a83935592dee952dcd24942727c6e288c0362a10a0e8bd19ab9613d95c962ebf016371918c68aaea961e6d93ca6e412e1b992e0f2ce686c866692dedadc6eae","ssdeep":"","tlshash":"11c08cc4a0c22e106612a41150af38e49024442674481b028c94d8482e620b09233e98","size":137,"data":"","first_seen":"2023-10-27T05:38:28Z","last_seen":"2026-08-15T05:28:12.326729Z","times_seen":343,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/search-D0CeyGv_.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"4e499dddf30c74c8c431532f3edeb59b","sha1":"3308de5e7d47ddb3278a4bf72b1cb36c3315b3cd","sha256":"eacd894d27ab709ab4eebea064db3cdb0b19602adfc6b0bb8a9c49c411c4ab6d","sha512":"c996a33d8fee530f57b3acc75214f7b4735a86b310b1d8778bc677a53595230d61107244332db460216f9ee1710ae6f1785465209b73de62c714f6ba5081eda8","ssdeep":"","tlshash":"0831c7240e40a949daff23eedb1d7700fe8b9f4e213c11e8986c02493aeb6281093161","size":1493,"data":"","first_seen":"2026-02-24T07:43:44.829435Z","last_seen":"2026-04-08T20:55:08.824927Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"79c4f2ab22add649edf14804a564c1a1","sha1":"f319bdf193ab9b1f772f354dc73f061637f56d54","sha256":"6946e361e2179bd6b35603f646f00cdad6b970bd42accb5855c7b10881866f23","sha512":"98ef9fd9a123cc11efc54f4316c9baa2b5aa5107626677fde8e26e57794f183a78cddaeef14037b66b4337795562ac8346de8c418911895242d418c4fc8e81e9","ssdeep":"","tlshash":"17c08cc8a1c22d001656a41020bf24f8a028842a70481b02cc99e9492e220b49233e98","size":144,"data":"","first_seen":"2026-03-29T01:48:00.303123Z","last_seen":"2026-04-08T20:55:08.958016Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"c318ea082404e2c9c48bda70fd8f97e4","sha1":"ba699ee84ffa6d63239a0badc0c61b8bdb1e3dd9","sha256":"970c93e9d93f3cc518933858d245a61e06f7b829285e9d34a475b05bd70165f3","sha512":"7410a3d69eb3d525eaa61cc0513ca8eb8b4fdbe045cd3b6b99944cd5b030345937d95085e6ae2bd781cb632350b3b24682404f5098ef69662355642cbbff6c02","ssdeep":"","tlshash":"8dc022c1b0e2b9006205a512047f39d48029502ab5086f828e90dc3c2b130b48633eb8","size":188,"data":"","first_seen":"2026-03-29T01:48:00.281245Z","last_seen":"2026-04-08T20:55:08.951125Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"43a3abc8b84eae845b75b760eb1b622d","sha1":"5bef60057f3ccb494bed46950ba0236512f9a008","sha256":"f0917c64dcab72d69172a0b1f2cacdda41636ff28fc6c2872dbbd04e8375b228","sha512":"2f72af078b568b4ffdad58361d9f6b567c1606fb812609c5e647dd01587453b862f7c2d6108a660cc34967ebe2fad30728559f6036fbaa638bdf75a0a6a20d87","ssdeep":"","tlshash":"74c08cc4b2da6e64162aa92054ef35e8a0288426b18c5b02ccd4e8483e230f19337fac","size":160,"data":"","first_seen":"2026-03-29T01:48:00.283824Z","last_seen":"2026-04-08T20:55:08.95645Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"014a4e2be9d09fbec2184067f44ad1b5","sha1":"0fdaead392606ba1cc654d95328fbf13b6f13773","sha256":"ef32d7e49764dddff002ca7f4ace8258874872e19b9f7890658c5db968522e12","sha512":"213699be9db776ddb31577e808cf6f186475783199185a6de3d11f9266ef89b6cfb289b5f674e4f45a9045682e0f2ac261453e2ee2a0e229141b1913e6623b46","ssdeep":"","tlshash":"afc08cc7b0c23d101616a42828bf36e89224402bb04c6b43cde4e89c3e620b08233ee8","size":157,"data":"","first_seen":"2026-03-29T01:48:00.289888Z","last_seen":"2026-05-17T07:15:33.372922Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"17eff39af16aca9dff915fb79171c661","sha1":"335f7fc7ca17be11ffee6afc0e40a75a2a14a65b","sha256":"9ff74609194770f84c98be6648c5fb90b40ddc6b9370d3c2a73120879c5b589b","sha512":"c5a67b5982826bb016fe536c11676daa870f6369ce27db5b5e32558ab06f50ed627c09174c26ff2897b5846a2d09a6721a80351e18c49cc5a88ab2d1c7ee6116","ssdeep":"","tlshash":"e8c08cc4a0da2d101617a53128ef6ae89034402bb48c2b12dd94e8583e231f09637eac","size":164,"data":"","first_seen":"2026-03-29T01:48:00.301255Z","last_seen":"2026-04-08T20:55:08.959173Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"f03f91ef788632b29c7aa94e331f066e","sha1":"8999411b9ff2518fac848fd0959506d9e3d0ccf8","sha256":"53165a4101b3608851d449619b7db74af6901556d523a9d7f407820a50006eff","sha512":"264edebdfd949fdc2cbe212ca4cb2df953c166fba5fa2fc7ff4e8ca94f3c8f1998371baad6c9c70504b523cc271f8e94f60f3b9ee845f054bf2eb082193df567","ssdeep":"","tlshash":"39c08cd8b0e77d101606692614ef25ecd028542a704c9b92cdecd85a2e226b48237ea8","size":157,"data":"","first_seen":"2026-03-29T01:48:00.290791Z","last_seen":"2026-04-08T20:55:08.943125Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"6c55bb094c310755abe7b77379f22e7b","sha1":"2bcde280af732905ae9afa9a6c330375b2c2c920","sha256":"2b97d249509626c8acf083f787509ed07e9c07dfd40a0877ce47c3c349151b7f","sha512":"4d471369379c847ce97557221ce347bba8f3ab5e2613b1d61c0518ce1fb7948e00b69c0ad3779b606851270433cbcf1860b5060a725ab3f2e540e97698e87208","ssdeep":"","tlshash":"3cc08cc5b0c26d401602651014af78e4a0345426744c1b028ca4e8482e220b08233eac","size":142,"data":"","first_seen":"2026-03-29T01:48:00.285536Z","last_seen":"2026-04-08T20:55:08.930414Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"lf1-cdn-tos.bytegoofy.com/obj/iconpark/icons_15107_188.0655b3de50b840e93c985eac1507fc40.es5.js","fqdn":"lf1-cdn-tos.bytegoofy.com","domain":"bytegoofy.com","tld":"com"},"ip":{"addr":"163.181.243.175","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"5dba0af833fa015e329d6eb4310e7459","sha1":"11a409ebbc4676239563c05bbedfd4a420d43a4f","sha256":"72e6fc8be817e2b3aac9378f35b17114173704eba81fdc46a1ce4d57cc4cb8cd","sha512":"9425d5c7bdcd5874bdd3e6efd4d95b3f08c07d4adcf0193c1c07bab21206a1317f9e5991b2fad78fb6f09d306b11226454170d9e28b2eda3aba8b84976b48b87","ssdeep":"3072:Xv7GhAyLfr6ZpAVdUbGly8auCanDn+/kxbQ9fak13c8rLhDGrdco5g5DBuYb8ps:Xv71rig5NuYb86","tlshash":"4234fbe73360e06c368746759bfe7952221e739830c583b065bfc5f413635a8ea6bda0","size":237293,"data":"","first_seen":"2026-02-24T07:43:44.923887Z","last_seen":"2026-04-08T20:55:08.82443Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"c5a84a608dc01f5319bbb64bcdb330c9","sha1":"3df5956b9d3fab550d01aac4cb64988d04ecb21f","sha256":"50f2d4e2db17752ae0f88c8f8c723920666d43dfdccc0c7430fb5606eefddb5a","sha512":"67ecb987877863443adb5fe2fc89822b27148dd9ecec61b2fe870af0c79faa654c2128c67784cbcddb854e1b4b0368d9cc22cf5b5366975ed68e3fb41c34d39f","ssdeep":"","tlshash":"0dc080c461c36e105601651034bf38d490248436745c57129c98e8452d1b0f04137ddc","size":158,"data":"","first_seen":"2026-03-29T01:48:00.284745Z","last_seen":"2026-04-08T20:55:08.945755Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"ae2141caa5de8b932c966159221aa50e","sha1":"eac41ccef748c726f8348d6f38a1c19dbfccc9fb","sha256":"1002803c00103fcdc73a564cf566cbe9496416c2b92f24628f9ab180cfedb16f","sha512":"65df4e2147fa5680f3ef31769f2e529b3e5e7aa6a9a809b8122ff372364f2fd2014b5eef784ece54a92a95b97aea74eed27cf110d6ce78c537383a9d01c5e795","ssdeep":"","tlshash":"18c08cc9a0c22d105a02a85191bf34e49034802a74482b528c98ec482e220b0a237e98","size":146,"data":"","first_seen":"2026-03-29T01:48:00.279419Z","last_seen":"2026-04-08T20:55:08.929372Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"ba43b36694e0c7e6845073549849fa8d","sha1":"f798c2fd02bf1d9c9807f92de1e81d23da703cf9","sha256":"32a0ca2a6dbcbe39ec278c62ea383ad52f7f15267958d6b4606753a607bafba6","sha512":"14139e197559890ee9c24beb384266fe8cbf8d0a101dc835b0f425e3ac8d50e0657d873c71625ae76e1e7f08acbb0f52e1a20346ea3087d299a12192ec7ae153","ssdeep":"","tlshash":"f0c080c5a1c77e106e055411507f75e4d028c03eb04c1b539e99ec642d120b09133dfc","size":163,"data":"","first_seen":"2026-03-29T01:48:00.280265Z","last_seen":"2026-04-08T20:55:08.946397Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"8efb2721c60ab16f63771a2c52e5b351","sha1":"19df3d22bd6f41ac2d8d66a9d7838c680eeb70f2","sha256":"e196ebcf39ed90ab2fd3ff59e665768e4a8cd73fd5e5b2f37b11aba5c07af347","sha512":"ed5d06bc43377b18d4d75d8173ab52912bc5348ef9013a8982e6c901492196ed6411ff18f034d2fa3c4f69cb3812001702c26453bbe8c0b9a5572ad6d2fa72f3","ssdeep":"","tlshash":"39c012d870862d14961ab55255af26d8e064442770885756cca4d95d2d521f48237da8","size":175,"data":"","first_seen":"2026-03-29T01:48:00.302094Z","last_seen":"2026-04-08T20:55:08.930959Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"82fda33ee3944778eee325fe5cb01ee4","sha1":"a611fd8e22171fbc0fb7282639b4d62cef4a872b","sha256":"80b6072e894b583c874c9d33673e4f31dda16fc30141a550f4602144f4d4d4a7","sha512":"4a86e8dad775f2dd1067d67d0260d541e646a91041919027024975fa7295a78a6a4913eaa91a31649de8608481c04d63d27c4b4da0f95349e4fedf4dc6a1cd74","ssdeep":"","tlshash":"42c08cd4a0d63d2016027950a4bf28e8a038482770485b039cd8d89c3e320f8e233ed8","size":158,"data":"","first_seen":"2026-03-29T01:48:00.275318Z","last_seen":"2026-04-08T20:55:08.956987Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"6074cdc080eaf94bc4f4afafa99dc975","sha1":"e4e74d51defa6f6fb74daa0c9fdf575a122a6e39","sha256":"6a4ce697add90d0b92ba527742814dd2ac9f9e4af8edb83ebd0bdd349896a545","sha512":"9e9f203e2f04d43cd0c3cd6e4be22c6365253be2a0eff3a13106220e37cfb67fe85ad8a081a3384ccf29c1beb9000c1b57bd4a43f6956c253d3b1db0e5f45381","ssdeep":"","tlshash":"efc08cc5a0d23e102606642416af38e890284037b4482f438cd4d8892e220f08233e98","size":147,"data":"","first_seen":"2026-03-29T01:48:00.295498Z","last_seen":"2026-04-08T20:55:08.934303Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"2ceecbb35acd5515d30e99833548891e","sha1":"07b108c2e31c958630a5ace11123233a962b7a49","sha256":"a5584abafa801a7a7206aa8cb06c46eab0ec9b57fcbf16292575664f482102a0","sha512":"127f205fbe8e0b4d9f5c997de06b4fbbe34c60cf3ccb9bdc97636551e4bd306468c727082ca9a307745e94deeb3a64b32154e2c385802c6201eacabc5258fe8c","ssdeep":"","tlshash":"d8c08cc4a0c22d002602681020bf25e49024402670482b028c94d8483e230b09233e98","size":138,"data":"","first_seen":"2026-03-29T01:48:00.300389Z","last_seen":"2026-04-08T20:55:08.975601Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"e6d3e962516a71a5dfd71a82be0c690d","sha1":"86908949927e8821c59d075717fd46b833b053b0","sha256":"a454f39ec8ac4935f67d5a059a9d703a1e964c0d2c19b7761b5540e0467837fc","sha512":"2ce8924443a653845ff48a387d2f47966532e666108936ea27022dda3b5e350fe6bfb8212465fdcbda66966891556109da9bc53519138926eac452322e831685","ssdeep":"","tlshash":"8ac08cc4a0c2ad005a52642420afa9e890248026b0881b038d98dc982e234b09337ed8","size":155,"data":"","first_seen":"2025-03-09T01:48:23.102005Z","last_seen":"2026-08-14T15:35:23.905275Z","times_seen":25,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"3e7796d28de328930a765c8470f1cf3d","sha1":"5284004a8a4dde2db0ce65556b8a6eec2b0ef4bb","sha256":"46d03b30353980e9557e1aa16c2f2ab767bbc599faa662793914fada9bb9d468","sha512":"059d9f7cc7c222b3072019262abfdf32f97368aca7a266712141c3abadfa426af19f712ebc9a4959b1240ed8225c3e68a792b1d320ccec0f87a4b6977af24816","ssdeep":"","tlshash":"e731c28c9e9620927db3760d47af229424e3848b480dd0507a0da342afe191bc35edfd","size":1712,"data":"","first_seen":"2026-02-24T07:43:44.987485Z","last_seen":"2026-03-30T12:31:33.31193Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/RoulettePanel-C3FvhfNv.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"3bcc3f4927adac217e48dbbad3ab9671","sha1":"13056f4946bfc65a9936aa6337f0fde12d0ad985","sha256":"c58a3bbcf168ad2a6315c214dee07805255243b97f34385c83c1db2c386939ea","sha512":"5e43669cc4312ebd3798bb31cd76a4684b9ed7705aaece430fd0beb47e5f4ecfa12e854e94d943f5111ef5f10ac900e8530accf9dbae8c960cc3b9d93c77aaf8","ssdeep":"192:kzV7ToVAkPRTVQFUR4NXsby7yB3bexS96yG67:kzV7sukPvQK4yTpe096yGm","tlshash":"b5e17e88f1418d3b44a336c525a51045ae0cbb2bc364dfd5b329c5f027b3d2db2b666a","size":7030,"data":"","first_seen":"2026-03-30T12:23:10.13051Z","last_seen":"2026-03-30T12:31:33.063Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/RoulettePanelPop-BpCGoQ3j.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"057ac2318dbbfa7532b02ccbd17e8459","sha1":"cfb06a76517ffed4ebb35f7434453b1efe987599","sha256":"e0e5bb6fbc7d6fdb0232ccd9ec7ab6a78658aed91378d198c84facbf8470205c","sha512":"353c7b5d588635e76e97f173a7514ee33ebeea1e238d0dff5c3c60cf9a4b92faf95f460e89cd530d76407d155f8dc7c810b3fa23f4725f60283ba6d8999a66c4","ssdeep":"","tlshash":"a241864c713681b688674fdce41c08e1e40cb3c86230b9d976e9086a3a519e6943efad","size":1916,"data":"","first_seen":"2026-03-30T12:23:10.103293Z","last_seen":"2026-03-30T12:31:33.128959Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/HomeTimer-BA9-8c0y.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"2ab74e9a01032f38ff902d84509df202","sha1":"ff5d4e4d2cf4229865895fd906772fe3bfe278cf","sha256":"beed42411fb517208fc5dd5c3afc1a1837d92a1333f73f2619616902e8a51764","sha512":"8e472ef22b1458dd526cdf8ba5e3ad48ce56e130b3a26b75977a417370f5e210c4bf633db25cb01670e6aa5853695f145bf59a0fbbc7b0e40cf7a21019ef74fa","ssdeep":"96:iSjsLqDo743cLJDPhc+OyDDtMdDkFP6oKpWzwPYqdeHfiG40b0Gw5Zu7aI9DG:pjsLq874sLJDPO+5DtODghKpYwdd5G4N","tlshash":"6691d8ceb402f43a87f15858a45c0421610d7bab7070e8f5ea7fde9a2349e91b327979","size":4268,"data":"","first_seen":"2026-03-30T12:23:10.08085Z","last_seen":"2026-03-30T12:31:33.0019Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/ber-finish-6xQoqTKO.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"0f98b0616c69e7514f0b4c90c9d24667","sha1":"ff1ae970c70207426088b59362f7f3d7bbca7c62","sha256":"2249ce17b324b0cd28c4184e85d6565e059770b558be269d4c7e5e2d357733a5","sha512":"eed4b3c726ecd8a720a495ef0a48031ace59411640760e33b405803aa4dcdbd199b166844724dceffe71dd0b7a5f0992c31ab2d0eca2b7f4c373283ff3d07ec4","ssdeep":"","tlshash":"80615bb85a061e209bc34deeffa7b424fd185f27e3d2918002da5f242b1f5b69036021","size":3231,"data":"","first_seen":"2026-02-24T07:43:44.84853Z","last_seen":"2026-04-08T20:55:08.81672Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"ecad91e47aad2990bd4ebcaded1cc27d","sha1":"adb3aa2140939728a1c492a17255a82952c7fa17","sha256":"dd8632d5c9193e49c72e222fc527bdae43ab306548e5b0d99678fbbccc81a01b","sha512":"2974a3a1af0f458cac1e27846db3c0eb820c3e0c0ab84cee79e2967337a1aaab7e391e67db25aa2bceda317d209306713a02e101e8337ec2d43206f1db32ba27","ssdeep":"","tlshash":"eac08cc8a0c33d045612656150af24e8a028402771882b029d96e8592e230b4a237f9c","size":153,"data":"","first_seen":"2026-03-29T01:48:00.289104Z","last_seen":"2026-04-08T20:55:08.946963Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"137e23690abe1435c06e9107b68be228","sha1":"f669357f8ee74232766527518ce993fd21d319f9","sha256":"54afe9cae26f33f06abf68e8a3ee1b4f463a545f62622870cb4a651a03d12141","sha512":"46265b6ea779d36865b54017f8b145c5e63b8407454ffbca81a4f73628e4af34b31b783ae1b7e32893e23291fdb0ed0d39f64301914feff2ac63de48eddda525","ssdeep":"","tlshash":"59c08cc4a0c22d802602a51914af24e89024402b78481b038da4d8582e220b09233e9c","size":142,"data":"","first_seen":"2026-03-29T01:48:00.291565Z","last_seen":"2026-04-08T20:55:08.955218Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/ArrowUpOutlined-C6sQH91S.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"1958c93f38e06aea8a76453690e6e24f","sha1":"7ef404e81c7108fcf0ba9038094b1ab42cb1eab4","sha256":"bd60eef7372633c6ec4120a90a547abd4f173abe17a2dcc972d99b8fe10f30e6","sha512":"cee9d0c6bf8cdc7981b3b05e06b35e26a6fe061acc9a95115f66d47fb7f5fc90ed05006220b486f4be079345a2b84dfbf42485170fb927de03fc968b838f9032","ssdeep":"","tlshash":"7611055d3184bbf647928aa4442aa503f0196a2a145cf860af51c9e5f9514c6a09ff4f","size":999,"data":"","first_seen":"2026-03-30T12:23:10.131506Z","last_seen":"2026-03-30T12:31:32.963534Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/empty-white-BjL230TF.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"3dea6937be1184ad628dd27202632b04","sha1":"8604f80ccf3d36dea78d62cabeec77af0b0028cd","sha256":"6c8cd179af0cc07eca46ab0d96db2630262db825648aace79a811ece018fba41","sha512":"3be0784c2b202905376a8ad10c61efad7965ef25c408fdcaadf8f1f0b00568ec997763931c749a7567fa774904f27853aa189ccb39a4cdb314f925ee7856b200","ssdeep":"","tlshash":"4ab01281a80088b0511cf8644121d65891089281f524c6af9030d249e51a4104a0bcb2","size":97,"data":"","first_seen":"2026-02-24T07:43:44.847491Z","last_seen":"2026-04-08T20:55:08.829069Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"0fffb922a5882bbebad940b348ec8120","sha1":"a72386bc4b4eac166d0a62da90a1b3d0e8badef2","sha256":"059c0464a8c4f98b40bf71f2034ce04c6cbe31c445508078fa82a17da4eb591d","sha512":"cc695960fc2adfe53e7b6564c9f4e5d4129c354946e22a5889a7a58adc8a1fab4aa596af8ab74c838c378785f32888921ea4dace5e01fdc0ebe0042b4d38d855","ssdeep":"","tlshash":"38c08cc8e0c33e005a56781854af39e4e0a8442ab4486b92cce8d8a82e220f19233f9c","size":163,"data":"","first_seen":"2026-03-29T01:48:00.29638Z","last_seen":"2026-04-08T20:55:08.943767Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"dd0110bad980ea1b6d309f3a93f8df2f","sha1":"864eb282e4f53935509d3f5de1855e228f65d6cb","sha256":"e1059c26a1bd9bc0260bae3a66a08ff0b3efcfe417a9f52080e8462f83188087","sha512":"e0b55c328a9fa2c74020dd60f27d7ca88a0bd08a491b364bf9148eff3772ec422c7b5160814a9d2ad6e9e16cd055d93365656ade83fd7a37c4a86611e0a8dfc1","ssdeep":"","tlshash":"bcc08cc5a2ca6d102a42a658a1bf3ae4a0349027b08c5b13ccf4dc483e260b4a333fdc","size":162,"data":"","first_seen":"2026-03-29T01:48:00.276241Z","last_seen":"2026-04-08T20:55:08.939875Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-3TUHiDgH.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"8c0adb26a0d32e0ad6a688d487363f7c","sha1":"e426bd25272ab5ab3fa9c2e1a9394e639be9f210","sha256":"3488079aec483efb2251d35791dea295da5aabc0b7bb8a602f1265d662bfb278","sha512":"d38207caa7c471c22f8f3212fb74fc783576b7b2fc6311c73eaf03a894ea7ba076ad8f7579a2df0a729ff311fa143fb55d7c8705f09938270f4b0b3d3cc52a47","ssdeep":"768:sBtE4fY8LwREUZY1EPNFbFvGenRlDyMdBm/hceUDyoQc9JXNMA6e66mC7itet6r4:sBVTCPF5dAKr9M8Iet6YZN","tlshash":"79132b41b4279cbeabb7540460d45441f20c7fabe098c8e5b2fe5d1a67cbda0bb51b70","size":44653,"data":"","first_seen":"2026-03-30T12:23:10.076058Z","last_seen":"2026-03-30T12:31:33.059558Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/yidun-captcha.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"7b000b02de7b102d639a4a2517fdb04c","sha1":"e4013200733675ad0afbf553f532c866ca3efe87","sha256":"05aa7fb82aa3a5d8e59c925af30c7b8cea0e4ee6edc2f5ed4eeb7a4a3fa12c80","sha512":"94ab54a1f10394efcb2c2fb09dcab29d70e8c59f6f99619b04fff6ee1863830894615f7e2b00ac0c665e2bba3a2ede048b1e5de6bc05c033c2f80c6cf9771a9b","ssdeep":"192:A6yPdWboBIB9jSAhp1xDBeMS9rcIIiQaQPBYKqH3T+HyaiQSrvSIDl0IQAgWLEnr:A6yYboBOS4AcIyuf+I9R2AeCdkvh","tlshash":"1d328319adf960675d1bb0bb94af9004f6788953080c9e117e8de340df909b85feafd8","size":10968,"data":"","first_seen":"2023-11-27T10:52:49Z","last_seen":"2026-06-30T01:13:41.043305Z","times_seen":204,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/timeZone-Cees-9Pj.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"69cbe55088b0261da8a7607d087d5aa0","sha1":"5534056c88aa178782b459eb04f517508095f4b0","sha256":"d1800375168257952fcff8b0c275f5c31e6e0dbe32d623c5742d5edecc5bb5d5","sha512":"6ddec36fcf4813dc736904a267b063204a6c5c0f4d224bf7472d013f4e8359cce24507fce6ed7fd3d926504a7b7990caed007e5e0b88b6ed26291b499ca54519","ssdeep":"","tlshash":"8d019c4a4860cab2b23505acb1bdb7807e25f860f6564a18661898213f3308979bff4b","size":733,"data":"","first_seen":"2026-03-30T12:23:10.07214Z","last_seen":"2026-03-30T12:31:32.95727Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"0c620bf4f66d4dde07c595dddcd7dbeb","sha1":"51ded83f73c8408b4b114a861b567673181b07b4","sha256":"06b1f571091a82fd20ebc15af3c094a4854bf4c62f61c1ca03964e38bb423602","sha512":"80f2add15b4eb7d92aae9fca6df9e13293f91f89fefea9cf8bd8a66b42b1914919600ab2840cbcd513a4097dd634ee922f7cf7a91075b501e4653dc3d6d473af","ssdeep":"","tlshash":"66c08cc4a1c22d001652a45010bf24e8a028802a70481b02cc98e9492e220b49233e98","size":144,"data":"","first_seen":"2024-08-08T11:57:46Z","last_seen":"2026-07-30T06:06:16.920005Z","times_seen":37,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"d5e8f6eb07b275bb6910b3a5bc466269","sha1":"45a349f858095562279cc729a43491df8558e092","sha256":"60b02d1e5e083d19cb594a3021c86152cd916c7e298a6f189f7f23b1dbb956df","sha512":"ef7763fe8ba3ac05bdf9dbd584ef85e07530b6b70c70f678044a6e503ac5d36b49a8e1a6bb411f9f774e4e5f2459960038cf32fac1236fc9a694c66773f02794","ssdeep":"","tlshash":"7cc012caa1c679106a16642020bf25e4d0284026b09c5a238c94e8582e220b09223e9c","size":157,"data":"","first_seen":"2026-03-29T01:48:00.273618Z","last_seen":"2026-04-08T20:55:08.967122Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"9caba21a258782dc4b3c680ddc4cb8c5","sha1":"68a430db88e73148030ad70ffa200e272bcfb0f6","sha256":"3d4de4cf797a701dae74af3bfa8cdf3b3f9555f23b19adfa37cd8bce4cb895ec","sha512":"d5ecdbbd2d6be332721d950850f401ba31226b86354c923be445d1569016add0360518a736bb7ad0f4247a5c954f6a6deac6bd5620be1f5256660ead7474cc72","ssdeep":"","tlshash":"a3f0629466a8301d88a61f4d006d781603f0a41ffb818f603cd48ecc2b1e0707a279e8","size":626,"data":"","first_seen":"2026-03-29T01:48:00.271043Z","last_seen":"2026-04-08T20:55:08.931546Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"34a9c3ad8b5b6aa2700349cc53893d39","sha1":"949a966abc4262ee0620f7a597b6df920f51208c","sha256":"7ccfeae80fdbef13a2faad8127e098a1d9103d0a698655c52aa39b81297b0276","sha512":"9dc292c6e7bca6160ffbfea44bc5b8755b68e201c7dccf0f09dcc24dbb393ff5fc21ddf988b36de8a43343dd83610b971dbd85dc2d5d84b79bdff178fb6b7bf6","ssdeep":"","tlshash":"5fc08cc8e0c33e115a16652850af35e4d0f8406ab4886b02ccd8ec583e220f19233e9c","size":160,"data":"","first_seen":"2026-03-29T01:48:00.286526Z","last_seen":"2026-04-08T20:55:08.935451Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-K4eGEQH7.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"2e67a8f811703cdaf5b6c117821434d2","sha1":"97ebefd8398c10b6e039a30f511bf6b459d2d6bd","sha256":"640fc2c40c9f5a48baa2868a9985ca5e15b5320ab0688e90f28efa6a13d2999b","sha512":"55b1093d7bd24530caefb86d86a475206dfb30fe62710581a34203b8d8ee879d2ef11e3b4772f24b94d80fc770ca5d926910c820b7876066287c9910844c5196","ssdeep":"12288:fZTJ0zYmS2gGMMyR9aFSaIHhqalitVEcqMx34eKzeNj7VOWv2vNGuzRzoYcfBi:fZTJ0znS2gJMyR9oSaIHhqalitV7qMxU","tlshash":"d4e47dd536a5942687e499cb94354512a3393e0f7808c0ecf97eadcf2e6ad05b03af74","size":716063,"data":"","first_seen":"2026-03-30T12:23:10.097849Z","last_seen":"2026-03-30T12:31:33.061323Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-BO2SIyJr.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"d3f7a5819db794b3457f9ebc203bf7a6","sha1":"7288d1a74c1d918af7e57493866add65151f1596","sha256":"78a8fb9d3b58b0964d08b2c2d37ecc6832546bd099ec43d347b0a6e715b0657e","sha512":"ac8ecf3b3502936fca8cbc5020fdc9fc949bdae22c80e6db4b643c44c68415b82179b0a7e6835a5af9d3fde94b5f85b63a7e4fd55ac72c5fe398975b9aa35cde","ssdeep":"49152:Dc+M90xMTRVYeWH0cdwb3QA/Jz+4htAuKAkAcE5uAc3kShZqILGh9rkhc+OBCqdg:8IAPJntAjAkAcE0ACf","tlshash":"a7d59e9a3186b06103731a55a07f3205b3be2e44b40cc8d4b679d9e739f6e09a17bf79","size":2924985,"data":"","first_seen":"2026-03-30T12:23:10.167552Z","last_seen":"2026-03-30T12:31:33.297807Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"6a8542fb4cd04732629ec4a333ec2b5c","sha1":"fc083256dd4efdae8388685f50559d0a1e64ef4f","sha256":"bc8cb348dfb4c4e67bb0ee9db29a20bf56b941778fd1e545812b1aeefbe6e904","sha512":"efb5ff39d26a217a6fdee914b8a8f45096ab8eb2783dde1311a19a0057f430bdcbb463555c815d500d45c64a0f756b055bc5fc8461127c55c1d3baf31717ebb9","ssdeep":"","tlshash":"f1c08cc4a0c26e005a02651011bf24e49034442670485b038c94e94d2e320b0a233e98","size":143,"data":"","first_seen":"2023-12-02T09:04:32Z","last_seen":"2026-08-14T15:35:23.714349Z","times_seen":85,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"e61c15f487ab50ad1d7a951a2594b2ae","sha1":"94dc5ef137b2c080fe8f90c66a257336b24f38be","sha256":"6f0a5ccff563595e134c66efcffe3b16927cecb93d8127eb96aaa963125c5a48","sha512":"da191a7fde6bf44d33a43fe109b83b0bf7c347f6207cc6229163958dfcba4040b9be35ce9cf9a7b8b48f6d59bcdcb13a254e909096287ad6f0cc08181bd12e2b","ssdeep":"","tlshash":"a3c08ce4a0c26d10160aa41025bf24e890248027b04c2f028d98ec682e624b49233e9c","size":147,"data":"","first_seen":"2026-03-29T01:48:00.268595Z","last_seen":"2026-04-08T20:55:08.923453Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"16dbe1c995cee50ffad69007b34edb56","sha1":"6bd3c18d876007770b66ca5deb1ac9d4e52f7d75","sha256":"f2cf8e09230f5c268bb5ff81416a1dc459a2c41821371b4a87dcbd4fe9c45dd5","sha512":"dcc408c07f3d3f4d173aa268064c092ea658bd72458bfe6a5f8231f6b238b36f577cf4e6677473c933575ea0f4cde4df13317057caec6c2e63e0fb732435e0f9","ssdeep":"","tlshash":"08c08cc4a2c36d006612641012bf34f4a0248027704c2b02ac94d9883e620b09233e98","size":145,"data":"","first_seen":"2023-12-03T05:41:21Z","last_seen":"2026-07-25T00:52:59.5839Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"0005c3243622eef128f698d86ebf3db7","sha1":"651433c24a41a9d26972124e75ee24467538de8c","sha256":"c197d2a3e6a40252b5bbe4f753dfe9646e210304435a24083f68513e00a4fbbd","sha512":"4392d6d78a29a3146eba1e64de60f2e9f543d7961d94dacd30ccdeea6f57c3bf6ea44c5c67e972230f847610f12a40f52491ef200e3dce0afcd67f4cb005e305","ssdeep":"","tlshash":"86c08cc4a1c2ad106616651012bf39e89025942b748c2b12ac94d9982e621b0a233f98","size":152,"data":"","first_seen":"2026-03-29T01:48:00.298746Z","last_seen":"2026-04-08T20:55:08.960511Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/jsencrypt.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"3fac4c5050ddf3affef9a83179884f1c","sha1":"4f3ff513d9a377f110c1ba350d9de22bcdddf2a3","sha256":"4361db6444d034e652083bc48d9b8635ec6cd5cc51145c9c09c22697bcef8933","sha512":"a468183df8d0942edf34a91ad1c094a422fac90746b82d9ad7f76e8918b7f9da60d3b47b2aac3ce1d7ad9d7366e6a95e92bc4b4100b09ef0cfc678fa8d82c8f5","ssdeep":"3072:tG9e3/feYEeNAY7bbwmO7H5bSaeG7qC6ZU8jPdYBSZsz0bqlMk96XA3EBK/9mzvm:tG9e33eteNwmO7ZurM4qlMDvO2wL","tlshash":"ea045f0a6ef71c21491770b84f5f6085a538940f2269d999bc4cf7e49f88a3407b9ffa","size":182390,"data":"","first_seen":"2026-02-24T07:43:44.841862Z","last_seen":"2026-04-08T20:55:08.852453Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"dadf40c415e66f3adb90f428a8dd7c5c","sha1":"46d052324cd173f10e03627897a14f8e0edde2ba","sha256":"a50a6541210b57b5080782544b3fea6f0eca9cf3b2d9048bd2e1e6bde51ccc97","sha512":"f7e10d2e3b239d93aa90ff60b6fd2d913d0f9272777353431b780bfeffbab1dc413d3d39378a67cc5830e6211155991f448ab48171a3f216cedc79f7aa5600ca","ssdeep":"","tlshash":"d0c012c5a0e27d14564a6961507f68d46024403675485a929c94dc592e164b06127e98","size":172,"data":"","first_seen":"2026-03-29T01:48:00.294506Z","last_seen":"2026-04-08T20:55:08.970135Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"5715b0045fea50dc0bdc33d8cd5aff9f","sha1":"f098d3f72b411132dd570bca6643b02d9a1a12f4","sha256":"bf6c470fc3e35486034e60baeb46cfa1cbb2335b56264758ccab636d2cbc033e","sha512":"080f0c4c76f863da3df1f40d98983fae1e9df9ed9f6a2b03de6de2b744f6b1e738944b9b2d9a230b4dd7d9c7eb9bd0b2d15538f948a9c8ea63bcb8f365dd4d39","ssdeep":"","tlshash":"d9c08cc4b0c23d006616a42062af36e490248826704c1b02cc94dc592e230f8a237ee8","size":150,"data":"","first_seen":"2026-03-29T01:48:00.292454Z","last_seen":"2026-04-08T20:55:08.962222Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"3c3f9c2f3070036c20390b1f514dbcd4","sha1":"2913a9dedf6546f93ed0d57463449e9a39aaf295","sha256":"8d7c3e301c17e445d99d02bb283f535b993362547f5ce0ebded89737a9f7593d","sha512":"c91ea016e2c6a754d185ccf74b0efd91bfc663a4c7c65fc98b7eee66fa7194e8735848473a806963de77d37377ef31abcc6aa9ee5e4d8c2ec799507f2d48c061","ssdeep":"","tlshash":"acc08cc5a0c36d011606641014af24e490284426b0481b82cde4e8482e630b08233ed8","size":143,"data":"","first_seen":"2026-03-29T01:48:00.278532Z","last_seen":"2026-04-08T20:55:08.934897Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/d_logo-BfF9f3i8.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"importedModule","is_inline":false,"md5":"bc1080d98fb3d6a758ce20794c8fef35","sha1":"c9855ae87acfa7f9035abbad28b98350a49c4eab","sha256":"ab824e7246c7cdbfd29f4fa10f684b92954d2424e2b9a7d9243018ed01349717","sha512":"2fbd62a62eb57f9657d688a9f724cf434d8eb1184e41bae40ebf168c0d21d47fa7aaea56bbeb37cc5c34dc038d00e4fdd633a709249c4760e549488b7100dc0d","ssdeep":"","tlshash":"1290026d140508b0119c64888763d575144142587279565590156909ae51491550a820","size":54,"data":"","first_seen":"2026-02-24T07:43:44.907329Z","last_seen":"2026-04-08T20:55:08.863515Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"515e6e45dac1f2ab717818a13b5b3102","sha1":"65228062fc993c99696d2df6c5e869814a9bef02","sha256":"4b637abe6e63473f0cd5275d5ed513763d860066a1e313ebaef94ccd07e307ee","sha512":"ef0bc005de70ffcc95a372615032308c8c7fd769117507cbd4aa9d95b53b929c675ed3a2954789bec31b2193c8e2b87fa31094325f3bf90ad2570374ef4ddfd8","ssdeep":"","tlshash":"95c08cc5b1c3ae101642781064bf68e8a028c93ab4885b42cde8d8893e734f0c33bedc","size":167,"data":"","first_seen":"2026-03-29T01:48:00.297147Z","last_seen":"2026-04-08T20:55:08.941435Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"e83cd56a06c587f94d8b0d0abf9f3494","sha1":"887937f3f7468f670bd619fefd0391dc81cea333","sha256":"5ebab1b00ca4dc67acdf6cda20765e7a7feb7b7090828d4d7d5d345f8638d8e4","sha512":"50e757f16d8cbcb24b10a644d269431e508092f0dc28b55def5fc0670aefaf85641436a5c569d1e3b56f02406b67ba7a84355f1b447c7bacafc78c21aa385616","ssdeep":"","tlshash":"d2c08cc4a0c26e001a22692050bf24e49034446675489b038c94ed4d2e220f08237e98","size":146,"data":"","first_seen":"2023-12-02T09:04:32Z","last_seen":"2026-08-14T15:35:23.852807Z","times_seen":163,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"a89e612995249b6b7b1ba2e2608777d2","sha1":"dc7481319603324b454a3b1d12887f05d3047d08","sha256":"5f4b744ccab08f85b1648a682e7dd759bd4ce9bba926caed7380d63de674c185","sha512":"a519af88382c723ff6cbb9857deb7e9e958dc9d2553f7370bb6c6a93d89c40d4343bee0b3bb8424a37d1cc73a8cf4765373cd13f8bcaf79a15a4982d00d88990","ssdeep":"","tlshash":"c0c08cc4b0cbbd186706a550a5ef25e4d0a46027b0481b438c94d8483f620b4a233e98","size":155,"data":"","first_seen":"2026-03-29T01:48:00.277162Z","last_seen":"2026-04-08T20:55:08.938633Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/home","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"934e8ae5e0df43301ac636ab8b357e70","sha1":"74fcbdc78d7a7b3f074a5d1bad52df7b8064112b","sha256":"fbc318aad23ae003fa11275727f1dbbe31c4299191a55d976c6fc3820c8cbec6","sha512":"546d19947aafd8d11407b34aa59dc052ae939e790910f8178ca5371951a10b52a31e0af604f7ae3eff60c11b43268d86c83d85731aa4cf6e55b489c2eb153c38","ssdeep":"","tlshash":"8dc012c4b0d63954161a552155ef26e4d0344436b04857528c98dc5d2a521b59237de8","size":183,"data":"","first_seen":"2026-03-29T01:48:00.303948Z","last_seen":"2026-04-08T20:55:08.975092Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/template/sport/vi/WAP/icon/tcg.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.631Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /template/sport/vi/WAP/icon/tcg.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 4091\r\ndate: Mon, 30 Mar 2026 12:01:00 GMT\r\nlast-modified: Thu, 15 Jan 2026 02:54:50 GMT\r\netag: \"b4da3d58e72b4ebf34b70a2402795c2c\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: VDj6lZ6RDp73bjKDEh42nNOmRionwSs8\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: vMV6YJhUcXpq17-k5VQZDSJzAaJ-CTVceS5AbfDO9ZYXeX7w6uSPiw==\r\nage: 1295\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":4091,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 135 x 60, 8-bit/color RGBA, non-interlaced","md5":"b4da3d58e72b4ebf34b70a2402795c2c","sha1":"7c883fa3eb3b08971c8b935e55789e672343f6f5","sha256":"9ceee06d18eedfbb9e858b5cd2f1767f7d9d1024e07c26544d7fa8e92fccfda8","sha512":"30e449538b607809b060f53d421bf82beeb1aeab17c1d18aafe735f660f5d59e33cc4d811518723aa7c3807ace38df9dea8f3a4c48657018529a78a405e90e92","ssdeep":"","tlshash":"e6818f1a031b09de7e1c453583be4b74a94c8ec30ba3ae45f294e87cff4a451150bd9b","first_seen":"2026-03-30T12:23:10.068573Z","last_seen":"2026-03-30T12:23:10.068573Z","times_seen":1,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/RoulettePanel-BoKSUyos.css","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.058Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/RoulettePanel-BoKSUyos.css HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 28 Mar 2026 03:43:03 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69c74e47-10621\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":67105,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"770d1196d3a5dfa4ee80418b944033c0","sha1":"ecb5f4cbc0227272ee8d1dd2baa1206b9d96ea31","sha256":"1dfce4eda68f5da4d1f219f21512f15590fc07fb78e23de7ba6e26be8022d7f6","sha512":"2ee72c16bb7768bbc3a980b291575861432dadb56e9d43778cb6894c6d24d301c749f72ddf1eb6a7a45a7c91826b08d269597689c86353ef09560ed6dd7c284f","ssdeep":"1536:opcvnidd8Wv3G1PRNt2lJQYDawmYU8PGlYq:op4lYq","tlshash":"3e63d884f19d783fd5bbd3252c94b62e0512b762e50fdd29b9a2f9ca0b4638362f1704","first_seen":"2026-03-29T01:48:00.059596Z","last_seen":"2026-04-08T20:55:08.899624Z","times_seen":17,"resource_available":false,"data":null}},"time_used":248,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":248,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-DBMhbs2U.css","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.457Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/index-DBMhbs2U.css HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69c74e48-2af6\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10998,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (10997)","md5":"87a5c7f146bb421b3c712480191e6a05","sha1":"4a4442a8ffc21fa868a664c7e5445b44bb40b4bd","sha256":"bffc14675d60cd893ee760945d3c8797ed3e48e7b77703e675b05a645b8e4d95","sha512":"3b9c3a8e9e6dd7627de7c6fd9ae5b06a1981aec2a6f2c823f7e68d8da1980ca43489eee67cb5ea99bb0ea624a0855372028b5fedeba7bd21edb558e2e3c32f3b","ssdeep":"192:DyeaiMZF0QYBrgcXP+TLd5TnBu5BC/Eqg3Fg35/meEbTISG5IlsNaBEMZig1t5e+:p4Fo","tlshash":"2732db84d8c9015882d6b32448ecda2a4e672570b7aed838517731afbff1297158ef7c","first_seen":"2026-02-24T07:43:44.908492Z","last_seen":"2026-04-08T20:55:08.848766Z","times_seen":19,"resource_available":false,"data":null}},"time_used":493,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":493,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/timeZone-Cees-9Pj.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.475Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/timeZone-Cees-9Pj.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-length: 733\r\nlast-modified: Mon, 30 Mar 2026 12:18:26 GMT\r\netag: \"69ca6a12-2dd\"\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":733,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"Java source, ASCII text, with very long lines (732)","md5":"69cbe55088b0261da8a7607d087d5aa0","sha1":"5534056c88aa178782b459eb04f517508095f4b0","sha256":"d1800375168257952fcff8b0c275f5c31e6e0dbe32d623c5742d5edecc5bb5d5","sha512":"6ddec36fcf4813dc736904a267b063204a6c5c0f4d224bf7472d013f4e8359cce24507fce6ed7fd3d926504a7b7990caed007e5e0b88b6ed26291b499ca54519","ssdeep":"","tlshash":"8d019c4a4860cab2b23505acb1bdb7807e25f860f6564a18661898213f3308979bff4b","first_seen":"2026-03-30T12:23:10.07214Z","last_seen":"2026-03-30T12:31:32.95727Z","times_seen":2,"resource_available":true,"data":null}},"time_used":481,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":474,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/club_3-BFOPCfem.png","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/club_3-BFOPCfem.png HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/home\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 4741\r\nlast-modified: Sat, 28 Mar 2026 03:43:05 GMT\r\netag: \"69c74e49-1285\"\r\nexpires: Mon, 30 Mar 2026 12:32:34 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4741,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced","md5":"074c5de616365e2857fe77738d03add9","sha1":"0c2532076ffc77ceb6c9016886f2cae2a4c5817f","sha256":"057b7acebe505da86a73108cf405b51ff6559a1deeba2a6513c61fa80f76eda3","sha512":"1ed7a5bc386b1797f5b7805d4cf8488ea1f99767157e9faa7fbfcf2903aa1a0215914584ee902213f1d60a73dcc97524fd8df962e559b2db9d79359abfd84865","ssdeep":"96:zKr6ZlcPZeo70O4EtKmpfMr0qTOViNU65O6RtCcFesrsF5To2d/FPOpk:GrWsD7/XMgqTOecyMcEAg5ToQ/uk","tlshash":"2ba18ee78b957f084e9d16f63c4aba5be936066c04ab0c6ff1042f58613845e026fc4c","first_seen":"2026-02-24T07:43:44.941079Z","last_seen":"2026-04-08T20:55:08.849257Z","times_seen":19,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/template/sport/vi/WAP/icon/bbin.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /template/sport/vi/WAP/icon/bbin.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 2723\r\nlast-modified: Thu, 15 Jan 2026 02:54:45 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: zx1wn13UI7poLRioqz7wCSCxD.H9.ZT1\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 12:01:00 GMT\r\netag: \"41d98b54fedc2996e2001f4b4af659f4\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: IkkYNpH4as-bmTNdIn3DvL0nLChFIbrvzIsCZmKDvVyS1JQyude97w==\r\nage: 1295\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":2723,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 103 x 60, 8-bit/color RGBA, non-interlaced","md5":"41d98b54fedc2996e2001f4b4af659f4","sha1":"243d3a6ecef6d388f0ee0b077e9a54ae368981e1","sha256":"eb6d21d20daa0cd7764c6d8142b2863df9ba3832d025e9716eeeef9cbb245d1d","sha512":"eda3c94942534ae89ff122d5e1c07e8cc72d5fc270017619b7c601960eab5eb6c50dd7302b10d1fdc848e6a33f7ad678c65ea114e7b0d35352933c6f35238b2e","ssdeep":"","tlshash":"a0514bc2490a3f759807f2121b96047b6f432837721e54449653da3f7ba18e44fda206","first_seen":"2026-02-24T07:43:44.830418Z","last_seen":"2026-04-08T20:55:08.832352Z","times_seen":19,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/RoulettePanelPop-Cikna7Tz.css","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.062Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/RoulettePanelPop-Cikna7Tz.css HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 28 Mar 2026 03:43:03 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69c74e47-faa3\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":64163,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (64162)","md5":"08c71aebdfa6d69cf86d71fa5d54fb28","sha1":"0080539f1efbf1b7cafd7f592ed36b3083da0b3e","sha256":"24cecd4a1e578d315835c1d448b827717b04d94fe8d3a8adcdd7f9ad2d9f56c5","sha512":"f2ec7cbff6d1166efe03ac5d5817f1997c787ca1bb03f45f285445c7853b078f287b78d5efc50fd54113e0068fe22a24e7791a75a7504440c2eb282d9d481199","ssdeep":"1536:kWfaOXSErvAGBM0YIW3MwJZ+LtH+H/I9T:kWBT","tlshash":"da539748f19d091e55e7db269e66e73c0513f762854f1b2dbd933b888e8e2c3b1a160c","first_seen":"2026-03-29T01:48:00.244489Z","last_seen":"2026-04-08T20:55:08.85784Z","times_seen":17,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-3TUHiDgH.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:33.695Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/index-3TUHiDgH.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/assets/index-K4eGEQH7.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:33 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nlast-modified: Mon, 30 Mar 2026 12:18:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca6a12-ae6d\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:33 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44653,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (44642)","md5":"8c0adb26a0d32e0ad6a688d487363f7c","sha1":"e426bd25272ab5ab3fa9c2e1a9394e639be9f210","sha256":"3488079aec483efb2251d35791dea295da5aabc0b7bb8a602f1265d662bfb278","sha512":"d38207caa7c471c22f8f3212fb74fc783576b7b2fc6311c73eaf03a894ea7ba076ad8f7579a2df0a729ff311fa143fb55d7c8705f09938270f4b0b3d3cc52a47","ssdeep":"768:sBtE4fY8LwREUZY1EPNFbFvGenRlDyMdBm/hceUDyoQc9JXNMA6e66mC7itet6r4:sBVTCPF5dAKr9M8Iet6YZN","tlshash":"79132b41b4279cbeabb7540460d45441f20c7fabe098c8e5b2fe5d1a67cbda0bb51b70","first_seen":"2026-03-30T12:23:10.076058Z","last_seen":"2026-03-30T12:31:33.059558Z","times_seen":2,"resource_available":true,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/search-D0CeyGv_.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:33.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/search-D0CeyGv_.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/assets/index-K4eGEQH7.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:33 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\netag: W/\"69c74e48-5d5\"\r\nexpires: Mon, 30 Mar 2026 12:32:33 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1493,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with very long lines (1492)","md5":"4e499dddf30c74c8c431532f3edeb59b","sha1":"3308de5e7d47ddb3278a4bf72b1cb36c3315b3cd","sha256":"eacd894d27ab709ab4eebea064db3cdb0b19602adfc6b0bb8a9c49c411c4ab6d","sha512":"c996a33d8fee530f57b3acc75214f7b4735a86b310b1d8778bc677a53595230d61107244332db460216f9ee1710ae6f1785465209b73de62c714f6ba5081eda8","ssdeep":"","tlshash":"0831c7240e40a949daff23eedb1d7700fe8b9f4e213c11e8986c02493aeb6281093161","first_seen":"2026-02-24T07:43:44.829435Z","last_seen":"2026-04-08T20:55:08.824927Z","times_seen":19,"resource_available":true,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":254,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/ber-finish-6xQoqTKO.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:33.702Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/ber-finish-6xQoqTKO.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/assets/index-K4eGEQH7.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:33 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 28 Mar 2026 03:43:05 GMT\r\netag: W/\"69c74e49-c9f\"\r\nexpires: Mon, 30 Mar 2026 12:32:33 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3231,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with very long lines (3230)","md5":"0f98b0616c69e7514f0b4c90c9d24667","sha1":"ff1ae970c70207426088b59362f7f3d7bbca7c62","sha256":"2249ce17b324b0cd28c4184e85d6565e059770b558be269d4c7e5e2d357733a5","sha512":"eed4b3c726ecd8a720a495ef0a48031ace59411640760e33b405803aa4dcdbd199b166844724dceffe71dd0b7a5f0992c31ab2d0eca2b7f4c373283ff3d07ec4","ssdeep":"","tlshash":"80615bb85a061e209bc34deeffa7b424fd185f27e3d2918002da5f242b1f5b69036021","first_seen":"2026-02-24T07:43:44.84853Z","last_seen":"2026-04-08T20:55:08.81672Z","times_seen":19,"resource_available":true,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/club_1-3MFTSt52.png","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.241Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/club_1-3MFTSt52.png HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/home\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 5542\r\nlast-modified: Sat, 28 Mar 2026 03:43:05 GMT\r\netag: \"69c74e49-15a6\"\r\nexpires: Mon, 30 Mar 2026 12:32:34 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5542,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced","md5":"5b06818fb5ff1ce9bf1a5ddd9632ff91","sha1":"4e1ee2ff89d2a8b771e343a8b1b8a1d506b1c887","sha256":"d8f6dff4efb83fa793ead3973dad288e3536b20faa1f9edb80c59d7cf86e9ff2","sha512":"645eea31532259db1ca1c1ec4c37d72c2c30eb11af7d5b6bd5c8812cb60a5d022e8d7f2dbfb28bf7099c90ee41d9b27fd9b361fb1c1decfc97b4b77ed958ea1b","ssdeep":"96:2OtEiK4eIwi6zV7mkYpdPHa9980dvSjjeHXfzVlPl7OqhMysbtwNjyWwRKV:2tdqymkYpdPaoISjjEXfzTPNbuNtwNq8","tlshash":"62b17db3773aee2edb82630b933d5121d0b935101bf567b493bc8a61f5c281336a5b10","first_seen":"2026-02-24T07:43:44.947266Z","last_seen":"2026-04-08T20:55:08.895677Z","times_seen":19,"resource_available":false,"data":null}},"time_used":256,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/web/sport/left-G-GAME.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.269Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /web/sport/left-G-GAME.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 4742\r\nlast-modified: Tue, 08 Apr 2025 05:46:55 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: RaX7f.rOLFhJPYVyJYb4FUvbz5hwijow\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 12:09:45 GMT\r\netag: \"66faa715ebbe9290f7eec32ab2504603\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: OQO-bzrkE28Dnu885DaiM6oFHMhTkPsHejnji2Isyw4C0vh4kG9KOw==\r\nage: 769\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":4742,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 104 x 104, 8-bit colormap, non-interlaced","md5":"66faa715ebbe9290f7eec32ab2504603","sha1":"d7e1e255c1b1080e8db5321d1074976d225f5b6c","sha256":"65dca6c93a7f43aef97668e3c06188dc6d9c428109c12bbaf9c2f95bdaf78125","sha512":"d26bc77b5e74408634324e63d05af3ee4f93576f95904767ccebbd9ef6ac8d0eeaa62022435da28ebe23189fbe5e671378ae47dbe6fa42e71d322520d89aac64","ssdeep":"96:UUdbMYMg/843y2STR0OOBfbCkBWf/NxS0UHw6ZFYWt0sUwKXqGTQGGf5I+0:nlt8c7qCXBOkBWHSJQ68WK4GGf5I9","tlshash":"61a17dbc67db016067d5cf9313bb201559468c3ddfda6bec1faa347a850e86ea4e0148","first_seen":"2026-02-24T07:43:44.856553Z","last_seen":"2026-04-08T20:55:08.880741Z","times_seen":19,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/search-D0CeyGv_.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.473Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/search-D0CeyGv_.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\netag: W/\"69c74e48-5d5\"\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1493,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with very long lines (1492)","md5":"4e499dddf30c74c8c431532f3edeb59b","sha1":"3308de5e7d47ddb3278a4bf72b1cb36c3315b3cd","sha256":"eacd894d27ab709ab4eebea064db3cdb0b19602adfc6b0bb8a9c49c411c4ab6d","sha512":"c996a33d8fee530f57b3acc75214f7b4735a86b310b1d8778bc677a53595230d61107244332db460216f9ee1710ae6f1785465209b73de62c714f6ba5081eda8","ssdeep":"","tlshash":"0831c7240e40a949daff23eedb1d7700fe8b9f4e213c11e8986c02493aeb6281093161","first_seen":"2026-02-24T07:43:44.829435Z","last_seen":"2026-04-08T20:55:08.824927Z","times_seen":19,"resource_available":true,"data":null}},"time_used":476,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":476,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/HomeTimer-BA9-8c0y.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:33.699Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/HomeTimer-BA9-8c0y.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/assets/index-K4eGEQH7.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:33 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 30 Mar 2026 12:18:27 GMT\r\netag: W/\"69ca6a13-10ac\"\r\nexpires: Mon, 30 Mar 2026 12:32:33 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4268,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (4239)","md5":"2ab74e9a01032f38ff902d84509df202","sha1":"ff5d4e4d2cf4229865895fd906772fe3bfe278cf","sha256":"beed42411fb517208fc5dd5c3afc1a1837d92a1333f73f2619616902e8a51764","sha512":"8e472ef22b1458dd526cdf8ba5e3ad48ce56e130b3a26b75977a417370f5e210c4bf633db25cb01670e6aa5853695f145bf59a0fbbc7b0e40cf7a21019ef74fa","ssdeep":"96:iSjsLqDo743cLJDPhc+OyDDtMdDkFP6oKpWzwPYqdeHfiG40b0Gw5Zu7aI9DG:pjsLq874sLJDPO+5DtODghKpYwdd5G4N","tlshash":"6691d8ceb402f43a87f15858a45c0421610d7bab7070e8f5ea7fde9a2349e91b327979","first_seen":"2026-03-30T12:23:10.08085Z","last_seen":"2026-03-30T12:31:33.0019Z","times_seen":2,"resource_available":true,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/web/sport/left-F-GAME.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.272Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /web/sport/left-F-GAME.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 4029\r\nlast-modified: Tue, 08 Apr 2025 05:46:55 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: Vt4XYT0mt5n0Bwvv7jhYjtRMpslOypRs\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 12:09:45 GMT\r\netag: \"ba8a7311fddb0eb6d8748b3dd0fe80d7\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: OYteTfLB-387mFr6oVCNzwkc0yVH9wdC8RuulzZ2yv-XsneCo83pBg==\r\nage: 769\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":4029,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 104 x 104, 8-bit colormap, non-interlaced","md5":"ba8a7311fddb0eb6d8748b3dd0fe80d7","sha1":"151cf232a847df158c456549e038bace1230f194","sha256":"14111b619e4b30ffdfbb762bf17365de1e1fc4b2f11d326429a8fd0b0a24e7e5","sha512":"3c838333bec4f96180d00dc31e7672cc1b68a1c515723998cb207bf268f08c02fde5a349f44a1a0b153fbec79e893ab4a1a555ee540e1d5723310d5596339128","ssdeep":"","tlshash":"23816de7035921ad947303b942e790119f3fa7857aeb921b902aeb07e0cc017a09b6f5","first_seen":"2026-02-24T07:43:44.937461Z","last_seen":"2026-04-08T20:55:08.92082Z","times_seen":19,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/template/sport/vi/WAP/icon/ae.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.603Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /template/sport/vi/WAP/icon/ae.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 2838\r\nlast-modified: Mon, 09 Mar 2026 13:13:39 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: 1iI5jZW.H2OMBVtbCUlSKbaMSMKHCDVn\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\netag: \"2eb1004deb88db90379e41de15e62bce\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: My7RMnyeJtj-sqDQ_eV_FL2VmHMfAfJmF4dOt2N-V9O2ww7368pb9w==\r\nage: 1295\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":2838,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 144 x 70, 8-bit/color RGBA, non-interlaced","md5":"2eb1004deb88db90379e41de15e62bce","sha1":"7ecf5668f9e3490803e8cfee773d1d526de42442","sha256":"fe569173f7f5d448ba69915ebd55fd435fa8e7b3b4c2f61cec6e31014163530c","sha512":"6fae60afb8ff565678ac8ad429a382214450f47d95dafe96f14286618eec797b9a8a6c534be22e1b0f0d4c4b83215163b57b81285471e1d7e0e6a1a4f94d628c","ssdeep":"","tlshash":"63510ac41341afa4a5890e5fce8fdeebdeb195d93ba0b0680a2c104a431cd4884c55d5","first_seen":"2026-03-29T01:48:00.140614Z","last_seen":"2026-04-08T20:55:08.89651Z","times_seen":17,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-M52D-hQv.css","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.453Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/index-M52D-hQv.css HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69c74e48-1e9b\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7835,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (7834)","md5":"2a9db268872d0b53fed859a1e02c4895","sha1":"9400f39e85c28d093a1d34588df964ab82a7ddea","sha256":"6207b63d2c064903d3a927c95bffccb953bf3948853af3a295abbc6474f64f94","sha512":"d01e1450cb322c6ead2bde852b095bf39b31039be17140eb15aed177e8360e68d09d342027c6be68d9582149c4d989f801fd24b988836d4c754fef557747c96b","ssdeep":"96:WOJ3Wp7WKPdNnHQN2Ol9VYUYenBKH1TAjKABbn:LJ3Wp7WKPXlOl9VYUBBKxAjKABbn","tlshash":"1df1342d9509212fe2ebc79c69f96fa899164ef1d01f065fb1b5f0b2020a1ad11dbf07","first_seen":"2026-02-24T07:43:44.853738Z","last_seen":"2026-04-08T20:55:08.902139Z","times_seen":19,"resource_available":false,"data":null}},"time_used":496,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":496,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/site-intqf/siteNotice/202603/068c9949b8fe4baa9bb412dac75f474c.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.014Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /site-intqf/siteNotice/202603/068c9949b8fe4baa9bb412dac75f474c.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 153099\r\nlast-modified: Mon, 23 Mar 2026 13:02:04 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: 4JbKWcSGFWeBJBSdOgFHbPVQQI2SQUWX\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 11:49:10 GMT\r\netag: \"ff591c940dd141818e6c9b7e445d19a2\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: SDhLsb4Bzyjjr11xxXSEurbZCI2GpRLyEVJWuqN6uG8PFTrODmb_cg==\r\nage: 2005\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":153099,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 500, 8-bit colormap, non-interlaced","md5":"ff591c940dd141818e6c9b7e445d19a2","sha1":"89d50306c43a040c7e372875673649c9bd336aac","sha256":"66ee5a0ae3b940ed9787b200bad06c1fda7a1b301b034108b0cdf0323ed29e59","sha512":"62a24079c0b6f13fe234346dba4090e18d72cc7afaa422b8bd6181c9d26a7fc728956b343c2a1a660e24d688307427f93e199ccea4d860397cef46290891e477","ssdeep":"3072:kcDJhGyoVuVWX722e41H7mi1Z0/cVY5nbr19RSd19yy8XM0DfZum:pLG/VIiCXqbocVQ5BpZtum","tlshash":"90e312d2642ef9bf0fd0d8a2bd6794c5c275d4c9fd97829a6240b931c6b8211c10bbe9","first_seen":"2026-03-29T01:48:00.260476Z","last_seen":"2026-04-08T20:55:08.91678Z","times_seen":17,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/jsencrypt.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:29.818Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /jsencrypt.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:29 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nlast-modified: Sat, 28 Mar 2026 03:43:07 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69c74e4b-2c876\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:29 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":182390,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (828)","md5":"3fac4c5050ddf3affef9a83179884f1c","sha1":"4f3ff513d9a377f110c1ba350d9de22bcdddf2a3","sha256":"4361db6444d034e652083bc48d9b8635ec6cd5cc51145c9c09c22697bcef8933","sha512":"a468183df8d0942edf34a91ad1c094a422fac90746b82d9ad7f76e8918b7f9da60d3b47b2aac3ce1d7ad9d7366e6a95e92bc4b4100b09ef0cfc678fa8d82c8f5","ssdeep":"3072:tG9e3/feYEeNAY7bbwmO7H5bSaeG7qC6ZU8jPdYBSZsz0bqlMk96XA3EBK/9mzvm:tG9e33eteNwmO7ZurM4qlMDvO2wL","tlshash":"ea045f0a6ef71c21491770b84f5f6085a538940f2269d999bc4cf7e49f88a3407b9ffa","first_seen":"2026-02-24T07:43:44.841862Z","last_seen":"2026-04-08T20:55:08.852453Z","times_seen":19,"resource_available":true,"data":null}},"time_used":929,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":929,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/bus-pay-5-BiECjimF.png","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.218Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/bus-pay-5-BiECjimF.png HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/home\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 65501\r\nlast-modified: Sat, 28 Mar 2026 03:43:05 GMT\r\netag: \"69c74e49-ffdd\"\r\nexpires: Mon, 30 Mar 2026 12:32:34 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65501,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 365 x 365, 8-bit colormap, non-interlaced","md5":"7c25e9edb1ebecff1e756ab545563088","sha1":"7eb0b198e0016c076a657de94ffa974c612b05a3","sha256":"13315be4ad0e1515756557a3ed56b8d7ac289448ec1cfd507aff38adf67bfee3","sha512":"251325211a4a2ece648706b49fefac5aa516c12c80401571f87e9fc384bc79f4672311c892431ba0638cd7b93e085844ed790eb745437abbc558c13a781ed774","ssdeep":"1536:diOyHA0mg1Tr/Cc4Yte3jpQ/W8BhM0qjHZn5R3G:1IAJG3/CStFjsBZ5R2","tlshash":"23530112bf04696b62ee8b20c602e52363ab1f4831f5db5d7800942f235dedda95c0fe","first_seen":"2026-03-29T01:48:00.240347Z","last_seen":"2026-04-08T20:55:08.911271Z","times_seen":17,"resource_available":false,"data":null}},"time_used":260,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":256,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"lf1-cdn-tos.bytegoofy.com/obj/iconpark/icons_15107_188.0655b3de50b840e93c985eac1507fc40.es5.js","fqdn":"lf1-cdn-tos.bytegoofy.com","domain":"bytegoofy.com","tld":"com"},"ip":{"addr":"163.181.243.175","port":443,"asn":0,"as":"","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:29.821Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.bytegoofy.com","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 19 Jan 2026 00:00:00 GMT","end":"Mon, 18 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"3E:44:54:E8:1E:67:87:C9:9C:01:D8:41:12:36:DD:65:49:E7:95:E9","sha256":"34:DC:66:D5:B6:92:CF:76:AC:9A:4B:47:FD:E1:99:C7:79:5D:45:7D:91:42:D1:22:91:D8:99:02:A1:92:DB:1F"}}},"request":{"raw":"GET /obj/iconpark/icons_15107_188.0655b3de50b840e93c985eac1507fc40.es5.js HTTP/1.1\r\nHost: lf1-cdn-tos.bytegoofy.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: Tengine\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 64277\r\ndate: Sun, 08 Mar 2026 13:10:30 GMT\r\nvary: Accept-Encoding\r\ncache-control: max-age=2592000\r\ncontent-md5: XboK+DP6AV4ynW60MQ50WQ==\r\netag: W/\"5dba0af833fa015e329d6eb4310e7459\"\r\nlast-modified: Mon, 27 May 2024 22:41:23 GMT\r\nx-tos-hash-crc64ecma: 10278901992462213962\r\nx-tos-request-id: fc4b7ead7545839b69ad7545-fdbdgdc02g28gc30gg12\r\nx-tos-response-time: Sun, 08 Mar 2026 13:10:30 GMT\r\nx-tos-storage-class: STANDARD\r\nserver-timing: cdn-cache;desc=HIT,edge;dur=3\r\nx-tt-trace-host: 01403f40cc3614c9b7396647d07ca428cfa93cb821d7d8d112eba16e43089879b83ed1afea73b69257f2702fd991336eee57bb7000b76057e3927df229dd1e54968c6373337f5e2feae7b0866f25cec4f12e725fd3419ceffac5f81e1e7c499378\r\nx-tt-trace-tag: id=03;cdn-cache=hit;type=static\r\nx-tt-trace-id: 00-26030821102902F2054BEF98ED729C6D-0681AF9A51A94892-00\r\nx-tt-logid: 2026030821102902F2054BEF98ED729C6D\r\ncontent-encoding: br\r\nvia: ens-cache24.l2de4[0,6,200-0,H], ens-cache11.l2de4[7,0], ens-cache7.gb9[0,0,200-0,H], ens-cache15.gb9[3,0]\r\nage: 1897920\r\nali-swift-global-savetime: 1772975430\r\nx-cache: HIT TCP_MEM_HIT dirn:-2:-2\r\nx-swift-savetime: Thu, 12 Mar 2026 16:50:31 GMT\r\nx-swift-cachetime: 2233199\r\nx-response-cache: edge_hit\r\nx-tt-supplier-id: 0_1\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\ntiming-allow-origin: *\r\neagleid: a3b5f3a317748733504438583e\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":237293,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"5dba0af833fa015e329d6eb4310e7459","sha1":"11a409ebbc4676239563c05bbedfd4a420d43a4f","sha256":"72e6fc8be817e2b3aac9378f35b17114173704eba81fdc46a1ce4d57cc4cb8cd","sha512":"9425d5c7bdcd5874bdd3e6efd4d95b3f08c07d4adcf0193c1c07bab21206a1317f9e5991b2fad78fb6f09d306b11226454170d9e28b2eda3aba8b84976b48b87","ssdeep":"3072:Xv7GhAyLfr6ZpAVdUbGly8auCanDn+/kxbQ9fak13c8rLhDGrdco5g5DBuYb8ps:Xv71rig5NuYb86","tlshash":"4234fbe73360e06c368746759bfe7952221e739830c583b065bfc5f413635a8ea6bda0","first_seen":"2026-02-24T07:43:44.923887Z","last_seen":"2026-04-08T20:55:08.82443Z","times_seen":19,"resource_available":true,"data":null}},"time_used":1297,"timings":{"blocked":619,"dns":515,"connect":22,"send":0,"wait":26,"receive":26,"ssl":86},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-3TUHiDgH.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.470Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/index-3TUHiDgH.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nlast-modified: Mon, 30 Mar 2026 12:18:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca6a12-ae6d\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: MISS\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44653,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (44642)","md5":"8c0adb26a0d32e0ad6a688d487363f7c","sha1":"e426bd25272ab5ab3fa9c2e1a9394e639be9f210","sha256":"3488079aec483efb2251d35791dea295da5aabc0b7bb8a602f1265d662bfb278","sha512":"d38207caa7c471c22f8f3212fb74fc783576b7b2fc6311c73eaf03a894ea7ba076ad8f7579a2df0a729ff311fa143fb55d7c8705f09938270f4b0b3d3cc52a47","ssdeep":"768:sBtE4fY8LwREUZY1EPNFbFvGenRlDyMdBm/hceUDyoQc9JXNMA6e66mC7itet6r4:sBVTCPF5dAKr9M8Iet6YZN","tlshash":"79132b41b4279cbeabb7540460d45441f20c7fabe098c8e5b2fe5d1a67cbda0bb51b70","first_seen":"2026-03-30T12:23:10.076058Z","last_seen":"2026-03-30T12:31:33.059558Z","times_seen":2,"resource_available":true,"data":null}},"time_used":526,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":526,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/bus-pay-3-DuOqe38C.png","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.214Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/bus-pay-3-DuOqe38C.png HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/home\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 8578\r\nlast-modified: Sat, 28 Mar 2026 03:43:05 GMT\r\netag: \"69c74e49-2182\"\r\nexpires: Mon, 30 Mar 2026 12:32:34 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8578,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 330 x 332, 8-bit colormap, non-interlaced","md5":"1d1c8726889ca01a9d72f23b9f861f1b","sha1":"29cdd121f4ee4a58e76ad9055a3bb9c75c8b7060","sha256":"7f023a883a6a3f5ad57dc8cc5042f4a29f02b9531e963ee990de8082543f6fcb","sha512":"cb41708878e22c666a8c6ac100df9647062e5e027e4186000d844a7961f6f65bd7805d2cf80a18619b477a30f3101340f04db6fd38610cfe36af94f19a39c733","ssdeep":"96:VUnFgBjRP7eZqqwhaEJaPUDoxdcWSsbRLXRQ4w5YXtr1HdERpM1T67NPXD7U/mzX:VbjOIzDoxvN7R3hERh7NPXfU/myeUu","tlshash":"9202a0841ae5fa1e80498784bebeec9349159b9dfeb6d35c8f045354a8189c88d3193f","first_seen":"2026-03-29T01:48:00.074938Z","last_seen":"2026-04-08T20:55:08.878315Z","times_seen":17,"resource_available":false,"data":null}},"time_used":248,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/web/sport/left-L-GAME.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.271Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /web/sport/left-L-GAME.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 4274\r\nlast-modified: Tue, 08 Apr 2025 05:46:55 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: fswwXeny4Y98YPBR7xFRyEZuINtFc3kj\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 12:09:45 GMT\r\netag: \"2784479c5890f4c00ade7f2ccbf54d27\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: zUEcyu6f9qO86GvHzG1GYtzwTvIxMeOuL8wbT7GuTpCS2Afo9yYdKw==\r\nage: 769\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":4274,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 104 x 104, 8-bit colormap, non-interlaced","md5":"2784479c5890f4c00ade7f2ccbf54d27","sha1":"c6cac1a43c4fab6faee82bdf2eb3a342b272b281","sha256":"638add8de947282e84c5a988ae02def3116472eda7773512329b52723deb9fa3","sha512":"efb738980e536979e6b90ae15889377813eef4615df9705f38734dd6ca0f764782648326ba30b34708e287e3023bae6266ddd92ebf85e17684bdef1731e285c0","ssdeep":"96:zhy3IQi07B0sj0izOjI7aiuR+LpbDW2aWJcQWfRe:zhGjjl0sOfR4bSCJcfRe","tlshash":"cc919e9d679cfc0960603082270aede288d70da7d23027d176de44dcf882461c7c269d","first_seen":"2026-02-24T07:43:44.911031Z","last_seen":"2026-04-08T20:55:08.864228Z","times_seen":19,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/api/game-center/f/game/gameNameDict","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.415Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"POST /api/game-center/f/game/gameNameDict HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: vi\r\nAccept-Encoding: gzip, deflate, br\r\nDevice: PC\r\nCurrency: VND\r\nFrontAuthorization: \r\nContent-Type: application/json\r\nContent-Length: 2\r\nOrigin: https://ydnaz.ksa9noa1-sdoqd.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2,"data":"{}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/json\r\ncontent-length: 24304\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://ydnaz.ksa9noa1-sdoqd.com\r\naccess-control-allow-credentials: true\r\ncontent-encoding: gzip\r\nx-remote-addr: 91.90.42.154\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92220,"size_decoded":0,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (64820), with no line terminators","md5":"30a2d8d8f53b40c34f9319cb6b179aca","sha1":"cdf1f44ec81d16faa640b4605b36f7504be05252","sha256":"a995f4e15aa22d67742cda8cd3b2c07bb1b90b18f554eb42e65c3d1da6e60414","sha512":"d120f0d8d4e05aca8f115863dd8bdc6f2e5100e569fcea27323b51770cdfc90358d5aa0ee1f65f116e34458d50e267d455996f4b32ea420f4b56200fe9476fa2","ssdeep":"768:Auboab2mxjvs/ntJRoL+c6/KxTrTWASv1tzM5b4w3xeiGiUM9X1c+qFGi5KwbPK2:AusKVEfLKaXQTWtM1cK9pWTF2m","tlshash":"4d937ddeca0e2cfe4ab82eb6169b39fd74f5341bb1dc4d00b485997629d435c103a6b8","first_seen":"2026-03-30T12:23:10.0902Z","last_seen":"2026-03-30T12:23:10.0902Z","times_seen":1,"resource_available":false,"data":null}},"time_used":379,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":369,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/template/sport/vi/WAP/icon/ag.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.609Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /template/sport/vi/WAP/icon/ag.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 3314\r\nlast-modified: Thu, 15 Jan 2026 02:54:44 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: BzYYMv2u6hlb3pReG4WPtRIFQ59WpC0b\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\netag: \"3f3cb903b5184849ad7186eae690d96d\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: 3PvJxaACQgz6xfpzwetWpVGh42nI3zL6KAlx09WZoW6IioSUypZFwg==\r\nage: 1295\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":3314,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 166 x 80, 8-bit/color RGBA, non-interlaced","md5":"3f3cb903b5184849ad7186eae690d96d","sha1":"d2216c18652a15432564c84ab40a099325cc4182","sha256":"e4d398f0be5d2d2ad2d5c181da22691a7b5604374585bca4475149a45aa9c457","sha512":"6a798d379b01256a1eaa6b91005d80e0742286f1e2266dd6080cb4f130b3f0d2eb989cfd8d34414f177489f954961174fece12bc23a7a370b1ba881382231004","ssdeep":"","tlshash":"0d613bc874c024aee6e3265423a8a0819d736b50ec3e130e5cd7942df1d8ea45bb238b","first_seen":"2026-02-24T07:43:44.93511Z","last_seen":"2026-04-08T20:55:08.844861Z","times_seen":19,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/template/sport/vi/WAP/icon/allbet.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.612Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /template/sport/vi/WAP/icon/allbet.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 2684807\r\nlast-modified: Sat, 28 Mar 2026 05:34:23 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: lQDnZOV12WbO4HPVOQweJde0D5Z1T2if\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\netag: \"bd61e4a8a447c68b07850ae238fe06b8\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: q8_yL_YQDtwehSq9KnyUutCi-vg0viasoZk4D8UmVG9eMHqkH35dPg==\r\nage: 1295\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":2684807,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 3450 x 2314, 8-bit/color RGBA, non-interlaced","md5":"41f2e37ce79969149f0c942b6c1736bc","sha1":"beadbe4e428afcaa2b2b2ede4841f40a4adcd72d","sha256":"a661364dd3b808744adcc72c72cc31ef68f786219bf50c6a7790aa1ba154a6e4","sha512":"388feb11c69318f3af7dcaeb11fc50f76690307a475b604e4a358f1d96162a1efa3ee61daeedc1240eeb3fe7df9b6b4ad7edff5c8dec44f181555c00f6d33cf8","ssdeep":"24576:KwKJ6FCU7MbqEw+5e4U6te/QQ73cWKwNJYNfSRzo0gU/dSI4Bv:NK0FCU7SdK6k/QQ7MWKwN2Yzo0rwfBv","tlshash":"7b2523cca0ecfe99c85db7b051ddef9068e3611929ef6770a32fe96990062c5113b483","first_seen":"2026-03-29T01:48:00.233641Z","last_seen":"2026-04-08T20:55:08.882568Z","times_seen":17,"resource_available":false,"data":null}},"time_used":166,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":139,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-BO2SIyJr.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:29.815Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/index-BO2SIyJr.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:29 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nlast-modified: Mon, 30 Mar 2026 12:18:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca6a12-2ca1b9\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:29 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2924985,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (39821)","md5":"21e5c33617a01866e33376ecf5511551","sha1":"94a9dff79fe1f2cb3448244a058aa7a976eed4ea","sha256":"1e8cee7ed7b0e9ae465198e8a494b4300fbd539bbb8159373cc1ca55fa4e124b","sha512":"af835ca5133c7fefe4c09d06236a66094112dee626a0816fed841b51dc74bfd9a5811b2622196a4558153c6b40376abf0b1f0ea11a04c7968178f09264611d84","ssdeep":"24576:Dc+M90xMTRVYeWH0StdMFmkbostGAnY4T:Dc+M90xMTRVYeWH0cdwb3QA/T","tlshash":"dd25179cb286b06253776861803f010bf33f2a49684dc890e27ae5d53e69e4dd167f7e","first_seen":"2026-03-30T12:23:10.093482Z","last_seen":"2026-03-30T12:31:33.20419Z","times_seen":2,"resource_available":false,"data":null}},"time_used":264,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":264,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/site-intqf/siteNotice/202603/a1018941be414cf0a487cdbe54e91dc6.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.019Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /site-intqf/siteNotice/202603/a1018941be414cf0a487cdbe54e91dc6.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 139295\r\nlast-modified: Mon, 23 Mar 2026 13:01:18 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: Pbqh4KOdcBX8D8PmaDYcezCQJkYvTiA0\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 11:49:10 GMT\r\netag: \"2e1e25c2e6539542cc13db6340ade5b4\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: WrF5wSoD7ElcuGS6I9Fz2ZlH0u71yLKjS7WucxHqjicB1QqRChlUPA==\r\nage: 2005\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":139295,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 500, 8-bit colormap, non-interlaced","md5":"2e1e25c2e6539542cc13db6340ade5b4","sha1":"cbf6316a62de45886f552d81692f37110a725c24","sha256":"afead483c08437e16722125906d4b0a935f314ee7066c8f152da4c87e2351622","sha512":"3038129609a8471f24302f758229c195c27e910793d7382461279e83ad7253c321b33b2427f1457821a102c022286fefe3ad2d677c93a32a96cdcb1f2fbb98fa","ssdeep":"1536:7miHRolVn/FsHQ8RA5qj9bxDJVHKKUa3Iqqs1n7/cnPQ+eqlV2KGWw2F0TebCj/r:SiUiw8TFhGeqmqIbqB7fbCbK/dj9O/5","tlshash":"dcd312634e698bf48478661b96d5719e00ae720c29a88d5bfb742f454bccfc1b7e3720","first_seen":"2026-03-29T01:48:00.178436Z","last_seen":"2026-04-08T20:55:08.879481Z","times_seen":17,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/site-intqf/siteConfig/202601/36987a28f75d4f9daecec6860888fa77.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.238Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /site-intqf/siteConfig/202601/36987a28f75d4f9daecec6860888fa77.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 21322\r\nlast-modified: Mon, 26 Jan 2026 04:42:40 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: 4VC5L422hUof5JRGa5O.l9eOEfXadjT_\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 11:49:10 GMT\r\netag: \"fd43cba637436f0ff41272148a952a5e\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: SKdjwvPuPvVeVYdKTFN7IsC6-HCkItg20g_PHthxVsS_-_wDN_MSJg==\r\nage: 2005\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":21322,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 368 x 100, 8-bit/color RGBA, non-interlaced","md5":"fd43cba637436f0ff41272148a952a5e","sha1":"0998ae892c19d573c094a1f4c022a87afa8d0c0f","sha256":"09dfc6b2d54a842fcef6f9456b94d9b88d3bfa54a6353071b3eb32d297123cc9","sha512":"c8196a56814ab34df47495876051a96c29beb5d24257427c4d142897a197925f74b6eeb2664161d3e6ef7e1c6e6715925056bceb97d1a7a8f659960528a2d192","ssdeep":"384:awVuWMK8I/0eisfqUdlDBHDF2lc/n+0x39pVIwUsKAqsDbWwzmpER3:TuWMKNEXUXh4c/n+0x39pVQsLnzmK3","tlshash":"49a2e161bf5cd7d4a93b30dc0a238260d7e7d326d61e22dad3412b41aa54b73127cb99","first_seen":"2026-02-24T07:43:44.885844Z","last_seen":"2026-07-12T06:23:16.113178Z","times_seen":44,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/template/sport/vi/WAP/icon/ssty.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.620Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /template/sport/vi/WAP/icon/ssty.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 2394\r\nlast-modified: Mon, 09 Mar 2026 13:13:40 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: RR2odtn8laarvaRKVKZjg4UcPhF2U6Eh\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\netag: \"1eed6cc114d9e1494a90e23757b5277a\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: bzyLzOT-p5_xOVPA_bF8UNJHTqAb4xjXAz78ceMKYQ2siYnWkBxYAg==\r\nage: 1295\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":2394,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 144 x 70, 8-bit/color RGBA, non-interlaced","md5":"1eed6cc114d9e1494a90e23757b5277a","sha1":"5a0003fb9c1c8d88d7642c8c6bc63aa59a7d651f","sha256":"7f4cdbbf6ed69e10b8f3863d22f75ae82e1e75e637f7dac37e01fd364d87dc32","sha512":"3a6842d397aa065954592b23788857baec3a09684cb255ff1221e54b6d83660453de63f565d1f008eddb08dd7d7519f485581b2e01559c690ad3bbee59d2d253","ssdeep":"","tlshash":"61411a72568065ef800edddc8c02cb0931f39e91ca035279fd72384a40d196e4b7bb2d","first_seen":"2026-03-29T01:48:00.231135Z","last_seen":"2026-04-08T20:55:08.92286Z","times_seen":17,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-K4eGEQH7.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.468Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/index-K4eGEQH7.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nlast-modified: Mon, 30 Mar 2026 12:18:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca6a14-aed1f\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: MISS\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":716063,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (65514), with no line terminators","md5":"2e67a8f811703cdaf5b6c117821434d2","sha1":"97ebefd8398c10b6e039a30f511bf6b459d2d6bd","sha256":"640fc2c40c9f5a48baa2868a9985ca5e15b5320ab0688e90f28efa6a13d2999b","sha512":"55b1093d7bd24530caefb86d86a475206dfb30fe62710581a34203b8d8ee879d2ef11e3b4772f24b94d80fc770ca5d926910c820b7876066287c9910844c5196","ssdeep":"12288:fZTJ0zYmS2gGMMyR9aFSaIHhqalitVEcqMx34eKzeNj7VOWv2vNGuzRzoYcfBi:fZTJ0znS2gJMyR9oSaIHhqalitV7qMxU","tlshash":"d4e47dd536a5942687e499cb94354512a3393e0f7808c0ecf97eadcf2e6ad05b03af74","first_seen":"2026-03-30T12:23:10.097849Z","last_seen":"2026-03-30T12:31:33.061323Z","times_seen":2,"resource_available":true,"data":null}},"time_used":530,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":530,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/api/game-center/f/game/getGameSupplier","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.438Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"POST /api/game-center/f/game/getGameSupplier HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: vi\r\nAccept-Encoding: gzip, deflate, br\r\nDevice: PC\r\nCurrency: VND\r\nFrontAuthorization: \r\nContent-Type: application/json\r\nContent-Length: 2\r\nOrigin: https://ydnaz.ksa9noa1-sdoqd.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2,"data":"{}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://ydnaz.ksa9noa1-sdoqd.com\r\naccess-control-allow-credentials: true\r\nx-remote-addr: 91.90.42.154\r\nhttp-geo-ipcountry: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4530,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"a562be0dc33eec7a1c897579136cad6d","sha1":"1dc16882608b6a3bd2bb0fb579f3e84e178bcab7","sha256":"f47707ab7fc71b98a521ea831c744ef0c730dacb78f48c3bf6efcc7faf12e235","sha512":"e418f9c3f2dff93d0f1a6a527c0a25e959818e1b5e971e7dd8bcf4ebb75c708f22bb828b6b458c0f480bb29d0a56947215120f45cd8f0f6fa3adf26ab8429548","ssdeep":"96:oaGzWoIGbseP/Pvlwawookw2P6c6xfZWL9wvCuITBQv:8PPlwawookjP6tfZWL9wvCuITOv","tlshash":"bf917f4de3049c5e22f2297779da24a428e8323bec921cb8d65e1def99fc74c9431e15","first_seen":"2026-03-30T12:23:10.099201Z","last_seen":"2026-03-30T12:23:10.099201Z","times_seen":1,"resource_available":false,"data":null}},"time_used":367,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":367,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-DJVWsiRK.css","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.451Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/index-DJVWsiRK.css HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 28 Mar 2026 03:43:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69c74e4a-81247\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":528967,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"67e582b3b33d57342ce9a9f6e244cf65","sha1":"442c2162ba6334e07fd7ec9a7d2feb865c326839","sha256":"55d7291691ab7e227de844dc1093cb3ea74ab4d726e60c3127b874b80120e3bb","sha512":"c6bce37ca6eecf1cd1586f423adc1e01f99a17953fc3d703014d01e5240ade34836e3787aa9f0b27a8609dc491a8a519207183885c251f694eee0da24f6fce68","ssdeep":"3072:E4MCKHNIC/0JuDoyKaV3DE3j0KYaGKMiNMC4rVCihO1gg/0JuDoDq0JuDot+Cw2X:Ilwa481125bH0G5Kl/","tlshash":"67b47255b58d202f54bbe33914a4b37d0a16bb12c90f5e7df5ab3a980b87387f290b44","first_seen":"2026-03-29T01:48:00.133704Z","last_seen":"2026-04-08T20:55:08.910704Z","times_seen":17,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/d_logo-BfF9f3i8.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.478Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/d_logo-BfF9f3i8.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:33 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-length: 54\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\netag: \"69c74e48-36\"\r\nexpires: Mon, 30 Mar 2026 12:32:33 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text","md5":"bc1080d98fb3d6a758ce20794c8fef35","sha1":"c9855ae87acfa7f9035abbad28b98350a49c4eab","sha256":"ab824e7246c7cdbfd29f4fa10f684b92954d2424e2b9a7d9243018ed01349717","sha512":"2fbd62a62eb57f9657d688a9f724cf434d8eb1184e41bae40ebf168c0d21d47fa7aaea56bbeb37cc5c34dc038d00e4fdd633a709249c4760e549488b7100dc0d","ssdeep":"","tlshash":"1290026d140508b0119c64888763d575144142587279565590156909ae51491550a820","first_seen":"2026-02-24T07:43:44.907329Z","last_seen":"2026-04-08T20:55:08.863515Z","times_seen":19,"resource_available":true,"data":null}},"time_used":719,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":719,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/site-intqf/siteNotice/202603/be7a18b8c42e40c9a64be40dbebe2d47.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.017Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /site-intqf/siteNotice/202603/be7a18b8c42e40c9a64be40dbebe2d47.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 151103\r\nlast-modified: Mon, 23 Mar 2026 10:43:59 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: 2iNJbs7hUox.sd49WVgYnmNgCZc7gVzI\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 11:49:10 GMT\r\netag: \"6c28d4f9a926c40cb0e456a647a60721\"\r\nvary: accept-encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: -l3bErh-oDsAdkX7H58wQkykuvRCKQL_MYImtL592A5FxkuvrpQ29g==\r\nage: 2005\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":151103,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 500, 8-bit colormap, non-interlaced","md5":"6c28d4f9a926c40cb0e456a647a60721","sha1":"c19e4a59abca2b125fbcd03ad06c1da32698832d","sha256":"62a06130a0cf2385a267487fbc01296e498dd5e4eade608ac343ed33ed3909e1","sha512":"9e209ee8ecda5cea7c9dbd0eed53ba3ad9b213e0940b9005acbd83f85efbd5090639e2b2810d524f524dbb10d597d9c57a004510e85b9ba738fc2971f87bd71b","ssdeep":"3072:HPW4rpjhm1RwXaFqRtUji9+t99iJuM6y4y/CVsr:drpeRwX8XB/9u6VM","tlshash":"09e3128d516288387ae0353c0727535de316c2fa4421d6d2f601afa4f8cb75ef299dae","first_seen":"2026-03-29T01:48:00.034738Z","last_seen":"2026-04-08T20:55:08.882014Z","times_seen":17,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/RoulettePanelPop-BpCGoQ3j.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.325Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/RoulettePanelPop-BpCGoQ3j.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/assets/index-BO2SIyJr.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 30 Mar 2026 12:18:26 GMT\r\netag: W/\"69ca6a12-77c\"\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1916,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"Java source, ASCII text, with very long lines (1915)","md5":"057ac2318dbbfa7532b02ccbd17e8459","sha1":"cfb06a76517ffed4ebb35f7434453b1efe987599","sha256":"e0e5bb6fbc7d6fdb0232ccd9ec7ab6a78658aed91378d198c84facbf8470205c","sha512":"353c7b5d588635e76e97f173a7514ee33ebeea1e238d0dff5c3c60cf9a4b92faf95f460e89cd530d76407d155f8dc7c810b3fa23f4725f60283ba6d8999a66c4","ssdeep":"","tlshash":"a241864c713681b688674fdce41c08e1e40cb3c86230b9d976e9086a3a519e6943efad","first_seen":"2026-03-30T12:23:10.103293Z","last_seen":"2026-03-30T12:31:33.128959Z","times_seen":2,"resource_available":true,"data":null}},"time_used":247,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-C_hTBnIk.css","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.456Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/index-C_hTBnIk.css HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 28 Mar 2026 03:43:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69c74e4a-1cad\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7341,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (7339)","md5":"93eebd7f1bb77540a7d1f4a003a8e68b","sha1":"b6d6615d7319b9e4812cad255fc8ac77e5734eac","sha256":"f2ca2cd14146104899fbc4f60d4eedd4a25a4ca2df7b532525a7f33c176b667c","sha512":"bd48f391a03198c175f50a055ca9ba67c9a59db8f5776d0bed90f5ec6a4deae2881238104b00f551027ba7cdb5e641a7448bf08b5a56888fe980d77e504655e7","ssdeep":"96:ogW7mnBZf9zA6dpyjJAiPuhOA21B5VPvpvLPsQ5sJPsjsrsh1sVsXhsys1EsmsEu:+E3f9EmsAhw1kirpk","tlshash":"bae1cba9666f236df652c32d648fda95fb2025e0412b07efb1d331b847ee91c06c7609","first_seen":"2026-02-24T07:43:44.931715Z","last_seen":"2026-04-08T20:55:08.861337Z","times_seen":19,"resource_available":false,"data":null}},"time_used":494,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":494,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-B4cP37dQ.css","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.460Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/index-B4cP37dQ.css HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 28 Mar 2026 03:43:05 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69c74e49-7c26\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31782,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (31781)","md5":"77154cb742807a3cfa7624aa86ad386e","sha1":"63b5046f9c973d6314417f74c910ab538e41e680","sha256":"475c7b6bc2952b44669c9df00866e661c0650f2e536ff37dfca560602083db33","sha512":"c976152245e674caa464edaaee8989472c2aac314c3cdd85cd1f828632f1ebf8ff7b64c96369016b9263aa5994b6e9e274241c68c8cedfd7aaaac03a5d96233a","ssdeep":"384:sySScMCYXK4Hso4X6KJpjp0RIkHjuvCGaTH59pQyMVVQS:sySSGYXK4Hsos2BGkg","tlshash":"42e2bb1c9ac710dbd9bee37535a0db96bb936c80c28f8677a371311c470e9ee25e1609","first_seen":"2026-02-24T07:43:44.837396Z","last_seen":"2026-04-08T20:55:08.869682Z","times_seen":19,"resource_available":false,"data":null}},"time_used":491,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":491,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/HomeTimer-BOYKdl1g.css","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.462Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/HomeTimer-BOYKdl1g.css HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69c74e48-fc12\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":64530,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (64529)","md5":"c965eee071727bcc69362ebb6c2ace1b","sha1":"6164129db24ca35d9254ed3aee6442033e8e90c3","sha256":"0eacbf1b01380a40dac39effadef66bafc19ea8e0d17249eef0a2982172274d8","sha512":"0281ceede21d064e9bcfa033351c656458a465f6ac9441831b468e8c81f1cd9482f58a08f5ab35ac7db4a6cc4f1eb6b381fe16b731881b07a668510824f8c092","ssdeep":"1536:/lpIPPagh9EX5TrbknPeC94mUEaa5jvMfO:YvMfO","tlshash":"fb53cb94b5dd001e5eb7eb351c54f6790912faa28e0f1d29f1f23ba84a87b8761b1f04","first_seen":"2026-03-29T01:48:00.130746Z","last_seen":"2026-04-08T20:55:08.838252Z","times_seen":17,"resource_available":false,"data":null}},"time_used":489,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":489,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/sponsor-DJBtmVqB.png","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.381Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/sponsor-DJBtmVqB.png HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/assets/index-CRClkQwT.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 42900\r\nlast-modified: Sat, 28 Mar 2026 03:43:07 GMT\r\netag: \"69c74e4b-a794\"\r\nexpires: Mon, 30 Mar 2026 12:32:34 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42900,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 940 x 140, 8-bit/color RGBA, non-interlaced","md5":"c3b154658c2ad8d3bc5dec6294a86c36","sha1":"85097a92a7234c4bbd83e7d6d4576d5e566492cc","sha256":"000f01845aee5a632b4d801252959c1dbb974f2ad355c16f27f69400b699107e","sha512":"3132eac15672eac23c1cd6e340aaf96f83fd98904b6635e17a1a6b030979c218ff81c768594e21de64e063eb1b810eee6a756e7bc18d04f0f60d20ba4886c486","ssdeep":"768:WhLJdyS1n/B3yMqQ5AC3Rt7HV7+j02PUSg4SrLL+MWXSgYhvhTo6D00qLVsqFuMu:UJcS3nNRt7RV2PsrPL+XSjbToT0+slw2","tlshash":"7c13e24fc09989a5e50e2387ff47160bc709285a563a22783b4b4aa977e70ccccb5477","first_seen":"2026-02-24T07:43:44.850498Z","last_seen":"2026-04-08T20:55:08.830107Z","times_seen":19,"resource_available":false,"data":null}},"time_used":261,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":250,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-30T12:22:27.055Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:29 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 30 Mar 2026 12:18:29 GMT\r\netag: W/\"69ca6a15-1387\"\r\nx-remote-addr: 91.90.42.154\r\nhttp-geo-ipcountry: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4999,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (390)","md5":"3412b3ede4c8212db49f4fd8b971ae7b","sha1":"ed0cf13e933263050dca1054dc8e07fcc6cb849f","sha256":"93852183d261fc52f6d027907c5ad92a4091729df96f22bbdc14dc7ddc009904","sha512":"75321ea6422fd595bd31279039474fa739366afd89adb74d181f4e1b612f3702d184ea14ad7607ece7e67abc9fa99154d534fa123b0e63ae587e7612f3ee78d0","ssdeep":"96:rsuPWpSeLSeLBEeLurtDOL5ngSZRFrUr01:ZrtDOLbZjrUri","tlshash":"ffa185565be0a0596a65412d42eaf00c1fd6d08fd314dca476cc62ecaf91ba0ca77bdc","first_seen":"2026-03-30T12:23:10.107666Z","last_seen":"2026-03-30T12:31:33.177603Z","times_seen":2,"resource_available":false,"data":null}},"time_used":4849,"timings":{"blocked":2248,"dns":1288,"connect":248,"send":0,"wait":353,"receive":0,"ssl":710},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-B412kKvN.css","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.455Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/index-B412kKvN.css HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69c74e48-ba7a\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47738,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (47736)","md5":"ac357b8c56cadb8e1a954e3b7ad9fab4","sha1":"3f26b92bb4fe8379b7dc9835bc44a819868e9de8","sha256":"bc20b45979ea3ec449896e063065f4e7324525f0b5ddffecf8b95b051fe61cf2","sha512":"2934143f1755cd506ff28b048598134f1a4edf6714058354d2c0e4f3e875048c8ee7becc3a74a17becf662e1b1841fee745810d9f487daec0001c0fb277318b4","ssdeep":"384:RP3kZIU5vlc0bfxKefi3g+eH9VuA+B+Aema8NC0UiM7:RP3kZIU5vW0bfxKefi3QkzN5DY","tlshash":"60232e68cb83315bd2a7d73628f77af68c218763808f49bd63e370558b4954e02d3ca9","first_seen":"2026-02-24T07:43:44.892623Z","last_seen":"2026-04-08T20:55:08.902838Z","times_seen":19,"resource_available":false,"data":null}},"time_used":495,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":495,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-DJPDMDWt.css","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.465Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/index-DJPDMDWt.css HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 28 Mar 2026 03:43:06 GMT\r\netag: W/\"69c74e4a-13b9\"\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5049,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (5040)","md5":"09d8281b7fb268ca866e7949bd060220","sha1":"6dc9b84abdb57c29326e33400f21bfb4b76b49fd","sha256":"228e9667b12853df56f546ffee67a64b443b7a600e52174a3e07ba3f6c5f3d3d","sha512":"c114e43e25a875e06b3069591ba40461e6070eac0c2cc171252f572d03d9410a558168c599bd2a56cfd8e627e78219213c5a176d1661faa9f88aa08347a8a965","ssdeep":"48:b3h2qPsz9I1Q6b4cwFtvaAr8rAUKHKTSt9DtgF6:bhEz9IvQLKTKvJ","tlshash":"5ca1211c35da654ac8aa8301ae93069ab9ebfd50a67d0584f3f3730047cdfa40ed998d","first_seen":"2026-02-24T07:43:44.863043Z","last_seen":"2026-04-08T20:55:08.838732Z","times_seen":19,"resource_available":false,"data":null}},"time_used":486,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":486,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/ber-finish-6xQoqTKO.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.477Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/ber-finish-6xQoqTKO.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:33 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 28 Mar 2026 03:43:05 GMT\r\netag: W/\"69c74e49-c9f\"\r\nexpires: Mon, 30 Mar 2026 12:32:33 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3231,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with very long lines (3230)","md5":"0f98b0616c69e7514f0b4c90c9d24667","sha1":"ff1ae970c70207426088b59362f7f3d7bbca7c62","sha256":"2249ce17b324b0cd28c4184e85d6565e059770b558be269d4c7e5e2d357733a5","sha512":"eed4b3c726ecd8a720a495ef0a48031ace59411640760e33b405803aa4dcdbd199b166844724dceffe71dd0b7a5f0992c31ab2d0eca2b7f4c373283ff3d07ec4","ssdeep":"","tlshash":"80615bb85a061e209bc34deeffa7b424fd185f27e3d2918002da5f242b1f5b69036021","first_seen":"2026-02-24T07:43:44.84853Z","last_seen":"2026-04-08T20:55:08.81672Z","times_seen":19,"resource_available":true,"data":null}},"time_used":720,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":720,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/timeZone-Cees-9Pj.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:33.697Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/timeZone-Cees-9Pj.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/assets/index-K4eGEQH7.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:33 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-length: 733\r\nlast-modified: Mon, 30 Mar 2026 12:18:26 GMT\r\netag: \"69ca6a12-2dd\"\r\nexpires: Mon, 30 Mar 2026 12:32:33 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":733,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"Java source, ASCII text, with very long lines (732)","md5":"69cbe55088b0261da8a7607d087d5aa0","sha1":"5534056c88aa178782b459eb04f517508095f4b0","sha256":"d1800375168257952fcff8b0c275f5c31e6e0dbe32d623c5742d5edecc5bb5d5","sha512":"6ddec36fcf4813dc736904a267b063204a6c5c0f4d224bf7472d013f4e8359cce24507fce6ed7fd3d926504a7b7990caed007e5e0b88b6ed26291b499ca54519","ssdeep":"","tlshash":"8d019c4a4860cab2b23505acb1bdb7807e25f860f6564a18661898213f3308979bff4b","first_seen":"2026-03-30T12:23:10.07214Z","last_seen":"2026-03-30T12:31:32.95727Z","times_seen":2,"resource_available":true,"data":null}},"time_used":248,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":248,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/d_logo-BfF9f3i8.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:33.704Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/d_logo-BfF9f3i8.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/assets/index-K4eGEQH7.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:33 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-length: 54\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\netag: \"69c74e48-36\"\r\nexpires: Mon, 30 Mar 2026 12:32:33 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text","md5":"bc1080d98fb3d6a758ce20794c8fef35","sha1":"c9855ae87acfa7f9035abbad28b98350a49c4eab","sha256":"ab824e7246c7cdbfd29f4fa10f684b92954d2424e2b9a7d9243018ed01349717","sha512":"2fbd62a62eb57f9657d688a9f724cf434d8eb1184e41bae40ebf168c0d21d47fa7aaea56bbeb37cc5c34dc038d00e4fdd633a709249c4760e549488b7100dc0d","ssdeep":"","tlshash":"1290026d140508b0119c64888763d575144142587279565590156909ae51491550a820","first_seen":"2026-02-24T07:43:44.907329Z","last_seen":"2026-04-08T20:55:08.863515Z","times_seen":19,"resource_available":true,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/template/common/service/telegram.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.196Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /template/common/service/telegram.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 2708\r\nlast-modified: Thu, 02 Mar 2023 11:02:06 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: 3VB4LE8I9bwZVilP2Bua9h_DLa_et5Bi\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 11:49:10 GMT\r\netag: \"f4dd1894d9727722ddf4411e990f83e4\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: 0ba3uNgOkaem3bV_v1C5bQ-6HlUv8fttw4ygVrYUlWc7O4q2GVb8CA==\r\nage: 2005\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":2708,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"f4dd1894d9727722ddf4411e990f83e4","sha1":"f4e844f1c4b9fff6664074dfe4d046a735f8e740","sha256":"5eeeb4fb7b1e909d6d870302ea218dd6e290820a9a0c40ba0ee58f25ce5c0bf1","sha512":"a9997a6fd6e9e573853d26748676174b7efb6644d00485aed14401b95499f608d41edee17d4e90aa8fe7e212e4bb14e2e6b014a0ddf918c70bb96ac3219de91d","ssdeep":"","tlshash":"a4512baff6371d6da0c661b7e12761f87e1d9ef57ca666454e0ab03e10644c24e11381","first_seen":"2026-03-29T01:48:00.124534Z","last_seen":"2026-04-08T20:55:08.825473Z","times_seen":17,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/bus-pay-2-iI-AEjAD.png","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.211Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/bus-pay-2-iI-AEjAD.png HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/home\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 6351\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\netag: \"69c74e48-18cf\"\r\nexpires: Mon, 30 Mar 2026 12:32:34 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6351,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 304 x 302, 8-bit colormap, non-interlaced","md5":"91b1ae988e96acbd835845b22ff128b8","sha1":"7f12f9a86d4e8c56f8dade9d5e3601ede233c82c","sha256":"d21571514ad045d568ae19bfa1ee6816f0bf07afeb1f2b1226c8d50268443f35","sha512":"b4dc53212bf76c5aaf1aa51652c1d07ff7d9a188217d6ced21355640e9673e3438a2c966310ec02374e38bbc2bf4479681a717323c9ec0f3ca1e5d7a0daa9f46","ssdeep":"192:F2/Hwfr9ukTccIT4RwQlCztJyNkTmTW6kuAN2NFZ:UHwD9ukT4T2wQlDNkGWm7","tlshash":"a1d17def9147346dd2799a3fda2eae4fcb59090022a130d45bbde45c7c067b8598e207","first_seen":"2026-03-29T01:48:00.213632Z","last_seen":"2026-04-08T20:55:08.877662Z","times_seen":17,"resource_available":false,"data":null}},"time_used":248,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/api/site/f/siteNotice/queryList","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.422Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"POST /api/site/f/siteNotice/queryList HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: vi\r\nAccept-Encoding: gzip, deflate, br\r\nDevice: PC\r\nCurrency: VND\r\nFrontAuthorization: \r\nContent-Type: application/json\r\nContent-Length: 2\r\nOrigin: https://ydnaz.ksa9noa1-sdoqd.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2,"data":"{}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://ydnaz.ksa9noa1-sdoqd.com\r\naccess-control-allow-credentials: true\r\nx-remote-addr: 91.90.42.154\r\nhttp-geo-ipcountry: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1955,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ddd23c04bdde6bb2c1c23cd0ad5701fa","sha1":"7e996fc50ee5ef7b692718a0ece18677cac708e3","sha256":"b26159a820ff71e453488a2d9b1e84984116274270a32f817c522e2b0002339a","sha512":"1442fbc8d9f990b18a67bc53235efef9ca89ad7ed2324f2b52f52f401558d7e47bd7e7a66d2791a46baec4b09f89d510e6a1324865a4b93f7f3965b61a0fd777","ssdeep":"","tlshash":"2341330b8bf4ea9e9d9103c662f3fee142c13446c0d1ca4c31ac3d5da48b93b070a217","first_seen":"2026-03-29T01:48:00.23023Z","last_seen":"2026-04-08T20:55:08.922364Z","times_seen":17,"resource_available":false,"data":null}},"time_used":310,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-CAaPVfO3.css","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/index-CAaPVfO3.css HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69c74e48-73bc\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29628,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (29627)","md5":"f1e8992295128c6b6af7161cbc99f884","sha1":"05b12f22453cf2404bab2c3d444063f2335a12c4","sha256":"2c0f7f0d597df970a011a85f24b05c532cfbf3e6cc28f0401014fbafd12957bb","sha512":"5e5fc8c38bf67264d0d703102b98abccc9592b5298a93d6e10322c51e690274ffbac253a4c1869f2440915bb596441e8470f69f5c159888ad9a0674fe554984e","ssdeep":"192:JfuIV6urYallQu94ktdpn4UkiZ86bmYuRE6lNkHYDyD9DvQNilll7/jutcfXyzWH:xuIVdN5lq9MCQ","tlshash":"4cd212c47cc6043daee1e3761999dd9987796f309b8e1d2963b6737aec0578a32e1300","first_seen":"2026-02-24T07:43:44.932883Z","last_seen":"2026-04-08T20:55:08.918901Z","times_seen":19,"resource_available":false,"data":null}},"time_used":492,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":492,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/empty-white-BjL230TF.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:33.702Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/empty-white-BjL230TF.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/assets/index-K4eGEQH7.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:33 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-length: 97\r\nlast-modified: Sat, 28 Mar 2026 03:43:05 GMT\r\netag: \"69c74e49-61\"\r\nexpires: Mon, 30 Mar 2026 12:32:33 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":97,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text","md5":"3dea6937be1184ad628dd27202632b04","sha1":"8604f80ccf3d36dea78d62cabeec77af0b0028cd","sha256":"6c8cd179af0cc07eca46ab0d96db2630262db825648aace79a811ece018fba41","sha512":"3be0784c2b202905376a8ad10c61efad7965ef25c408fdcaadf8f1f0b00568ec997763931c749a7567fa774904f27853aa189ccb39a4cdb314f925ee7856b200","ssdeep":"","tlshash":"4ab01281a80088b0511cf8644121d65891089281f524c6af9030d249e51a4104a0bcb2","first_seen":"2026-02-24T07:43:44.847491Z","last_seen":"2026-04-08T20:55:08.829069Z","times_seen":19,"resource_available":true,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/web/sport/left-C-GAME.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.273Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /web/sport/left-C-GAME.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 5059\r\nlast-modified: Thu, 10 Apr 2025 09:34:30 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: EmTyxbHYFgmUKadCVfWobId89WYQ6atb\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 11:36:27 GMT\r\netag: \"61af82fc7d21f895643363b0e55fd3f7\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: tr8o5rpmVV9V1TCaFroHjGuMyKYHKpbQVube39U3edjoM76gAF8aPQ==\r\nage: 2768\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":5059,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 104 x 104, 8-bit colormap, non-interlaced","md5":"61af82fc7d21f895643363b0e55fd3f7","sha1":"d027c8b97723533ca9cd9775325286792fba57bb","sha256":"6eb7feb4719fc770fc282aab78728e75cb4712908a8460004557a7a61b47b4f7","sha512":"d985b9505ea3cfe4864481a5a4184f8256be1200b70351381c72f4dc06b8e20c6d0816963ed64263f8777acf37a9e2ee721536e6643cfa5a09337af687595213","ssdeep":"96:+tsRIkQ9S1ki6QuR0ET8FxtpsSgglvcNAMhy/vLozR8YwVAlJLtze23xncOJaIu:awIkjKidueET8FxnsAmViozfwVAPq230","tlshash":"55a17d952dc03690c6241eb1a732ad11be9a21a79d49c74bb8cf8d10ead0ae6d414e37","first_seen":"2026-02-24T07:43:44.895331Z","last_seen":"2026-04-08T20:55:08.867037Z","times_seen":19,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/template/sport/vi/WAP/icon/crown.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.629Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /template/sport/vi/WAP/icon/crown.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 19618\r\nlast-modified: Tue, 10 Mar 2026 01:58:27 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: NKe9_EtG3om8Qd8Zfc.n8tEaqgACEwXK\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\netag: \"0b2043705bf9d1b82d0fcc822bb1f751\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: mfhC2Q8a1KMVlzsV4KdYSkwV2nBiI5X9nbpXDfTbpRluc7XxCva3XQ==\r\nage: 1295\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":19618,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 230 x 135, 8-bit/color RGBA, non-interlaced","md5":"0b2043705bf9d1b82d0fcc822bb1f751","sha1":"12db6b34329021a6920d1d33ec0dac405a071839","sha256":"fbf78e99b67d59e93de3fe7dadfdbb1639fb15a5f2e70e8cee75721f2bfd85cc","sha512":"74148a3a75b6ed02816de4902ec1a9a813c62511758a586b3e4ebe3de583637a43d2acf95408356e10f7848a9ca9af1c892381f4e7c737e3896611a1a7b66514","ssdeep":"384:cVpPt1tmkvqK2yeOIP/wl9ejiR5gq0tCn1U5AZkC4ZF:up1bvBiP3wqs5gZA+5AKZF","tlshash":"b692e1cbb31b3385b97441a58043356db8b3ea79603d4ddf84e6c0e6073b9259c89bb5","first_seen":"2026-03-29T01:48:00.210278Z","last_seen":"2026-04-08T20:55:08.845447Z","times_seen":17,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/api/game-center/f/menu/getHomeMenu","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.431Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"POST /api/game-center/f/menu/getHomeMenu HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: vi\r\nAccept-Encoding: gzip, deflate, br\r\nDevice: PC\r\nCurrency: VND\r\nFrontAuthorization: \r\nContent-Type: application/json\r\nContent-Length: 2\r\nOrigin: https://ydnaz.ksa9noa1-sdoqd.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2,"data":"{}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/json\r\ncontent-length: 10453\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://ydnaz.ksa9noa1-sdoqd.com\r\naccess-control-allow-credentials: true\r\ncontent-encoding: gzip\r\nx-remote-addr: 91.90.42.154\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":139288,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"0bb6c972d0527eb7e9be0ed4091187a0","sha1":"5d3e5d9fb50a3dbbf27caf2056f6a5671b0f8588","sha256":"c9b2c1b8de12867f03845f35d2449173e1447c13cb134a25ac6aa1abcceb6103","sha512":"4a6c2a31c93eec425ab14e36b20c79e3707d81bf3aba1bf567e7c7f9102a8b2f72620d5685663237a98a2d9358373e47bd0f9c9c6dcdd5c69a65e547afa08205","ssdeep":"384:CDp15Q+C+7td17G93DBEhlejKO31dEgC6591SM2EIs6MQu9uPKao/+nOWdiBIFwH:YXBTwkU+Q6V9UUrXBfmX","tlshash":"8ed39d9ac224cc185b2f12f665eb3594b5e92247ccc4ac7ae18e4f7bc5ec33ba305546","first_seen":"2026-03-30T12:23:10.117087Z","last_seen":"2026-03-30T12:23:10.117087Z","times_seen":1,"resource_available":false,"data":null}},"time_used":375,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":374,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/api/site/f/sitePageConfig/queryList","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.440Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"POST /api/site/f/sitePageConfig/queryList HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: vi\r\nAccept-Encoding: gzip, deflate, br\r\nDevice: PC\r\nCurrency: VND\r\nFrontAuthorization: \r\nContent-Type: application/json\r\nContent-Length: 2\r\nOrigin: https://ydnaz.ksa9noa1-sdoqd.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2,"data":"{}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/json\r\ncontent-length: 82977\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://ydnaz.ksa9noa1-sdoqd.com\r\naccess-control-allow-credentials: true\r\ncontent-encoding: gzip\r\nx-remote-addr: 91.90.42.154\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":640778,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"cc45c37954b76b09cc4356c4bbc5e69c","sha1":"77753573188533ea6b49059bcf1b89ffef04567a","sha256":"da43f8a7a92e3fc6cb93ff8d86ca18192c3e45c5e378af1aae58a36f2119b99b","sha512":"ce3ea470f866d462b301cc3a60b67ee72d7d9a6aa654e21af4007d830cf27f7c818d4f59bbc3c80ce4cac33c40e58d65c0c31c5256bec092d75e0e1d96d02c47","ssdeep":"12288:+r4rtAxi7fWtvYcPteSS5lfnIHqZVx9BdEXW8ssJYbKFF:6otAxi7fWtvYcPteSS5lfnIKZVx9BdE/","tlshash":"02d4340293d4b1114a2cc5ecd0bf3b646ec6541ceb925fbc6fbc56786a4c8a536326ce","first_seen":"2026-03-29T01:48:00.245263Z","last_seen":"2026-04-08T20:55:08.842175Z","times_seen":7,"resource_available":false,"data":null}},"time_used":555,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":501,"receive":54,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-DEQCjo-d.css","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.464Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/index-DEQCjo-d.css HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69c74e48-1f686f\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2058351,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"6b4ce48416711ca407cda8cac4f8352d","sha1":"456c3dbdf0513321633ffd731d89a65800f61497","sha256":"ce7a3117fdf4bd4ce5aef542df378c90c54ca486a9fe40ccd7c99e7e7c72760a","sha512":"d33f2bd88738f9086194b3f1bfd6e572ef5e8c3d98c8d988f87fea034c3e94381163f5de74bb577223f1d47c6eb25ff40486fb8402704dc4ee6330ab4d4de9a5","ssdeep":"1536:/r7m5xACXXmBDlFR6JlI4j20qEIwLa6SUL7pE7reJZYKfPOhjtFBCRtAQ7WUSsYg:n6SUL7p0aekrxfIwr5utTnQwzD4bEm","tlshash":"a0257184f59d011e64b7e77124a4b77d0a23b752c94f1e7aa2673a8c0f476cb73a2708","first_seen":"2026-03-29T01:48:00.064303Z","last_seen":"2026-04-08T20:55:08.858507Z","times_seen":17,"resource_available":false,"data":null}},"time_used":488,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":488,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/bus-limit-2-DQidePQr.png","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.222Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/bus-limit-2-DQidePQr.png HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/home\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 9153\r\nlast-modified: Sat, 28 Mar 2026 03:43:05 GMT\r\netag: \"69c74e49-23c1\"\r\nexpires: Mon, 30 Mar 2026 12:32:34 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9153,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 108 x 60, 8-bit/color RGBA, non-interlaced","md5":"c6fe8a89c6246f127f783e8f01620c82","sha1":"fd1e2010577d773b320f9ec537fa83c182526a2b","sha256":"c93c82806858d9c4016d2e98e32cdf838c8ee2d39b1bce2600d9caa34f50096e","sha512":"58311d1997281efdefd8bd45d0a397d967b5cb9d3a7c9aa6455e5a9388af3aa7a42675af53f463d9408cf554f995d7f0cc0f8d298ea1bc8d30a475140fbb99f6","ssdeep":"192:FCOGCe3xwSWpV18o7J2h5A/opWDTi9UZVfZz90tZ71s57YCSfou:jNRSeXKeopQTUKB50bps57vSfH","tlshash":"3512c0268531c6b117420de5f005c9291bf601a9d67d03eb8d7e20bccbf64b95ab35d1","first_seen":"2026-02-24T07:43:44.928068Z","last_seen":"2026-04-08T20:55:08.885155Z","times_seen":19,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":258,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/club_2-BAQ3YscC.png","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.242Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/club_2-BAQ3YscC.png HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/home\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 4936\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\netag: \"69c74e48-1348\"\r\nexpires: Mon, 30 Mar 2026 12:32:34 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4936,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced","md5":"283b390cdcc80bc9784834928b78191c","sha1":"54b73c3fceadc210b552d1c5ab32e9aec2b1d035","sha256":"79e62a9305a0d0969d6ae3fc3971213a443491e9253c258c5fe3e336d2349e72","sha512":"9fec8250d9fa1275654e4fd60910a7d87a3fb05256961fa3517a6576e7d29cbd8ceca74ac1559c3098ce5555e9436b7933527519feffb7b99254eeaf2843f586","ssdeep":"96:K579Z/3zu3KXfM+qtWjlvYS0FVsIHvb7egdU7LJojv1oudQFsUk:K579Z/5fM+qOvL0TsCeH7UvDdQFW","tlshash":"57a17c895f7f3544f399af2d931f628721a487a9a18018e001e50eee19082d2b4c92e2","first_seen":"2026-02-24T07:43:44.878079Z","last_seen":"2026-04-08T20:55:08.9044Z","times_seen":19,"resource_available":false,"data":null}},"time_used":256,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/web/sport/left-S-GAME.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.255Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /web/sport/left-S-GAME.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 5311\r\nlast-modified: Tue, 08 Apr 2025 05:46:55 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: UrZvnTXPR7DGbgX5eBk0dlKUVkWIV9JH\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 12:09:45 GMT\r\netag: \"231d2afa8aa63903b85e60fddff0ebf4\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: JWNeLgFZ62lawPWO_ItZ8PhFghGzO8kyaDBPfuby4QUKVHaQxUdKUQ==\r\nage: 769\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":5311,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 104 x 104, 8-bit colormap, non-interlaced","md5":"231d2afa8aa63903b85e60fddff0ebf4","sha1":"7e78705923c1fc09c067f1cd54cf2cfac370630c","sha256":"6b0fefea18926f9ad7d6c294a22e50621c1325053c045a956c1ac809cd610061","sha512":"39fcaf9929e6c4caf5dd5a94c8fa725d57b68b01d7698b58ea3b9bbaec664a2a557ed558f0088c89e3d8c9bc0337dbd209b709956cff46332ffeb9d2a838c31d","ssdeep":"96:gaVKXUaaXj3d4L9/2nCRmLAT2c+YVe+No4Z6bLoWeTWIYYE0:8XUaaT3d45eCkLAYqTNTEWY6","tlshash":"07b15ce9a713dddd8f0f3ae3d20f2852ea288ebafdc91860b01cc10e45548d3765a564","first_seen":"2026-02-24T07:43:44.899406Z","last_seen":"2026-04-08T20:55:08.837221Z","times_seen":19,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/api/game-center/f/sport/querySportType","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.518Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"POST /api/game-center/f/sport/querySportType HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: vi\r\nAccept-Encoding: gzip, deflate, br\r\nDevice: PC\r\nCurrency: VND\r\nFrontAuthorization: \r\nTimestamp: 1774873354\r\nContent-Type: application/json\r\nContent-Length: 185\r\nOrigin: https://ydnaz.ksa9noa1-sdoqd.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/home\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":185,"data":"{\"params\":\"P5EHx9Q91xGwILLTyLdk5ob+1HmmToQpmITjzQpJTMSMdXec7qCMTn/1UjSuwVbBgM0h9ACbh7A5VlpsyVs1JZDJqdl+xX1UdXQQGj5n7HXPXVlj7RmYB/fybU+TkA6F5QllmjMXRvJKy5u/m7OSXdY1+D+9ocLryRvha2UfwMU=\"}"}},"response":{"raw":"HTTP/2 400 Bad Request\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\ncontent-type: application/json\r\ncontent-length: 54\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://ydnaz.ksa9noa1-sdoqd.com\r\naccess-control-allow-credentials: true\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"bbff42da60fd2397b7ea5035a41e300c","sha1":"7741074b77cc426f53d2b9224f7af8fc768d987c","sha256":"a18e6fa1acdf9f6fa0adf569c2ff0ef2b7d1f31311cf5f92252267c14c6de485","sha512":"e7813b1118881e4e6943e3728d76ad9da408813a9e150e8dcecd382e3dbf9b081f784259950934b09ab559ff6ad457f782b69040b3305cc44b8d06de4b287a33","ssdeep":"","tlshash":"13900250b1a84643d52209daa54c5d45a5a97856269566422e9c112083644414d04661","first_seen":"2026-03-30T12:23:10.122647Z","last_seen":"2026-03-30T12:23:10.122647Z","times_seen":1,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/template/sport/vi/WAP/icon/im.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.627Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /template/sport/vi/WAP/icon/im.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 2477\r\nlast-modified: Thu, 15 Jan 2026 02:54:47 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: oW4c61XIG0bTWJme4pecwTg5Yyis8S8T\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\netag: \"627ed57294425a4f625d62a5aa791c93\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: OgK3fhW1WaAFr8WA7iF1ROWJqc0_eEa4CD84wOV72A40p5A97Qh5BQ==\r\nage: 1295\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":2477,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 84 x 60, 8-bit/color RGBA, non-interlaced","md5":"627ed57294425a4f625d62a5aa791c93","sha1":"305cc934ac0305b1ff3f845dff19388a6a696c56","sha256":"510023d446a7e4490e0c8ed72d5ace45b66d6a337bd97f14f1bab2da5b3084a0","sha512":"9123cc671ed3de04eeb954c8473ff4f4c3f725d6384c3ecbb81e6d49532586809c0d40c63018644bff25c3289443d8413398c964d6637ebae8cc8d9897a6fa4a","ssdeep":"","tlshash":"e4514d9dca7030d802122b5002297c0ae17c5b0d03e46a99fd4c0965bb09ec17c93f93","first_seen":"2026-03-29T01:48:00.246163Z","last_seen":"2026-04-08T20:55:08.86761Z","times_seen":17,"resource_available":false,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/empty-white-BjL230TF.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.474Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/empty-white-BjL230TF.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-length: 97\r\nlast-modified: Sat, 28 Mar 2026 03:43:05 GMT\r\netag: \"69c74e49-61\"\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":97,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text","md5":"3dea6937be1184ad628dd27202632b04","sha1":"8604f80ccf3d36dea78d62cabeec77af0b0028cd","sha256":"6c8cd179af0cc07eca46ab0d96db2630262db825648aace79a811ece018fba41","sha512":"3be0784c2b202905376a8ad10c61efad7965ef25c408fdcaadf8f1f0b00568ec997763931c749a7567fa774904f27853aa189ccb39a4cdb314f925ee7856b200","ssdeep":"","tlshash":"4ab01281a80088b0511cf8644121d65891089281f524c6af9030d249e51a4104a0bcb2","first_seen":"2026-02-24T07:43:44.847491Z","last_seen":"2026-04-08T20:55:08.829069Z","times_seen":19,"resource_available":true,"data":null}},"time_used":482,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":475,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/site-intqf/siteConfig/202603/8e06bed1ec5f42da9b813dc36e0e48e9.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:33.213Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /site-intqf/siteConfig/202603/8e06bed1ec5f42da9b813dc36e0e48e9.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 43602\r\nlast-modified: Mon, 16 Mar 2026 13:25:05 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: _YptDyWaw5vDE8WdKpNSXOgpFYMKnC_E\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 10:26:47 GMT\r\netag: \"c081f4426cb4edefe9b6cfb1b38479cf\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: -2oFcGBVvs_L8y_GqtidjpT9E4q8V_-REnPd4FiCUqHFOFv1Za1ZxQ==\r\nage: 6947\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":43602,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"c081f4426cb4edefe9b6cfb1b38479cf","sha1":"485cb55733599d878b515569f2f40f3c05bed82d","sha256":"9034e437b66adaa67b29b51b6f4210e7cc6627f6bcfe0ca855d7144211b2854e","sha512":"cfe5c4fcd495f88c8a9eb99eef7394d10a05b09f0b60168b1f426ecdf1cf463c365b3b1144ad06c638ca3a5938acab5ca3edb335aaf4a03be74b74623a3b2316","ssdeep":"768:6SBKi47BEJM+NNtxepvfyMssYd00captRRIWegOnJRbC3eXCVKthiAbSUlka:6SBKiSBEJMo7xe5fyjsYdqadILgSdpC6","tlshash":"f913e14662004562e48a89b51a03cf9793622974cbbb6757f66af0f1b4c2dc0eb8fdc0","first_seen":"2026-03-29T01:48:00.255992Z","last_seen":"2026-04-08T20:55:08.872329Z","times_seen":17,"resource_available":false,"data":null}},"time_used":304,"timings":{"blocked":-1,"dns":116,"connect":1,"send":0,"wait":25,"receive":3,"ssl":159},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/bus-pay-4-CFb9VGxa.png","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.215Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/bus-pay-4-CFb9VGxa.png HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/home\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 34937\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\netag: \"69c74e48-8879\"\r\nexpires: Mon, 30 Mar 2026 12:32:34 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34937,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 319 x 319, 8-bit colormap, non-interlaced","md5":"5513de343fc97e96006e14fae1132c4d","sha1":"f4c74535227dd3117c3090e36fe83a12f00d3558","sha256":"c9ab35a0baf8b76abb62fe7e6cb03dba87addbe07617a8bdd9f914975d78007e","sha512":"cf7003ddbdd7d5b230124d00e5204ba43d51af44b707bc3c52a438ea96351072b20f0c68b635eafc36b3f8dee2f066a2b7919a49e6c8e3302a03a878182b09e6","ssdeep":"768:Fz+/9/27guwQiyuc22jOy2F8ZRyQEACM3kihDr:8/NduwQiEljZ2yIJ0FH","tlshash":"cdf202d7eb7f014f079b0544c9ac6b21d1ecdd08a67fd3a9839b9aa21f0f3614109674","first_seen":"2026-03-29T01:48:00.223969Z","last_seen":"2026-04-08T20:55:08.917275Z","times_seen":17,"resource_available":false,"data":null}},"time_used":256,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/bus-limit-1-DjCpZCHi.png","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.219Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/bus-limit-1-DjCpZCHi.png HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/home\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 11812\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\netag: \"69c74e48-2e24\"\r\nexpires: Mon, 30 Mar 2026 12:32:34 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11812,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 168 x 56, 8-bit/color RGBA, non-interlaced","md5":"63aedfdade53a6a7970d44ef5be1ba9b","sha1":"f2f0fe191d0e69839ffcae37c9b17de23321d886","sha256":"b031a8d2f407362ad282db09e9fe29f34ba5aa61e2e111883890d128087f7538","sha512":"add642e049815c35087d05a3dfd6ecb0d4266821872ee39d6ddfe72efdd1722806bac611ca516fdc2ebeae5978e6e306ad329c6318b8ff0bf00790e97f784796","ssdeep":"192:BRQm/5RFbDk1lP32ldof8dV8J5J1EOugjKLWRyOCp9pvP5iUjJQvmnDW2iNxJHvZ:BRQm/57Sd200zmP1FukUqCrFrdwmDWFx","tlshash":"fa32bf1a43682ff2e8647ee221d81fc509ae303c0965726e2572a74a9b24df9152cb29","first_seen":"2026-02-24T07:43:44.869441Z","last_seen":"2026-04-08T20:55:08.919574Z","times_seen":19,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":258,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/web/sport/left-V-GAME.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.270Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /web/sport/left-V-GAME.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 20645\r\nlast-modified: Thu, 10 Apr 2025 08:09:08 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: G.nxrsvsH4JPijgfgafGfvkqiVRuf8ig\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\netag: \"6fc3f616d9b1b8d24e4e751162cb5302\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: fLC6YGkSDC6C-7YmOb2OEOixFC85dz_zHUkDq81rDsHMcr-vjstq3g==\r\nage: 5621\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":20645,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 104 x 104, 8-bit/color RGBA, non-interlaced","md5":"6fc3f616d9b1b8d24e4e751162cb5302","sha1":"52415130c4e9f1b8eddd654779a8ce7bf17d1606","sha256":"b2f951a8ed8d24357a8246f7be121f18dd0f63e1d4f7fccca17dc0e25f0cb6d5","sha512":"10c5b234f3f5665e5f223d5f82d411602c38592eb8dcb21beab9822b76d1874178817c54f941dff9cedffa9b3305328e684e919b7c33b2dee586ea626aa3668d","ssdeep":"384:NkqUXDSwNwD8h0xRH26mgUPbW2H7qWSrUaTBjPq0QBqqq6LxFYLAAv:W54s0xUDPbRbqhbFPqbqqqYYv","tlshash":"6892e04b7985f2dccb9cb53bc1b8914952e7384cd8f8a0846a2d51b7c1c5a1f4acdbe2","first_seen":"2026-02-24T07:43:44.942624Z","last_seen":"2026-04-08T20:55:08.920219Z","times_seen":19,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/template/sport/vi/WAP/icon/saba.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.623Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /template/sport/vi/WAP/icon/saba.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 2668\r\nlast-modified: Mon, 09 Mar 2026 13:13:39 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: XftQ0YEyAtlDKSWmWpU8nuLS.a7Vgp9X\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\netag: \"3d3db6121678ecf718b9bb3492db0a49\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: nEMpB4xbUF4UJpVE2iB5W1xsX07QzRZ3b2SEu1gVSX5eOHTdLg8wAQ==\r\nage: 1295\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":2668,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 144 x 70, 8-bit/color RGBA, non-interlaced","md5":"3d3db6121678ecf718b9bb3492db0a49","sha1":"8083ee01c5a1e56d0c965bb4b99a019040b7e511","sha256":"fab247566e1220598c86c2c6f53f728e1fe548a47f3b69fbc2591db63ea0ff6d","sha512":"34613da37bef910bfaecf5ee0a714cb633dd371727b86d4e4e23cc2ee48c0a2fd9d5f869c5d7092af990d334c0c92966cb6d6f20b31e1a1622dd08fa7a0e851c","ssdeep":"","tlshash":"c4512bc9fa7347e5cb1bae5222070a4eb881269f31cc86ba3df1736952248d081d4f88","first_seen":"2026-03-29T01:48:00.256781Z","last_seen":"2026-04-08T20:55:08.878863Z","times_seen":17,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/yidun-captcha.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:29.819Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /yidun-captcha.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:29 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69c74e48-2adc\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:29 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10972,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (545)","md5":"7b000b02de7b102d639a4a2517fdb04c","sha1":"e4013200733675ad0afbf553f532c866ca3efe87","sha256":"05aa7fb82aa3a5d8e59c925af30c7b8cea0e4ee6edc2f5ed4eeb7a4a3fa12c80","sha512":"94ab54a1f10394efcb2c2fb09dcab29d70e8c59f6f99619b04fff6ee1863830894615f7e2b00ac0c665e2bba3a2ede048b1e5de6bc05c033c2f80c6cf9771a9b","ssdeep":"192:A6yPdWboBIB9jSAhp1xDBeMS9rcIIiQaQPBYKqH3T+HyaiQSrvSIDl0IQAgWLEnr:A6yYboBOS4AcIyuf+I9R2AeCdkvh","tlshash":"1d328319adf960675d1bb0bb94af9004f6788953080c9e117e8de340df909b85feafd8","first_seen":"2023-11-27T10:52:49Z","last_seen":"2026-06-30T01:13:41.043305Z","times_seen":204,"resource_available":true,"data":null}},"time_used":929,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":929,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/RoulettePanelPop-BpCGoQ3j.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.063Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/RoulettePanelPop-BpCGoQ3j.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 30 Mar 2026 12:18:26 GMT\r\netag: W/\"69ca6a12-77c\"\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1916,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"Java source, ASCII text, with very long lines (1915)","md5":"057ac2318dbbfa7532b02ccbd17e8459","sha1":"cfb06a76517ffed4ebb35f7434453b1efe987599","sha256":"e0e5bb6fbc7d6fdb0232ccd9ec7ab6a78658aed91378d198c84facbf8470205c","sha512":"353c7b5d588635e76e97f173a7514ee33ebeea1e238d0dff5c3c60cf9a4b92faf95f460e89cd530d76407d155f8dc7c810b3fa23f4725f60283ba6d8999a66c4","ssdeep":"","tlshash":"a241864c713681b688674fdce41c08e1e40cb3c86230b9d976e9086a3a519e6943efad","first_seen":"2026-03-30T12:23:10.103293Z","last_seen":"2026-03-30T12:31:33.128959Z","times_seen":2,"resource_available":true,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/RoulettePanel-C3FvhfNv.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.067Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/RoulettePanel-C3FvhfNv.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nlast-modified: Mon, 30 Mar 2026 12:18:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca6a12-1b76\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: MISS\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7030,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"Java source, ASCII text, with very long lines (7029)","md5":"3bcc3f4927adac217e48dbbad3ab9671","sha1":"13056f4946bfc65a9936aa6337f0fde12d0ad985","sha256":"c58a3bbcf168ad2a6315c214dee07805255243b97f34385c83c1db2c386939ea","sha512":"5e43669cc4312ebd3798bb31cd76a4684b9ed7705aaece430fd0beb47e5f4ecfa12e854e94d943f5111ef5f10ac900e8530accf9dbae8c960cc3b9d93c77aaf8","ssdeep":"192:kzV7ToVAkPRTVQFUR4NXsby7yB3bexS96yG67:kzV7sukPvQK4yTpe096yGm","tlshash":"b5e17e88f1418d3b44a336c525a51045ae0cbb2bc364dfd5b329c5f027b3d2db2b666a","first_seen":"2026-03-30T12:23:10.13051Z","last_seen":"2026-03-30T12:31:33.063Z","times_seen":2,"resource_available":true,"data":null}},"time_used":349,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":349,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/ArrowUpOutlined-C6sQH91S.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.476Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/ArrowUpOutlined-C6sQH91S.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-length: 999\r\nlast-modified: Mon, 30 Mar 2026 12:18:26 GMT\r\netag: \"69ca6a12-3e7\"\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":999,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (998)","md5":"1958c93f38e06aea8a76453690e6e24f","sha1":"7ef404e81c7108fcf0ba9038094b1ab42cb1eab4","sha256":"bd60eef7372633c6ec4120a90a547abd4f173abe17a2dcc972d99b8fe10f30e6","sha512":"cee9d0c6bf8cdc7981b3b05e06b35e26a6fe061acc9a95115f66d47fb7f5fc90ed05006220b486f4be079345a2b84dfbf42485170fb927de03fc968b838f9032","ssdeep":"","tlshash":"7611055d3184bbf647928aa4442aa503f0196a2a145cf860af51c9e5f9514c6a09ff4f","first_seen":"2026-03-30T12:23:10.131506Z","last_seen":"2026-03-30T12:31:32.963534Z","times_seen":2,"resource_available":true,"data":null}},"time_used":479,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":472,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/RoulettePanel-C3FvhfNv.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.578Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/RoulettePanel-C3FvhfNv.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/assets/RoulettePanelPop-BpCGoQ3j.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:33 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nlast-modified: Mon, 30 Mar 2026 12:18:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca6a12-1b76\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:33 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7030,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"Java source, ASCII text, with very long lines (7029)","md5":"3bcc3f4927adac217e48dbbad3ab9671","sha1":"13056f4946bfc65a9936aa6337f0fde12d0ad985","sha256":"c58a3bbcf168ad2a6315c214dee07805255243b97f34385c83c1db2c386939ea","sha512":"5e43669cc4312ebd3798bb31cd76a4684b9ed7705aaece430fd0beb47e5f4ecfa12e854e94d943f5111ef5f10ac900e8530accf9dbae8c960cc3b9d93c77aaf8","ssdeep":"192:kzV7ToVAkPRTVQFUR4NXsby7yB3bexS96yG67:kzV7sukPvQK4yTpe096yGm","tlshash":"b5e17e88f1418d3b44a336c525a51045ae0cbb2bc364dfd5b329c5f027b3d2db2b666a","first_seen":"2026-03-30T12:23:10.13051Z","last_seen":"2026-03-30T12:31:33.063Z","times_seen":2,"resource_available":true,"data":null}},"time_used":610,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":610,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-K4eGEQH7.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:33.271Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/index-K4eGEQH7.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/assets/index-BO2SIyJr.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:33 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nlast-modified: Mon, 30 Mar 2026 12:18:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca6a14-aed1f\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:33 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":716063,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (65514), with no line terminators","md5":"2e67a8f811703cdaf5b6c117821434d2","sha1":"97ebefd8398c10b6e039a30f511bf6b459d2d6bd","sha256":"640fc2c40c9f5a48baa2868a9985ca5e15b5320ab0688e90f28efa6a13d2999b","sha512":"55b1093d7bd24530caefb86d86a475206dfb30fe62710581a34203b8d8ee879d2ef11e3b4772f24b94d80fc770ca5d926910c820b7876066287c9910844c5196","ssdeep":"12288:fZTJ0zYmS2gGMMyR9aFSaIHhqalitVEcqMx34eKzeNj7VOWv2vNGuzRzoYcfBi:fZTJ0znS2gJMyR9oSaIHhqalitV7qMxU","tlshash":"d4e47dd536a5942687e499cb94354512a3393e0f7808c0ecf97eadcf2e6ad05b03af74","first_seen":"2026-03-30T12:23:10.097849Z","last_seen":"2026-03-30T12:31:33.061323Z","times_seen":2,"resource_available":true,"data":null}},"time_used":247,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/ArrowUpOutlined-C6sQH91S.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:33.700Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/ArrowUpOutlined-C6sQH91S.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/assets/index-K4eGEQH7.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:33 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-length: 999\r\nlast-modified: Mon, 30 Mar 2026 12:18:26 GMT\r\netag: \"69ca6a12-3e7\"\r\nexpires: Mon, 30 Mar 2026 12:32:33 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":999,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (998)","md5":"1958c93f38e06aea8a76453690e6e24f","sha1":"7ef404e81c7108fcf0ba9038094b1ab42cb1eab4","sha256":"bd60eef7372633c6ec4120a90a547abd4f173abe17a2dcc972d99b8fe10f30e6","sha512":"cee9d0c6bf8cdc7981b3b05e06b35e26a6fe061acc9a95115f66d47fb7f5fc90ed05006220b486f4be079345a2b84dfbf42485170fb927de03fc968b838f9032","ssdeep":"","tlshash":"7611055d3184bbf647928aa4442aa503f0196a2a145cf860af51c9e5f9514c6a09ff4f","first_seen":"2026-03-30T12:23:10.131506Z","last_seen":"2026-03-30T12:31:32.963534Z","times_seen":2,"resource_available":true,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/bus-limit-3-XP-q7HvR.png","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.223Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/bus-limit-3-XP-q7HvR.png HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/home\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 13466\r\nlast-modified: Sat, 28 Mar 2026 03:43:04 GMT\r\netag: \"69c74e48-349a\"\r\nexpires: Mon, 30 Mar 2026 12:32:34 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13466,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 68, 8-bit/color RGBA, non-interlaced","md5":"d17e79a8e8551e7b5ac042c26f1bb6d0","sha1":"e8d54af0990aa77852909d122f97dfab8f92a0d9","sha256":"9e74b60919864872cec9baa2531d9fd21772d5d50d7006598557fd93307d3d65","sha512":"fdf3f26e65accaef5b981749ce95f793e9fa8cefe65dfac1da167c375c47ccc5ff3d6305cb8544bdb206ad5323476f58ce4947f163b96f6730249519e5cd506a","ssdeep":"384:fTmLCiFuyBWRpM63PA6WP0W05XSF6g3aM:fCLhcR6yWMW0UF3V","tlshash":"ab52d0e584791f1910d280265f66fcd0164668dea51ad4dba032baf90632f2f528b7f3","first_seen":"2026-02-24T07:43:44.898354Z","last_seen":"2026-04-08T20:55:08.826359Z","times_seen":19,"resource_available":false,"data":null}},"time_used":282,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":281,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/index-CRClkQwT.css","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:29.817Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/index-CRClkQwT.css HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:29 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 30 Mar 2026 12:18:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69ca6a14-2c3a53\"\r\ncontent-encoding: gzip\r\nexpires: Mon, 30 Mar 2026 12:32:29 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2898515,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"f216449e43a550b24e0fc314650f21d8","sha1":"9e5a2472e7af34f2eb30f99c89baf69f29612bc2","sha256":"438dcd308616dbac4fffc86ac39002c3aa3082926599480e29d5973882a022c7","sha512":"0a9b1534a2404b98a270f956e3f95040114db7ea47224a91b720b3a6ecc9d56dc9de775a2659a067490da78795e1368470b5c951e1cb0e9ac8fe211d37ba98bd","ssdeep":"6144:7AuBXlDSSlzZcA3R+j7e8YS0dV3cBr44FL:5ZcA3GxH","tlshash":"c3259595f58d101fa1bbe33624a4b7790a26bb13c44f59bdb267399c0f4b28373a2744","first_seen":"2026-03-30T12:23:10.133251Z","last_seen":"2026-03-30T12:31:32.977447Z","times_seen":2,"resource_available":false,"data":null}},"time_used":929,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":929,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/api/site/f/siteConfig/query","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.070Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"POST /api/site/f/siteConfig/query HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: vi\r\nAccept-Encoding: gzip, deflate, br\r\nDevice: PC\r\nCurrency: VND\r\nFrontAuthorization: \r\nTimestamp: 1774873352\r\nContent-Type: application/json\r\nContent-Length: 185\r\nOrigin: https://ydnaz.ksa9noa1-sdoqd.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":185,"data":"{\"params\":\"e5lw2mUjS5XDJ+b2lPqVvuw09N8JkxB0pe4wmW2tx99njRYsDz4nlS2zy6lf6mAdVHitk2z7k55J8OhqsbGsw9SIcx9zmfh+ouU/y1MQM+64D8MhHBJH9/yp+Z3oByCxFCGXj+f71k2D9IpbpHbj601YGCKLSSyIvTm8eMxv1I8=\"}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/json\r\ncontent-length: 7570\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://ydnaz.ksa9noa1-sdoqd.com\r\naccess-control-allow-credentials: true\r\ndefaultlang: vi\r\ncontent-encoding: gzip\r\nx-remote-addr: 91.90.42.154\r\nhttp-geo-ipcountry: NO\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27515,"size_decoded":0,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (23991), with no line terminators","md5":"3c8b4e8652a73943ae7e40257a443c93","sha1":"6e5a7a08dab15ce815e3ce19c0d9a842a78a6279","sha256":"303e61221a5a9d6f3cb91127a7f2c25032ce2ce63c83b482f3f54851ac49d24a","sha512":"8d391f6f05ce9715614f6c6508b7d62eb807a760083944c849fe2f8c7963f23234db083e68ba276e3adb5b863a8230b51f1a16c7f94d5b7b600112ed38a0e236","ssdeep":"768:YzFBSUPrpvF84VtrXBeFeme+ene5edeDRXeXeNe4eceOeiQeLejeBevebe2me8ex:YzFBSUPrpvF84VtrReFeme+ene5edeDd","tlshash":"57c2640343c49425c62d85dcd0bfb71d1ac5202efbc09fe95bf85678698e4663b2229a","first_seen":"2026-03-30T12:23:10.134578Z","last_seen":"2026-03-30T12:23:10.134578Z","times_seen":1,"resource_available":false,"data":null}},"time_used":316,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":315,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ydnaz.ksa9noa1-sdoqd.com/assets/HomeTimer-BA9-8c0y.js","fqdn":"ydnaz.ksa9noa1-sdoqd.com","domain":"ksa9noa1-sdoqd.com","tld":"com"},"ip":{"addr":"20.2.97.225","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:32.475Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ydnaz.ksa9noa1-sdoqd.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 24 Mar 2026 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:86:FF:42:FD:9C:08:68:91:97:86:DC:16:D1:25:44:93:58:75:2E","sha256":"3B:20:DA:8E:41:DD:8C:95:5F:D9:C7:C2:0D:2F:D6:3B:F2:DF:73:20:22:B4:3A:35:E5:0F:F1:9E:09:5E:80:4D"}}},"request":{"raw":"GET /assets/HomeTimer-BA9-8c0y.js HTTP/1.1\r\nHost: ydnaz.ksa9noa1-sdoqd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 30 Mar 2026 12:22:32 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nlast-modified: Mon, 30 Mar 2026 12:18:27 GMT\r\netag: W/\"69ca6a13-10ac\"\r\nexpires: Mon, 30 Mar 2026 12:32:32 GMT\r\ncache-control: max-age=600\r\nx-proxy-cache: HIT\r\nx-remote-addr: 91.90.42.154\r\nx-forwarded-port: 443\r\nhttp-geo-ipcountry: NO\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4268,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (4239)","md5":"2ab74e9a01032f38ff902d84509df202","sha1":"ff5d4e4d2cf4229865895fd906772fe3bfe278cf","sha256":"beed42411fb517208fc5dd5c3afc1a1837d92a1333f73f2619616902e8a51764","sha512":"8e472ef22b1458dd526cdf8ba5e3ad48ce56e130b3a26b75977a417370f5e210c4bf633db25cb01670e6aa5853695f145bf59a0fbbc7b0e40cf7a21019ef74fa","ssdeep":"96:iSjsLqDo743cLJDPhc+OyDDtMdDkFP6oKpWzwPYqdeHfiG40b0Gw5Zu7aI9DG:pjsLq874sLJDPO+5DtODghKpYwdd5G4N","tlshash":"6691d8ceb402f43a87f15858a45c0421610d7bab7070e8f5ea7fde9a2349e91b327979","first_seen":"2026-03-30T12:23:10.08085Z","last_seen":"2026-03-30T12:31:33.0019Z","times_seen":2,"resource_available":true,"data":null}},"time_used":473,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":473,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-30","alert":"Sinkholed","trigger":"ydnaz.ksa9noa1-sdoqd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/template/common/service/zalo.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.201Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /template/common/service/zalo.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 2465\r\nlast-modified: Thu, 02 Mar 2023 11:02:08 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: hP1d783piQfK6jXdaapMI5Kzd3_NjIHZ\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 11:49:10 GMT\r\netag: \"f9c3990b52fe594a57d9964af647e66b\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: WFaxLhPAgC3GCmn3J7mYUpsyUY4rwiMyJiEvmYSJQyVO_qH7wxr3NA==\r\nage: 2005\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":2465,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"f9c3990b52fe594a57d9964af647e66b","sha1":"39c5179d50b770380ced58e48cb339ba1ac496dc","sha256":"c78f24a54251052bbbddaa7f95d2086f108f7a2aae6eaf7df9c8af2f278f1257","sha512":"a76516a429b809bd4cd6114bc640a027b1982fa9e9c1760d300f5f790e63c26f6e8ded29111046973931cdf1ad9ddc059558e286db192143439396ba5a00fcaf","ssdeep":"","tlshash":"52515acbc6080d4d027e384b602adea5ec3e31c37d626c8e904d5a1197d02c6ecc23a8","first_seen":"2026-03-29T01:48:00.134644Z","last_seen":"2026-04-08T20:55:08.839186Z","times_seen":17,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/site-intqf/siteConfig/202601/176d7c3dab264be4b0ea997a4224286e.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.231Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /site-intqf/siteConfig/202601/176d7c3dab264be4b0ea997a4224286e.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 21322\r\nlast-modified: Mon, 26 Jan 2026 04:49:28 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: 8RMLdHKHM99Qk1NPmrZl19jrfNvZQfLY\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 11:49:10 GMT\r\netag: \"fd43cba637436f0ff41272148a952a5e\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: Yc1V4YCVURAlMKKYVEcb0XvGE1_-_dkr_tbff_KfrUSXciwKq-AvCQ==\r\nage: 2005\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":21322,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 368 x 100, 8-bit/color RGBA, non-interlaced","md5":"fd43cba637436f0ff41272148a952a5e","sha1":"0998ae892c19d573c094a1f4c022a87afa8d0c0f","sha256":"09dfc6b2d54a842fcef6f9456b94d9b88d3bfa54a6353071b3eb32d297123cc9","sha512":"c8196a56814ab34df47495876051a96c29beb5d24257427c4d142897a197925f74b6eeb2664161d3e6ef7e1c6e6715925056bceb97d1a7a8f659960528a2d192","ssdeep":"384:awVuWMK8I/0eisfqUdlDBHDF2lc/n+0x39pVIwUsKAqsDbWwzmpER3:TuWMKNEXUXh4c/n+0x39pVQsLnzmK3","tlshash":"49a2e161bf5cd7d4a93b30dc0a238260d7e7d326d61e22dad3412b41aa54b73127cb99","first_seen":"2026-02-24T07:43:44.885844Z","last_seen":"2026-07-12T06:23:16.113178Z","times_seen":44,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tposs.qiddfc-dqiod52d.com/web/sport/left-E-GAME.png","fqdn":"tposs.qiddfc-dqiod52d.com","domain":"qiddfc-dqiod52d.com","tld":"com"},"ip":{"addr":"3.167.2.103","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ydnaz.ksa9noa1-sdoqd.com/","date":"2026-03-30T12:22:34.261Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tposs.qiddfc-dqiod52d.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 27 Aug 2025 00:00:00 GMT","end":"Fri, 25 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D0:96:57:8B:56:09:2E:8A:4D:C1:87:CA:FD:41:09:B6:57:2C:4F:1D","sha256":"48:66:5F:5D:67:07:2E:C0:CB:EF:91:62:93:36:C2:EF:FB:B7:0E:4A:9A:93:C5:0D:10:9E:B6:05:6B:45:AC:AF"}}},"request":{"raw":"GET /web/sport/left-E-GAME.png HTTP/1.1\r\nHost: tposs.qiddfc-dqiod52d.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ydnaz.ksa9noa1-sdoqd.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 4176\r\nlast-modified: Tue, 08 Apr 2025 05:46:55 GMT\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: bcqAOJxQF9EwlwZc9lhQStrHq4V7Ln0Q\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Mon, 30 Mar 2026 12:09:45 GMT\r\netag: \"7b0a6e052a66b218ae2129e04323d261\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 be3750c9aa69fd9d53a35aea8d9dab16.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: tQpLxdFb88r36S_qmkBZ9ICmIwBxMdjwhT1lU-yiKUNxpb7AQ5m7Vw==\r\nage: 769\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":4176,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 104 x 104, 8-bit colormap, non-interlaced","md5":"7b0a6e052a66b218ae2129e04323d261","sha1":"0eb5316ecc3349e06a2cbf2480361382af0150ea","sha256":"2dee4f3abc2727872859f55bb8eca8f4e1176b39d72bf283f69b1f283b899312","sha512":"b44693287c04107072d32c327b5e202ab202423c9db807cfcf6e764cef43a46a977db166160be25565b641a769df2e26afdca1d2d799e11421203be170976e1e","ssdeep":"96:bHGv23zcXU7lOWNLXlpN9pC0llv4ylidDN1LJ:bo23vROqLVBpblvr+jJ","tlshash":"6e817db0057d9ffd38dbf261386b417bf8909a0b9a06839271f08122b80a2a4429ec08","first_seen":"2026-02-24T07:43:44.855304Z","last_seen":"2026-04-08T20:55:08.855524Z","times_seen":19,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}