{"report_id":"461126a6-64a7-452c-92f5-e5899bd6e5df","version":0,"status":"done","tags":[],"date":"2026-10-16T14:34:43Z","url":{"schema":"http","addr":"redotpaycn.com/","fqdn":"redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"www.redotpaycn.com/","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"title":"红豆钱包(RedotPay)中国官方网站 - 数字支付与综合金融服务","dom":{"size":48866,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"8b468101d66ccd46adae9eb43833c3f4","sha1":"5e01996db3679c2b55d2f57afd0e428dcf5773df","sha256":"089560be69d7d5637a148667e9f80ace2128c31f98ff8bbe1aa6f7a26d841013","sha512":"5659fd967f7621b7e88bbce7244f7098da8ae4d47f4d09d6e55a4b5a0a7b1d25e221e8268c66905fa922e1e754c465b7a4895445c803540b64f7675ee7a98deb","ssdeep":"768:f7XMvsH3xN9316vr4h/MRrOFANF41yHTzQ:f7XMvsH3xN9316vr4h/MRrOeNS1MT0","tlshash":"bd236371d2e219a35013c0d86fe99b6a7fd05803c69b8055bbee17884fdafd8e81365c","dom_hash":"domhash4c5d6f0fb09023176fbfb769d4226554","first_seen":"2026-10-16T14:35:05.812989Z","last_seen":"2026-10-16T14:35:05.812989Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"redotpaycn.com/","fqdn":"redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-20T14:34:43Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"ndkszc.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"8pe7xml5.63775.wang","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"img.mmtd.top","ip":{"addr":"104.21.29.180","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-11-07","domain_rank":0,"first_seen":"2025-11-09T12:42:44.533161Z","last_seen":"2026-09-06T01:02:23.872829Z","alert_count":0,"request_count":11,"received_data":3235110,"sent_data":5860,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"www.redotpaycn.com","ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":104,"request_count":52,"received_data":14206824,"sent_data":27253,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Popper","description":"Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.","website":"https://popper.js.org","common_platform_enumeration":"","icon":"Popper.svg","categories":["Miscellaneous"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"WOW","description":"Reveal CSS animation as you scroll down a page.","website":"https://www.delac.io/WOW","common_platform_enumeration":"","icon":"","categories":["JavaScript frameworks","Web frameworks","JavaScript graphics"]},{"name":"Swiper","description":"Swiper is a JavaScript library that creates modern touch sliders with hardware-accelerated transitions.","website":"https://swiperjs.com","common_platform_enumeration":"","icon":"Swiper.svg","categories":["JavaScript libraries"]}]},{"fqdn":"ndkszc.com","ip":{"addr":"104.21.63.232","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":1,"request_count":1,"received_data":50006,"sent_data":551,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"8pe7xml5.63775.wang","ip":{"addr":"59.152.51.132","port":443,"asn":26658,"as":"HENGTONG-IDC-LLC","country":"Hong Kong","country_code":"HK"},"domain_registered":"2026-08-21","domain_rank":0,"first_seen":"2026-10-16T14:34:52.712082Z","last_seen":"2026-10-16T14:34:52.712082Z","alert_count":1,"request_count":1,"received_data":992,"sent_data":571,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"redotpaycn.com","ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":2,"request_count":1,"received_data":582,"sent_data":483,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/bootstrap/js/bootstrap.min.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7451e07cd6077783b728c0c924da6629","sha1":"fe104e2ab91ecd0a39dff04e5aca698440bc9e22","sha256":"4fb5913ee978bde28acce2944e8139aaedc5c22bd51f88a1fcab174b1cc5694a","sha512":"c1ea2fce2f8a0d3d2893cc6f9fececbf16db46d4c196deac69cd0bafac764cac5fb2063ef390acfb04c2f01c29d1640f3234eefbff5fda12a0e5f6f851665936","ssdeep":"768:0ZYGDyGi43HVzdR2BmDb7zTNilqtvY1xWiDLYjQVW1/MVOlKvnxFa+B0DV:0ZFXOCx0wNGaYkR","tlshash":"5743c80a72547873059fa176817f420bb736798ae90a826cb91d98dd1e7cc893237f7c","size":60016,"data":"","first_seen":"2023-03-07T01:06:36Z","last_seen":"2026-10-16T14:35:05.83406Z","times_seen":1319,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/home/index.html?ref=","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"7c50d0d83bbf9e2f924858e2fcf7ef1b","sha1":"b14336b5b4144f11c588b3585cf2e27950e8e40a","sha256":"1620ce4345613bd7dd65c6b063dadb176871ecb0de768d1cd97608c4b9173c2e","sha512":"350eeae586d273b4f80e15dff8f5d871e6127dc6eb99f2802d67c66592ce33fa5633d2444ad97413b8967915e994b9699ecd3d1ed20eb67656656213a5a28e5e","ssdeep":"","tlshash":"c9f0261e7be328c02c67b53b23ae3241347314470c07ca017d0ca6405fb4aab8028bd8","size":447,"data":"","first_seen":"2026-10-16T14:35:05.901137Z","last_seen":"2026-10-16T14:35:05.901137Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/js/jquery.fullPage.min.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c478adc5a33db2374da4884b3bd47e18","sha1":"8c48ef380e2b04e59fa0209c615a64bd1ec41e63","sha256":"ac8afe4054815d0d987aa214e3837936c38a4bd73cff9b56770f5e8bd1ea23ba","sha512":"aff9e19b4dd2cc5e2dd1d862d3c8b15d59d7f0be70fe40a23b9313e4bdd1ca48adbaf157e65a27112fdc50aee64d706fdc5e74085b39dd109be7253cb1c0dd15","ssdeep":"384:ApslHGlSZrQFnQeBzTwRO7lfCeXY756alH+lSB/QobfnXCAe1:dIorfe5cRafCe26aoICAe1","tlshash":"21527585f92172f680ff22eb611f81416136ac73895254d1f46da4bc2e79ed803a3f9b","size":13766,"data":"","first_seen":"2024-09-28T08:42:23.375956Z","last_seen":"2026-10-16T14:35:05.88105Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"64011fb35e5911ae2588ed915c59f39d","sha1":"6440d608d5f483d39cef425236d2e8560cf2b820","sha256":"0d81df6293f2e1f77b9b2394b8000483ce5b7b5f43f296b5faf37bd3e8c7238a","sha512":"7ab4e63e231359d79b919cf1eb1abb747bb45cf1854804478c3f18283c170eae22753859380ed3f518f25213dc6e1a1de7e0c742599b1407272334969253fc3f","ssdeep":"","tlshash":"1fc08c242f3a1efcc03001224c34ec4080f9cc92860bb24a54073a44d3017d60b18210","size":161,"data":"","first_seen":"2026-10-16T14:35:05.902167Z","last_seen":"2026-10-16T14:35:05.902167Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"2d313be4b5d93e9b681de954aaeb3006","sha1":"1e0508be1026244daf1812f988033612c3945bdb","sha256":"9059d0d74efaf0e229d59a9c05ace7b975b42ccacea21e01aa64c56b2157048c","sha512":"83b5d773d5184b8feefc9c7fa2637098ad1c9ca5839ac5dd68f59372c7b4329b8298f1236c8d9247b3b2fd6afc159b9dc8cabbd6a8bbe8e5e2707dd6a7fbc82b","ssdeep":"","tlshash":"b99002c9f196a475e2b96030551b9205a0164c4d8c3c415c6100347e381559a8857679","size":57,"data":"","first_seen":"2023-03-07T01:19:11Z","last_seen":"2026-10-16T16:19:52.260824Z","times_seen":12768,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"988c049c7032bd60daf82f9c609b767a","sha1":"9c39f77d8111d75a6f45e0fee0f8fc1dbbbfb5c3","sha256":"ec898564cb2c3f7b702fa1c0a24d631b969c60df697e306946671349d41ed17c","sha512":"6aaab3636fb44f1a156718066b41ecc1ab35ffbdb1402cd5f8cd2460cf7003e2449966fe697f4d5d2c3c6df09863d5815a21cc885e91f2ce374d7fd272f06803","ssdeep":"","tlshash":"ad21496637a7263269f3a1753bdf3206212a402711458a007e6e5ba05f31cb92732bda","size":1195,"data":"","first_seen":"2026-10-16T14:35:05.90373Z","last_seen":"2026-10-16T14:35:05.90373Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"c87934f6ac6a4f3d532349836b62429a","sha1":"4c53095fa525a19babfcc4eecece455bb3b34eb8","sha256":"f9d5ecd18c2e15587b49e00cdeab574270516843827da835acfa358c0b199b64","sha512":"7f022bc4785b00b458d195a8749e094e53b06ca651a9a5164d0495ac435efe9ab71be25973687a1c52120a971046595e75e4b2354f0f4ba35bd2ea88bf2768a9","ssdeep":"","tlshash":"52f04ca9f0d051b012f7241315be14043e466c07534bc520b87f2afc3fa813565aaf6e","size":580,"data":"","first_seen":"2026-10-16T14:35:05.904612Z","last_seen":"2026-10-16T14:35:05.904612Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"feb46243962beb2de2985f9e5e6c2045","sha1":"2e9d999341289c4c0db92bd0b8f75e7fcbd6c45b","sha256":"370f736f1794dd1b4a53126d14f8fd7284e591727a507d72c1439fc762904bfe","sha512":"097eadb55333e2e76244b31f9bf125817a7605d9bfb3c874ca7b0d281a8a6f9cc50b9724af9109bf6dc05b271d916288070d7a2dfb4040794463afec7d674f69","ssdeep":"","tlshash":"77014142909430f61c3be5f867be26003c610013dc91ec353cdd0a415fde80c356aaeb","size":839,"data":"","first_seen":"2026-10-16T14:35:05.905718Z","last_seen":"2026-10-16T14:35:05.905718Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"5619e452f349e46446d7ae758043c62a","sha1":"ec581faead16e0f4ee1e4033e19f395d13886184","sha256":"5c681b960c0e314ecf522051f412e22c40b5fea719503864926cd215af80367f","sha512":"56dbec42692fee71267090807b3428ef9990168fc19ac3a9af4b835aba635fdc0375d224ab49ce644500bdcb5cd2f4acafad6a3aa235311bfe80d253cfd3d714","ssdeep":"","tlshash":"69318b84316026f00d6be1aef39b9780717974a37016ef7d3a1f8fa40f19ab94255ac6","size":1569,"data":"","first_seen":"2026-10-16T14:35:05.90678Z","last_seen":"2026-10-16T14:35:05.90678Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/js/popper.min.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"855075c14fed65779e9226874c12d223","sha1":"eb352e9da7a729ab8dd14f41e8aa3c47d3a9e4de","sha256":"03f5c3670a8445c0af75a1b934be176f6c1cde339fbe76b1062cc51e590bca98","sha512":"7ca3d85a512e71642eced745f71fab314bf33b70ed9250fb93ccf725d3d3dbaa971734fcc73968f66e6112303c7e41b92c0d3db55e0596404bd923aeedf108f1","ssdeep":"384:xnMQG5rwVO7dV9nNbRGCB9D45Hkn5vj2xpOxvIAgD75zBi5vISg3gzopL9TidOgp:M5sg7X/jD45eSxpOxvKD73i5vTzwL9TE","tlshash":"27a2b3cc3294b06643a791a7a0bf960eb2339875610e9410f199f2e97c30ef9917fd79","size":21262,"data":"","first_seen":"2023-03-07T12:40:49Z","last_seen":"2026-10-16T14:35:05.820408Z","times_seen":861,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/swiper-4.3.5/js/swiper.min.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f73e23ebde1624296c284cbfdca7c615","sha1":"2ba2bc6dbf969b10a1ea9aa8936c9efb22700a7c","sha256":"7a165ed05e8bfe7fa472338a7ba7e37a619701be8f3d8f158bd163a06f613487","sha512":"7f899b1a76fc3c630e00e58669dfd954885d9c8f927db13db36fc44fade67c3abdccdaa7f972ba76acaadf6511d216f4e8dc5a0687fc29db5c4b59abf72a915f","ssdeep":"1536:PorVciYAwdCXrlnLtN+K8ExalQgYySj25RtYNluvpIXvH7WcWUwcPqYbaE8EtObr:zCXrDNFLxvOeluSfH7WcWUwcPquDHY","tlshash":"8ac31949b35071d555e32256539ed201a3b62845b90ac1a831b2dcdbacbde8c03bfefd","size":120757,"data":"","first_seen":"2023-03-07T13:14:01Z","last_seen":"2026-10-16T14:35:05.820978Z","times_seen":97,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/js/wow.min.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ed4b12ef0f7e4bf5d5ff3555d18718cb","sha1":"258fa26dec8fcf4769d49eaca6712ef56923673e","sha256":"3162b6468674133d7b6c903e4b8a06f7faf51216d1e7f8b3edc8f326b1bfe461","sha512":"40d8f96697d393a5301d2960394cbea52ea64330a8b706a0982e9b17176bfc0d55394dd4f0fbea2cd1798c938e66ccccc671d803b2802f8b37c2c41f40c1200a","ssdeep":"96:xrZgL1xvPV6GqKyR6TYdtHFMLzA4pOROVEE1fosvGeaMozHImBaokbl:xry9PVfSnAPAjROVEEdos+eatzHILoe","tlshash":"17f175c9ba967035c75792f2833f0106b23a5aeea028047cb5b98dd57d38c58523bf78","size":8183,"data":"","first_seen":"2023-03-07T01:03:44Z","last_seen":"2026-10-16T14:35:05.861784Z","times_seen":2771,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/analytics.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"53d5cd567d6faf2bc9f7b24515fd09ca","sha1":"53f2f62b3d86d2c2061122ddd0ef77c489305d34","sha256":"72eef8b83c2d65c8b3732dc0d31b0ec76d02ccc3c2ec50b4093bdd2cc5bc866f","sha512":"57676254c4b13e2c5087ac4f16c86e887e2325dba3870e65e6372f80c0ba337c8b97571d5d11f54dba4d843b62ea1848a71036da878a8229efdfebb6e06f188b","ssdeep":"","tlshash":"4cd0a75f24052d784f8d12b6607ae69cf561211c61aac452888ddc5a4c30fea646568c","size":241,"data":"","first_seen":"2026-10-16T14:35:05.866603Z","last_seen":"2026-10-16T14:35:05.866603Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/push.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"26282ede1149d5139807724d11956125","sha1":"c2e5d639403b4239afd015869e81886a98f0822b","sha256":"d0707e212bcdd19428ee298dc5b0cb647f9e06ef5ba756a06b20a1ab9982ea8f","sha512":"94d896ddb8b0d031f522a2ab95f36152b411ccf887683415df1f769a3e12bd8f89dd16fc5ff37cb4abe5500fe82c1acc0a74aaaa5be8d14e768ba383c4a473bc","ssdeep":"","tlshash":"d83114cf641106bc56b2116c997f399cfaad0a2f8850b140f869d4411f7467743a7ed4","size":1455,"data":"","first_seen":"2025-08-20T05:58:30.978293Z","last_seen":"2026-10-16T14:35:05.853198Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"8pe7xml5.63775.wang/yf6usqyu.php","fqdn":"8pe7xml5.63775.wang","domain":"63775.wang","tld":"wang"},"ip":{"addr":"59.152.51.132","port":443,"asn":26658,"as":"HENGTONG-IDC-LLC","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"26421ac860f4dba7f27811712a149502","sha1":"aaf37d59cb4b28ac48ecefa82a2824a8e6210d5b","sha256":"266f482d6e5dd0302fca1871e22db5996e068d1188d1ba9cd96b892552fbcab3","sha512":"919156d81b248a368b0559741a8e0ce24a14178806923d1c1e783b25c3e61815727c3b81cf21e8f4ccd6c29c49f43e8a4d3cfe5bf386b43b01913f328d864e4d","ssdeep":"","tlshash":"6e9004d730c350345f53135404571cc5513cc470144c4d44c0c0d4517cd50345115c5c","size":39,"data":"","first_seen":"2023-04-12T04:16:13Z","last_seen":"2026-10-16T14:35:05.907867Z","times_seen":21279,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ndkszc.com/","fqdn":"ndkszc.com","domain":"ndkszc.com","tld":"com"},"ip":{"addr":"104.21.63.232","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"dfbb6dc9333ed639f3ad69a8631a28fe","sha1":"5eaba3ef5430e0557398c142989c14229c5dec98","sha256":"aaf226a251a2ca519be010e2dcb80c5c497d2888fd315818718bdfc3135e7658","sha512":"8eec96f324d77f8a33758d17480343b65d57ceee652a7022dbbaf7925281cd6f82fe4d0a72627f6695b2d85bf0440aaa2de27d3c0e6130ba3fb88ac6ef21bbc6","ssdeep":"","tlshash":"04d0a75f6c401d780fa911ba617ae69cf065115ca6aac81288cdd8599e30efe482674c","size":235,"data":"","first_seen":"2026-10-16T14:35:05.90877Z","last_seen":"2026-10-16T14:35:05.90877Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ndkszc.com/","fqdn":"ndkszc.com","domain":"ndkszc.com","tld":"com"},"ip":{"addr":"104.21.63.232","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4205a89ec04e61a96e8d4c844d3c2c0e","sha1":"3da0c0a5c6068b76c225b88b8a0a2b9b2814a665","sha256":"f67ee07be29b766a90920b516e812f12f7c2da5f4a3160ace6c28c327a5b71e8","sha512":"34bf3273b19f22645c11bae01db961cee60709c0d17910d6eb9808e4da0114f369e8f4235fd343cce691643a47d9c5f93c15d6b4f01d0ecd02a69d935de911ef","ssdeep":"","tlshash":"2df0acea04692db001bb7168234ff3443e63003321146c407e4ccbe40faa86390975eb","size":610,"data":"","first_seen":"2026-10-16T14:35:05.915117Z","last_seen":"2026-10-16T14:35:05.915117Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/unimportant.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b87d6b895df572bfa9602eee007d36a2","sha1":"13c4c504ab2e9666f8443ec9d4cc9fe7484cfd58","sha256":"73e23109a2a07c522d0aa2341ec2531161d989717259c6fe6bd147020b9ca272","sha512":"c8406c8c67a68e90b03f8c914c951008a51b46cddcc3ce0c6c596a5b246b4fdd52e726159d8253fd77e7943e6f1c4d92bf65dbb8bf88957827e1ea1aad4a5595","ssdeep":"","tlshash":"332147764861507c45329337b1b25e3cf9b9801bd3210910b54c3d3a6fb8e05d967dd8","size":1230,"data":"","first_seen":"2026-10-16T14:35:05.897668Z","last_seen":"2026-10-16T14:35:05.897668Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/js/jquery.SuperSlide.2.1.3.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"90d933b43f8d8ede1bcf3bd61ce24c4c","sha1":"5d2c4ea9e0a8d6a4165a893ef1347edf8ca29b52","sha256":"4eef68c1654d3e996dbc418e1892d3fd6ddc5fb9582f71740c3ea915182dd4c7","sha512":"f408a02f068f7e28a66b743296f0382ef79b05646910ad797ee5300598be643da22ed3511fd7b65f780e7101c08d1fde1eaf392017dcb70ec511a456921c4ffc","ssdeep":"192:OrITKvJoHPHsgGuuauF56tpE9Er5MYB5c3TXP3ZO/mpUhClGS5OHxImISLTNSfY8:OrJvJUsgGuvlMYXcjfRUCESKREcS3KuP","tlshash":"f432a55eb56375ce56a7b3f0107f940d232765a5fcca8ca0b1748380ad79a1c212bbad","size":11757,"data":"","first_seen":"2024-08-19T16:31:27.156982Z","last_seen":"2026-10-16T14:35:05.846174Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b8462d132a35bc43f849618eb5af74b9","sha1":"95ec46545cdaf3d23d7c7434b055adc26698abdd","sha256":"d936cd327e90c64569a9d6c34bf8660db1b2701c4b6ef2e83f615a4b0153c7f5","sha512":"8100878f23a74665105738bdac8aa330774121c1ced25d3b28204029d6aefd492e77d95070619ec6b7834eded3e293ac25c24d7056bbf95b7fe7ea7307385d97","ssdeep":"","tlshash":"98c092b6d158dc0346132c7d7a8b24669bf0b000d6c71880820c99500a2c42b4207819","size":163,"data":"","first_seen":"2026-10-16T14:35:05.916174Z","last_seen":"2026-10-16T14:35:05.916174Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"8pe7xml5.63775.wang/yf6usqyu.php","fqdn":"8pe7xml5.63775.wang","domain":"63775.wang","tld":"wang"},"ip":{"addr":"59.152.51.132","port":443,"asn":26658,"as":"HENGTONG-IDC-LLC","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"ea45917358c0782f4031782ac9558290","sha1":"515ef85ae36b11bd4a8c6380a1574be431527268","sha256":"eaaffb623ef5e8f9ab0357b3a6f5c4530e92c23130421cf4d578d2a301e2e1dc","sha512":"a5ba7c504eb2d5042ab6bf49678e610d33c263aebc43964c62fb527d0a8df04ddcc1cf38528bc1732f30383dc0fafeb716e5e3b5c8e21e1de23dc8293764de16","ssdeep":"","tlshash":"b7d0c9bda086e57ca35a2420a23bcb4c79369815751f107ad10c16b934a5ca8dd63f90","size":204,"data":"","first_seen":"2025-07-20T08:04:30.799394Z","last_seen":"2026-10-16T14:35:05.917267Z","times_seen":251,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/js/jquery-1.12.4.min.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"618538b4ab9639d444e962729a927f15","sha1":"dacc1f76630a9708add066819b1aabf8dce01056","sha256":"27d92130c0321dad5a03760fd5ac98a3d04ed4c94d88418fe6d50da1f7fc5cbe","sha512":"bcb6754ea246939a19a917cc0b810e1753c1b0f1a8b1b7e652128ef15dee4fc79111e4d88fe12f9188449a307e82240d0261af402d783428edfe5785c860372d","ssdeep":"1536:jYE1JVoiB9JqZdXXe2pD3PgoIiulrUdTJ5Fk/zkZ4HjL5o8srOaS9TwDhb7/Jp96:y4J+03jL5TCOauTwDhFdnCVQNLa98Hrc","tlshash":"9693d7d9b6d6706287b734a851bf410bb17aa8eab40c4c60f058c8e47e74e9d507bf2d","size":97168,"data":"","first_seen":"2023-03-07T01:12:12Z","last_seen":"2026-10-16T14:35:05.818183Z","times_seen":6043,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/js/public.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5dc3ecc4dba321a58166fe33865dedc9","sha1":"b2ffed289abe14312c93cf160549f61995b2e110","sha256":"58c79d31d8a7a09a3dd3643b48498d79b6ad7a1ed1efd3a2a51a76dcc99dcc70","sha512":"eb91986069e16824cbef396cc3d8821388a736404ccf1c96469b354c7c99d1f072b966b3cfe8163e2fea0615123f96f761fc0bb85b12bc031a1123a0647906d8","ssdeep":"","tlshash":"3bf09964f8488aad11f2713560371208ae2b286363021e91d0bd45b43e38a7c5ff3c44","size":650,"data":"","first_seen":"2023-11-26T12:01:54Z","last_seen":"2026-10-16T14:35:05.844086Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"img.mmtd.top/jiuyou.gif","fqdn":"img.mmtd.top","domain":"mmtd.top","tld":"top"},"ip":{"addr":"104.21.29.180","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ndkszc.com/","date":"2026-10-16T14:34:09.387Z","timestamp":1792161249387,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"399ee6eb.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 29 Aug 2026 23:51:54 GMT","end":"Sat, 28 Nov 2026 00:51:50 GMT"},"fingerprint":{"sha1":"18:F2:21:F7:61:95:C8:F7:9D:64:CD:DC:93:E6:EC:3F:A5:AB:9D:6B","sha256":"B7:D6:82:9B:2A:6D:E1:B6:CD:D9:F9:C3:1A:64:4C:2A:82:9E:F5:EC:F2:DA:54:1B:97:70:21:C7:BD:15:10:71"}}},"request":{"raw":"GET /jiuyou.gif HTTP/1.1\r\nHost: img.mmtd.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ndkszc.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 16 Oct 2026 14:34:09 GMT\r\ncontent-type: image/gif\r\ncontent-length: 289852\r\naccept-ranges: bytes\r\netag: \"534d9ccd3b2c226c544f038d73513277\"\r\nlast-modified: Tue, 08 Sep 2026 16:07:40 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=74%2Bai7huNUnAS5JFvF9JEouEl8wCx473IQjkYWnGgcKNKoyWaUSQaeT9vB9z2i2mJIxcKaPF3xt%2BaDKNgJ6m3JsEm4HAMSxcSyWVC3yA2i4%2BBFEfsVtWcdVvifM3QAw%3D\"}]}\r\ncf-ray: a4b7c8614f09c272-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":289852,"size_decoded":290504,"mime_type":"image/gif","magic":"GIF image data, version 89a, 800 x 400","md5":"534d9ccd3b2c226c544f038d73513277","sha1":"8a96bac151a5ac713c99e4a34e8c3d9086b1b673","sha256":"3852cb6420eecccdea4f12e910da77ba4d98d9e0c5e4c55f510eb34232d019c8","sha512":"3daf13501689dbd47096dcecb688aff1c1c8facac57c6800ee2035ea77254a4e4a2159ad1386b81995020d6b94af10da6f95ef7a29032106ade65e314f5e8cc2","ssdeep":"6144:GCAiAtSKlj6F+BWKVG9SmcbaAMEDy1Da5BAmxyXoaOmqjMcAcog8EB0UNX:YiWZHVOqDy1UmgyXoHmHcvp0MX","tlshash":"4d542395e3f7668bb3303fd009804f926f0a4ddab9009421566c5779beba72c8f6d6c4","first_seen":"2026-10-16T14:35:05.815803Z","last_seen":"2026-10-16T14:35:05.815803Z","times_seen":1,"resource_available":false,"data":null}},"time_used":587,"timings":{"blocked":-1,"dns":47,"connect":0,"send":0,"wait":280,"receive":207,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/bootstrap/css/bootstrap.min.css","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:00.955Z","timestamp":1792161240955,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/bootstrap/css/bootstrap.min.css HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=K8Fm42jD8jNA69GC9fJBj8qa0Zojb0ckKMf6paVFhySzgifTEhXSAawU79dOKk37lI%2BwmbC%2BynxORbyxZqMGM2xvLpi1Pfi6ba3%2FaI0unFv%2F14CrZjO4VI%2B16%2Bal30TDqvgHYBU%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1bc07d098f9b\"\r\npriority: u=2,i=?0\r\ncf-ray: a4b7c82bff19723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":159521,"size_decoded":26691,"mime_type":"text/css","magic":"ASCII text, with very long lines (65319), with CRLF line terminators","md5":"cc1382088863aa74eda6e6c8820df514","sha1":"152a10c0910c9d5ce1e0acd1a747ed5c4445970b","sha256":"31268c5e83a3d6528dfc18561208e25f45f168b37d23c5f06804dfa680f34fef","sha512":"daf3593bce0c9a4d924b57fb2d2bb10e526a19335dd0beae20795ea889ef3e48b7358abff516e66fbbc889dd905fb5592c56479eb7ade2d79ff58459bbf2caa4","ssdeep":"1536:f7OIJNT48SyEIA1pDEBi8INcuSEFO//uKFq3SYiLENM6HN264:f7Za4GMq3SYiLENM6HN264","tlshash":"33f352a6f5a0312de467c61964d0bafd152f8245d7224bfbf827376487892c70a73e4c","first_seen":"2023-04-05T22:38:02Z","last_seen":"2026-10-16T14:35:05.81743Z","times_seen":1670,"resource_available":true,"data":null}},"time_used":1490,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":398,"receive":1092,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/js/jquery-1.12.4.min.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.004Z","timestamp":1792161241004,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/js/jquery-1.12.4.min.js HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: application/x-javascript\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3XrCrFC6tSa%2BOQ9VDUYTcygSUacElCZJxZHO9kLnGx9Wmw1GYo4k6HunoU4bUZAqYSaK7DkzRfm5YO%2BBHB0Zmy0p%2FNAwnY8wvgK5L3PhZRtJV960AatKXMBTlBeK6TtxdjQxBkg%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1bc07ed8cb47\"\r\npriority: u=2,i=?0\r\ncf-ray: a4b7c82c4f3f723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":97168,"size_decoded":36964,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with very long lines (32077), with CRLF line terminators","md5":"618538b4ab9639d444e962729a927f15","sha1":"dacc1f76630a9708add066819b1aabf8dce01056","sha256":"27d92130c0321dad5a03760fd5ac98a3d04ed4c94d88418fe6d50da1f7fc5cbe","sha512":"bcb6754ea246939a19a917cc0b810e1753c1b0f1a8b1b7e652128ef15dee4fc79111e4d88fe12f9188449a307e82240d0261af402d783428edfe5785c860372d","ssdeep":"1536:jYE1JVoiB9JqZdXXe2pD3PgoIiulrUdTJ5Fk/zkZ4HjL5o8srOaS9TwDhb7/Jp96:y4J+03jL5TCOauTwDhFdnCVQNLa98Hrc","tlshash":"9693d7d9b6d6706287b734a851bf410bb17aa8eab40c4c60f058c8e47e74e9d507bf2d","first_seen":"2023-03-07T01:12:12Z","last_seen":"2026-10-16T14:35:05.818183Z","times_seen":6043,"resource_available":true,"data":null}},"time_used":1406,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":363,"receive":1043,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20230624/1687591326253848.jpg","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.454Z","timestamp":1792161241454,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20230624/1687591326253848.jpg HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bf3OluUwvzTlHeZaBf11OMyG5wTA7ayhSC1vJv%2BBuZoEpHm9jgMehjPlZK4TWNCMeiIiLJ%2FkheYKBLR01cq0eIxstyxxLtbbx9ZlUPpfpMwhpBJfQ0Cyyy%2FO7TWI%2BIxa4olOJ%2Fw%3D\"}]}\r\ncontent-type: image/jpeg\r\netag: \"8df1bc0885556be\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82f18c9723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":513377,"size_decoded":514007,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3, xresolution=50, yresolution=58, resolutionunit=2], baseline, precision 8, 962x717, components 3","md5":"aa7657f45fa7d464961c3e0a2d7c5abb","sha1":"691c87bb63a9e07831a2bfcc584ef7da90264633","sha256":"d3a49a4d9a78b2bb6ff047a9a4c08a477e1331842bd535f606205dbe0a14442d","sha512":"995b65e4d36656be121d847727edac7c82fb958b227c21e724bc4fd8bee428b2feafd428eb0baf18ad3e86ca22b2f5aca5ad8531286c111be3048bdc5da5c19f","ssdeep":"12288:8EledHNh6XO7X+LDtg6Nd8Nb9OsF26Yl8TzUAxnWvp+J:qdHKkSRExOOTzUigE","tlshash":"a1b42335f2836517c9db36f4cc0a0461c6eb972eda1ab5ce63a0584c682f9f49f2724d","first_seen":"2026-05-02T03:19:57.484243Z","last_seen":"2026-10-16T14:35:05.818805Z","times_seen":2,"resource_available":false,"data":null}},"time_used":2364,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":376,"receive":1988,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/js/popper.min.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.632Z","timestamp":1792161241632,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/js/popper.min.js HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: application/x-javascript\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aN7qlYQmdkzZycQQXvJE1Ai08v%2F5zG4L6wGbJGFQ8V6Owd22wGbcPrUkswTFi8A%2FmYSIqrjwJp7d7%2FTPnLifgpa5waR2vZogPI3bcTMLPdxhGHTKyG2TjHh0Hbc2vKPika%2BuhNU%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1bc081805962\"\r\npriority: u=3,i=?0\r\ncf-ray: a4b7c8302990723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21262,"size_decoded":8791,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with very long lines (21084), with CRLF line terminators","md5":"855075c14fed65779e9226874c12d223","sha1":"eb352e9da7a729ab8dd14f41e8aa3c47d3a9e4de","sha256":"03f5c3670a8445c0af75a1b934be176f6c1cde339fbe76b1062cc51e590bca98","sha512":"7ca3d85a512e71642eced745f71fab314bf33b70ed9250fb93ccf725d3d3dbaa971734fcc73968f66e6112303c7e41b92c0d3db55e0596404bd923aeedf108f1","ssdeep":"384:xnMQG5rwVO7dV9nNbRGCB9D45Hkn5vj2xpOxvIAgD75zBi5vISg3gzopL9TidOgp:M5sg7X/jD45eSxpOxvKD73i5vTzwL9TE","tlshash":"27a2b3cc3294b06643a791a7a0bf960eb2339875610e9410f199f2e97c30ef9917fd79","first_seen":"2023-03-07T12:40:49Z","last_seen":"2026-10-16T14:35:05.820408Z","times_seen":861,"resource_available":true,"data":null}},"time_used":864,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":361,"receive":503,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/swiper-4.3.5/js/swiper.min.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.640Z","timestamp":1792161241640,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/swiper-4.3.5/js/swiper.min.js HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: application/x-javascript\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0j0Mx88TKMmMous1WBOIc9Rz4AeXNP8De%2F63P2swS0elTAS4yc6TMJDqNVoKK65kNfxe5kCfT%2BFZvaWxpOlND03jVkOcDiT%2BpyIbiZpQ%2FlgfeYS0rqAPLPGvNpbn7ovqsmTZrr0%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:02 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1bc087c8aa20\"\r\npriority: u=3,i=?0\r\ncf-ray: a4b7c830399c723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":120757,"size_decoded":34725,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with very long lines (65263), with CRLF line terminators","md5":"f73e23ebde1624296c284cbfdca7c615","sha1":"2ba2bc6dbf969b10a1ea9aa8936c9efb22700a7c","sha256":"7a165ed05e8bfe7fa472338a7ba7e37a619701be8f3d8f158bd163a06f613487","sha512":"7f899b1a76fc3c630e00e58669dfd954885d9c8f927db13db36fc44fade67c3abdccdaa7f972ba76acaadf6511d216f4e8dc5a0687fc29db5c4b59abf72a915f","ssdeep":"1536:PorVciYAwdCXrlnLtN+K8ExalQgYySj25RtYNluvpIXvH7WcWUwcPqYbaE8EtObr:zCXrDNFLxvOeluSfH7WcWUwcPquDHY","tlshash":"8ac31949b35071d555e32256539ed201a3b62845b90ac1a831b2dcdbacbde8c03bfefd","first_seen":"2023-03-07T13:14:01Z","last_seen":"2026-10-16T14:35:05.820978Z","times_seen":97,"resource_available":true,"data":null}},"time_used":1393,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":369,"receive":1024,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/images/mkbg3.jpg","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:03.212Z","timestamp":1792161243212,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/images/mkbg3.jpg HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/template/jintou/css/style.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wcTJ8Cv%2BHz%2B3LkQf2kNdBe7oBvaaTf4ssRZUqYfgVJ2H8fbUSAjX8N1MAMi7I7HxwkgPQmL7TCwD3PEgda1glNSll1E5%2F4BCZm4%2Fk98AeA173cBv2Y9KrRJGbKDxCX1DA00eXV8%3D\"}]}\r\ncontent-type: image/jpeg\r\netag: \"8df1bc086f6ae96\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:03 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c83a083b723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":139478,"size_decoded":140106,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1920x1080, components 3","md5":"4a8c0daa8089780affcea737cc3434dd","sha1":"5bade6f46f8cc26c2ad08560a426e7cc80ef69e4","sha256":"120a9d7d6690fe0ba79964779430b8871072931ab2c1d36d2c60e0ef60219d54","sha512":"2b5c3b450310f0831bd2b87ded0085500f99afaf0de4b1962c29bc440075012ec8fbeaa323156671689a7f5ce54ef88472a9b188de46ecfdf33ecea603f98fbc","ssdeep":"3072:xJNsICVd3w0y9ih7k695wU1cAJBtCLZLLbPQ/1tHx14yYsi:L2vVBwkhA695wmlJBwLZLP0g","tlshash":"71d302ca69643eeeda6c837759d78f092225072d7110d3e709f39923d21ea2ebf45881","first_seen":"2026-10-16T14:35:05.821516Z","last_seen":"2026-10-16T14:35:05.821516Z","times_seen":1,"resource_available":false,"data":null}},"time_used":680,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":178,"receive":502,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/favicon.ico","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:04.786Z","timestamp":1792161244786,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=v3j%2FEKY9MhvrHyax17yFl4k7Q2wwPjbI1pF3cvVVhnxR5DP7pQCslOa%2FqWfwHTH2LUbDYPJbF3WSWUD9eNohbviKs%2FOG7Ie0tlj1yjmhFOjN4FDscHntVQMqPs0DazcEhboFyXw%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:05 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c843edff723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":578,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-16T18:26:25.445628Z","times_seen":19150143,"resource_available":true,"data":null}},"time_used":398,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":398,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/images/slide_down.svg","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:03.200Z","timestamp":1792161243200,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/images/slide_down.svg HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/template/jintou/css/style.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B7fq5R%2Fy920ves2Vf8vPPIdTVbWhhILjMQvJNsfxLlavO4pHEPZOwqxlP6Tf73NXbuP5m763cWMSVd9P46NGE2zZFd5jhJn3gxnAJn0EI2i15oTGlqKEXkeH0IJcPULEPrD7TgQ%3D\"}]}\r\ncontent-type: image/svg+xml; charset=gb2312\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:03 GMT\r\nlast-modified: Fri, 16 Oct 2026 14:34:03 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: a4b7c839f82d723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5885,"size_decoded":2691,"mime_type":"image/svg+xml; charset=gb2312","magic":"SVG Scalable Vector Graphics image","md5":"ff73c4114d98478a33e6318dbde85970","sha1":"13e08a6d5dc2cf55c60af6b50566aae4b4f05c69","sha256":"9182f1f6e05f56d5ab9dd7591dea8e85f044141b00369ad0c1ee7763608649fa","sha512":"e438e9042e96036a88d290af6e2a1378e5673babf8b98a07d2d3285395b799fd2bd010fb38c73d86d5b23cc9d4ac3d21bcc61be46d52db4b6030a7f21dd7a468","ssdeep":"96:Ij7nxdS7T/+0AqTXGX83qRHIYTcppf4mz/2PYdaatnmpxfbGYFay+00aaHGmeaA:QbS7TBnmHzQf7kYdIpxDOytabeF","tlshash":"bfc186f9aa2466cd41fdc3d5f6624061676ef8b1b922c945cccf4e31b842484cc7f9a5","first_seen":"2026-10-16T14:35:05.823299Z","last_seen":"2026-10-16T14:35:05.823299Z","times_seen":1,"resource_available":false,"data":null}},"time_used":172,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":172,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ndkszc.com/","fqdn":"ndkszc.com","domain":"ndkszc.com","tld":"com"},"ip":{"addr":"104.21.63.232","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://8pe7xml5.63775.wang/yf6usqyu.php","date":"2026-10-16T14:34:08.400Z","timestamp":1792161248400,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ndkszc.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 09 Oct 2026 13:09:20 GMT","end":"Thu, 07 Jan 2027 13:09:19 GMT"},"fingerprint":{"sha1":"EB:C5:D1:DD:1D:A8:2F:2A:DE:E8:C6:67:AF:BE:E1:6E:6B:1E:BD:47","sha256":"A2:CB:F7:34:01:AE:99:93:37:90:34:3A:DF:1C:D2:E7:95:7B:5B:A5:90:66:E9:65:31:B8:30:1F:58:79:8C:15"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ndkszc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://8pe7xml5.63775.wang/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 14:34:09 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 15 Oct 2026 12:59:05 GMT\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\npriority: u=4,i=?0\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BC%2F%2FomSbPYZLvvYjiuBkD3oxnOk8Nj8HxC%2BJF0tOOc%2BRImpw0Ilc6z1uoXLsFQCfuRubHctqPL2B%2BSgr4xlgwP9Pm2Z8566agBcsLHMSH78kdYBmNpTWund1z5BT\"}]}\r\ncontent-encoding: zstd\r\ncf-ray: a4b7c85abc07dfec-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49321,"size_decoded":9005,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"0f7322284f66b707344e5d5c50d49ade","sha1":"2c355d067316c1ae2fa3bdbce1d3a90443257b3b","sha256":"b59b0e6a664af2dfcd9953905d251f46631ac918c272357cd280083b3cc66920","sha512":"2a2efdd8bf59978a6b9918cefbe20d4987586e38d703164c3c87c500f82afdf652afc6961e0a24b163434da6d95e3f0181ca4194104b72bb87d5c016000724c5","ssdeep":"768:37XMvsH3xN9316vr4h/MRrOFANF41yxMw:37XMvsH3xN9316vr4h/MRrOeNS1+Mw","tlshash":"c7236271d2e215a35023c0d86fe99b6a7fd05803c69b8055bbee17884fdafd8e81365c","first_seen":"2026-10-16T14:35:05.824486Z","last_seen":"2026-10-16T14:35:05.824486Z","times_seen":1,"resource_available":true,"data":null}},"time_used":919,"timings":{"blocked":0,"dns":18,"connect":19,"send":0,"wait":882,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"ndkszc.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.mmtd.top/pgsoft3.gif","fqdn":"img.mmtd.top","domain":"mmtd.top","tld":"top"},"ip":{"addr":"104.21.29.180","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ndkszc.com/","date":"2026-10-16T14:34:09.393Z","timestamp":1792161249393,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"399ee6eb.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 29 Aug 2026 23:51:54 GMT","end":"Sat, 28 Nov 2026 00:51:50 GMT"},"fingerprint":{"sha1":"18:F2:21:F7:61:95:C8:F7:9D:64:CD:DC:93:E6:EC:3F:A5:AB:9D:6B","sha256":"B7:D6:82:9B:2A:6D:E1:B6:CD:D9:F9:C3:1A:64:4C:2A:82:9E:F5:EC:F2:DA:54:1B:97:70:21:C7:BD:15:10:71"}}},"request":{"raw":"GET /pgsoft3.gif HTTP/1.1\r\nHost: img.mmtd.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ndkszc.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 16 Oct 2026 14:34:09 GMT\r\ncontent-type: image/gif\r\ncontent-length: 269378\r\naccept-ranges: bytes\r\netag: \"5ae29df546022c3d388ee1b949d5e0f0\"\r\nlast-modified: Thu, 20 Aug 2026 18:35:21 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yLjtQhgNRM5H5XFILmMcBvGtRRsg3N1TtSpXtCB0aK76VaM%2F8B61bQOPamYnNVvHNK%2FGQgzpldmxCimdqw%2FAWJ3KA4rZgwLvqxh2vfy4u75zjgYBVijGM6EY9pGABp4%3D\"}]}\r\ncf-ray: a4b7c8614f0bc272-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":269378,"size_decoded":270030,"mime_type":"image/gif","magic":"GIF image data, version 89a, 800 x 400","md5":"5ae29df546022c3d388ee1b949d5e0f0","sha1":"41e35f41bbb888ca890631ac0613da9b37bd6e12","sha256":"cf1d14ab1a80fbbfa31fa08b61188d11dda7f17f70302371b3d1567a751a5980","sha512":"f55dc2e357aeace42545c6b4615434d1e7c4ce76de68e7b8515ffcf48ff129aaacb7ed79ebd321a5ef6c6e576f59f4778c6399ac43c717ab438ab14496955b60","ssdeep":"6144:IUlsBpJT2/gJUdzjpf0rB7pr+Wt1qLM4ZHkZh69Gv7EwqOqhJGRd:fkJa/EqnpMuWqLTdkPkGv7+M","tlshash":"3f44236b134f605d21c1e5611233b19a2b7bcaaff2d2b89073e787cfe18d6904d11a6d","first_seen":"2026-10-16T14:35:05.825732Z","last_seen":"2026-10-16T14:35:05.825732Z","times_seen":1,"resource_available":false,"data":null}},"time_used":372,"timings":{"blocked":-1,"dns":41,"connect":0,"send":0,"wait":272,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.mmtd.top/wynnpalace.gif","fqdn":"img.mmtd.top","domain":"mmtd.top","tld":"top"},"ip":{"addr":"104.21.29.180","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ndkszc.com/","date":"2026-10-16T14:34:09.397Z","timestamp":1792161249397,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"399ee6eb.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 29 Aug 2026 23:51:54 GMT","end":"Sat, 28 Nov 2026 00:51:50 GMT"},"fingerprint":{"sha1":"18:F2:21:F7:61:95:C8:F7:9D:64:CD:DC:93:E6:EC:3F:A5:AB:9D:6B","sha256":"B7:D6:82:9B:2A:6D:E1:B6:CD:D9:F9:C3:1A:64:4C:2A:82:9E:F5:EC:F2:DA:54:1B:97:70:21:C7:BD:15:10:71"}}},"request":{"raw":"GET /wynnpalace.gif HTTP/1.1\r\nHost: img.mmtd.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ndkszc.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 16 Oct 2026 14:34:09 GMT\r\ncontent-type: image/gif\r\ncontent-length: 244436\r\naccept-ranges: bytes\r\netag: \"31974afddf3711c41f34599b39edb43e\"\r\nlast-modified: Thu, 15 Oct 2026 12:36:29 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dGEPphVgrdBIgCO2y5ePUpLoCdDp%2F7C6MF59gYzRCKBIUdfjfMEgKbedSWU0t6qc5l69fQ4c0KXEBgsdNqeoVcR8C%2Fm6TS%2BCzafuAgUXqL8qjM7gkKLOXOtpRaLltBY%3D\"}]}\r\ncf-ray: a4b7c8614f15c272-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":244436,"size_decoded":245088,"mime_type":"image/gif","magic":"GIF image data, version 89a, 800 x 400","md5":"31974afddf3711c41f34599b39edb43e","sha1":"1f5ea3eb59d3f29e7e032b88878128375f9fa4eb","sha256":"85660b2a9e98f97d80c89b49f78eeea5180ee5ea6da18ad41523445098864067","sha512":"d05ac207b66bdc396079b7d6419352502eef3b0ae21cd92724f667da9fa61be224a60cfc8f29cf835c2823c2ff1f9d2184836c48ec08b777d6b4e7046caf3927","ssdeep":"6144:X8JfOXPWa/86ApN1lboFJTlLIA0jsb9c+QgQ33r05ecIJahu:X8J4PbMTdoFZlD0cQgmY5eShu","tlshash":"9e34134b18490cb95ce0708c7ce6b68cf4d9722dffb05caaf19a1d8032591f59187ae7","first_seen":"2026-10-16T14:35:05.827247Z","last_seen":"2026-10-16T14:35:05.827247Z","times_seen":1,"resource_available":false,"data":null}},"time_used":395,"timings":{"blocked":85,"dns":0,"connect":0,"send":0,"wait":302,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.mmtd.top/pg6367.gif","fqdn":"img.mmtd.top","domain":"mmtd.top","tld":"top"},"ip":{"addr":"104.21.29.180","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ndkszc.com/","date":"2026-10-16T14:34:09.401Z","timestamp":1792161249401,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"399ee6eb.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 29 Aug 2026 23:51:54 GMT","end":"Sat, 28 Nov 2026 00:51:50 GMT"},"fingerprint":{"sha1":"18:F2:21:F7:61:95:C8:F7:9D:64:CD:DC:93:E6:EC:3F:A5:AB:9D:6B","sha256":"B7:D6:82:9B:2A:6D:E1:B6:CD:D9:F9:C3:1A:64:4C:2A:82:9E:F5:EC:F2:DA:54:1B:97:70:21:C7:BD:15:10:71"}}},"request":{"raw":"GET /pg6367.gif HTTP/1.1\r\nHost: img.mmtd.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ndkszc.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 16 Oct 2026 14:34:09 GMT\r\ncontent-type: image/gif\r\ncontent-length: 241366\r\naccept-ranges: bytes\r\netag: \"0781d6ff8d0901f9876aa25722271dfc\"\r\nlast-modified: Thu, 15 Oct 2026 12:41:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OY%2B5U%2F8NELa1xfufUGxi1lawO4eoKkl%2FYWuV9GBDFOBUsIKLmBZ2oAQIJLlvcRrr%2FpjHwrXI0%2Bt4jjwwTMctlDXqtnuei6O7j9r4cIvxEEPfr0g9dasRaj2f3oC7Tks%3D\"}]}\r\ncf-ray: a4b7c8614f22c272-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":241366,"size_decoded":242022,"mime_type":"image/gif","magic":"GIF image data, version 89a, 800 x 400","md5":"0781d6ff8d0901f9876aa25722271dfc","sha1":"94b785c4b70516eef56578d637f245064e4333b1","sha256":"081558ae08067c25490571aa0da1bf2ea5e09a0d6c468a3ea20744f373ac3121","sha512":"0b81bc7c72d190cda1508c2211209a608c3b5ea326ea0634294dc0e36500cdacbdf52d7eb4e59feae9643239458fc48f39dff07d58e75bb30955fb157a5801dd","ssdeep":"6144:LHmm+IG9qOVwgCLoOwf4hKMUMzG/gvH59tVskiHhgST:yHV3Oy/gv9lOmST","tlshash":"b63423523d4f5bb3dcab342109e26bfce347e677a51677a63fc69032566200a284c372","first_seen":"2026-10-16T14:35:05.828952Z","last_seen":"2026-10-16T14:35:05.828952Z","times_seen":1,"resource_available":false,"data":null}},"time_used":613,"timings":{"blocked":84,"dns":0,"connect":0,"send":0,"wait":276,"receive":253,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.mmtd.top/wynn6.gif","fqdn":"img.mmtd.top","domain":"mmtd.top","tld":"top"},"ip":{"addr":"104.21.29.180","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ndkszc.com/","date":"2026-10-16T14:34:09.403Z","timestamp":1792161249403,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"399ee6eb.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 29 Aug 2026 23:51:54 GMT","end":"Sat, 28 Nov 2026 00:51:50 GMT"},"fingerprint":{"sha1":"18:F2:21:F7:61:95:C8:F7:9D:64:CD:DC:93:E6:EC:3F:A5:AB:9D:6B","sha256":"B7:D6:82:9B:2A:6D:E1:B6:CD:D9:F9:C3:1A:64:4C:2A:82:9E:F5:EC:F2:DA:54:1B:97:70:21:C7:BD:15:10:71"}}},"request":{"raw":"GET /wynn6.gif HTTP/1.1\r\nHost: img.mmtd.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ndkszc.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 16 Oct 2026 14:34:09 GMT\r\ncontent-type: image/gif\r\ncontent-length: 285201\r\naccept-ranges: bytes\r\netag: \"6e2cb4e40adb69778e9b7bdec233c5b4\"\r\nlast-modified: Thu, 20 Aug 2026 18:40:30 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z2GbggSl0Z5UQxfqxAImNKhi1UPH%2BafFEISGEHMkAJdY%2FmQF5nyFXapbO4CwlvUc63F%2FawngDv3QCN%2BUTWrFj7xCepZBlONTL45e224FUA5Ju4b7Z0U5JTgDBCxl1zI%3D\"}]}\r\ncf-ray: a4b7c8614f13c272-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":285201,"size_decoded":285855,"mime_type":"image/gif","magic":"GIF image data, version 89a, 800 x 400","md5":"6e2cb4e40adb69778e9b7bdec233c5b4","sha1":"4f1476118806fc30f899bcc75df5dfb4b9b6a1b8","sha256":"5d6797a9fad6365c4febcb6dd33f453cd7dc6fcc83f0c4b78d83f7b823e3fd4b","sha512":"81752866f3f8bd8aef0635b7a700af9c8262c0e149a19c29924bf952c58042ded3eece2daefcb96e58a61673190733c7fab17b0be965441f2fbe8f041662daf0","ssdeep":"6144:ghD0fiBjU/BW7ksgRBdjLgenob8anBqTLzInbrjGO9girRL+NRp:iLjCBmOnogIqTLCSi3tKNn","tlshash":"725423cab494a74c1f794626b97725f4bfdce88687bc08a41f3a3583742a72c7857207","first_seen":"2026-10-16T14:35:05.830268Z","last_seen":"2026-10-16T14:35:05.830268Z","times_seen":1,"resource_available":false,"data":null}},"time_used":420,"timings":{"blocked":81,"dns":0,"connect":0,"send":0,"wait":317,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/swiper-4.3.5/css/swiper.min.css","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:00.964Z","timestamp":1792161240964,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/swiper-4.3.5/css/swiper.min.css HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Qao6lzVB9DH2ni4FAWpGgLXjGt%2FYwxohMqKlkmI5I00NH5AXtWHZ%2F06cCGYNCM%2FiXioGtiZVoj3jw5fWAdeCsQPiCDNhPXlb1o%2BCGDW0yszU5jEGogsqH0LpdehxyZdv4QfKsog%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1bc07d262beb\"\r\npriority: u=2,i=?0\r\ncf-ray: a4b7c82c0f23723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19785,"size_decoded":4235,"mime_type":"text/css","magic":"ASCII text, with very long lines (19512), with CRLF line terminators","md5":"a14f9e37faab8461a617c4dc3901b2f7","sha1":"e5254e75466db6b1d9997a0107fffe6f79a9491c","sha256":"66859aebabf3e2e3d89cc5d21c193c82f4be90d96faa19ce3ee7c8ed70baf5f6","sha512":"8ac42cfff0e39215e911cadb9a979d34ae13502ff02cca0bea3b1be75d3654da8370223d8c62dce426d8d9f6e9e51ce6dc750268838b7471c6960c7cf2172a12","ssdeep":"192:xpEaNv/lSSyJWCh8zfi5o/mXDN3eBxwdJ5c:xea1/lS0Cifi5o/mXOGJ5c","tlshash":"2e92612c17003057e2334f1a87d99778c724c9939e4358ef6250ee48c7bb96a32af766","first_seen":"2023-04-12T09:34:15Z","last_seen":"2026-10-16T14:35:05.831621Z","times_seen":287,"resource_available":true,"data":null}},"time_used":891,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":377,"receive":514,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20230424/1682336938948050.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.459Z","timestamp":1792161241459,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20230424/1682336938948050.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OX9k6fDYn8Zj454eaHKtip6weHjgyP9NmsZ8yaTgh8bKGwM%2BYjbwNRzLB4z1w8jTgjt1xb19lxbnxbKcLSH8P2IcNff9rtgxw7053fiNFw6aEa0qhXzjsESbEnFK4pBfqWHtc4U%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc087bf1fd0\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82f18d1723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":322057,"size_decoded":322678,"mime_type":"image/png","magic":"PNG image data, 511 x 316, 8-bit/color RGBA, non-interlaced","md5":"085addde2f99826d8bb8b23b3fae9758","sha1":"698718a960b9e8484c6c92674922bf7b772f1a7c","sha256":"31d8dc53cc9f2faa320cc7407b3eacc01b2cd06d58589970909a7201fca0b79b","sha512":"3f888d79299885c36eeccd428e343ea0fc4a4eefff40dce79adc4b69674361bf9b5a3af20c931091585a199b2d76502e52a597e6ac1edd72ce395572444ad6c6","ssdeep":"6144:EVeH/kL0csmqGDH4qUbxoPHz7LRzfCenwZ9LyZaCnoqgvyUwZ8Yh:YeH/kQoHLZPHhfCenwTLy8CoTvygG","tlshash":"c464230d86d19d0252b5f736efb8ecd811b2350b1fe1a59ecc36b1c4943909f9a17a23","first_seen":"2026-10-16T14:35:05.832209Z","last_seen":"2026-10-16T14:35:05.832209Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1754,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":356,"receive":1398,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20230823/1692758372655496.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.634Z","timestamp":1792161241634,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20230823/1692758372655496.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iyIJL7SaohE0lC%2BnPSIw51POMdbSc73f6qJCYnrfTNsoLPzoInn91lx%2Ba7H4HgsCojSCr5uXD0P0VObmY3li6dc1YXFlDdDjECu2ML5N9RDYVhhetVlQRmJlw4dTAUmcUPkUfTc%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc086f1e9a7\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c8303993723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19256,"size_decoded":19879,"mime_type":"image/png","magic":"PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced","md5":"d0289dc0a46fc5b15b3363ffa78cf6c7","sha1":"29c400bc3b89f6085766dac4e0330ded5cb73d52","sha256":"a20583c81805fe64f7fa210851ce29754af9d25fd6aa5a3225a9557529602513","sha512":"10a9cd6fd64b8107db8b058eb8c4cc0fe23bb5c13a91d40caf93d323f4a15f1b34463bf0eacb0239c6dbd699ec6c49a8625e86cec674cc7b351509155b889e7f","ssdeep":"96:VSMllcHitlIxv9vk7C1+I4wWHLihk/xGWvki7rxmVKXUsDEVWvdNGthls+GfNXrL:VSHIIHUCD4wabkijpso15909rfEx","tlshash":"1c823928fcf0b125548993393de674095c779bc3c681ac45badc8a0b6f00fa95d6b183","first_seen":"2023-04-16T20:03:19Z","last_seen":"2026-10-16T16:44:44.744869Z","times_seen":11809,"resource_available":false,"data":null}},"time_used":857,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":351,"receive":506,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/bootstrap/js/bootstrap.min.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.635Z","timestamp":1792161241635,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/bootstrap/js/bootstrap.min.js HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: application/x-javascript\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2TD9%2FfoEEBa6xBTCJx9vKonhiwdFmaRMts6RC8SigXeJtZpSmARmULwNM8xnzArXJK5ZQgS6cUvazgiVd2IYptPk6L1i5QeaXPMcccS52pAw5Y5u7w6T9WYuOMPQ6%2B6kMU23ETE%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1bc084977413\"\r\npriority: u=3,i=?0\r\ncf-ray: a4b7c8303996723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":60016,"size_decoded":18309,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with very long lines (59729), with CRLF line terminators","md5":"7451e07cd6077783b728c0c924da6629","sha1":"fe104e2ab91ecd0a39dff04e5aca698440bc9e22","sha256":"4fb5913ee978bde28acce2944e8139aaedc5c22bd51f88a1fcab174b1cc5694a","sha512":"c1ea2fce2f8a0d3d2893cc6f9fececbf16db46d4c196deac69cd0bafac764cac5fb2063ef390acfb04c2f01c29d1640f3234eefbff5fda12a0e5f6f851665936","ssdeep":"768:0ZYGDyGi43HVzdR2BmDb7zTNilqtvY1xWiDLYjQVW1/MVOlKvnxFa+B0DV:0ZFXOCx0wNGaYkR","tlshash":"5743c80a72547873059fa176817f420bb736798ae90a826cb91d98dd1e7cc893237f7c","first_seen":"2023-03-07T01:06:36Z","last_seen":"2026-10-16T14:35:05.83406Z","times_seen":1319,"resource_available":true,"data":null}},"time_used":1074,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":369,"receive":705,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/images/line2.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:03.210Z","timestamp":1792161243210,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/images/line2.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/template/jintou/css/style.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GUsVo7IWmwDA%2BlZeT4BnLYTn0vDbRFgQyKI%2B%2BgEyhVhjcCTnc%2FCk3GXgPoMC76lIvK0DsaTaVlaR%2BUK4G0TZBYQ7%2FpLS8FvFuVWBwHp7CmPzcBybMFBjnCraZ8xxSNZV5kqSYuQ%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc086a2be70\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:03 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c83a0838723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1122,"size_decoded":1753,"mime_type":"image/png","magic":"PNG image data, 93 x 4, 8-bit/color RGBA, non-interlaced","md5":"cbe736484aab91363ad4b182fda6a121","sha1":"e3812b2b0a5f041e4737ccc25f4bcd08c996a968","sha256":"2735da9a39de36cb292669cb078a2c85c58f86b3f5669a60de5ae6d61e641b68","sha512":"d81aed435c4fb42169403202d2ba58dc3e42b507dd559e3d48ec7b760cd57f1bd7ea4f8ce930783f4b091727181746267b91dbb28ef3587b3553d0229218389a","ssdeep":"","tlshash":"5a2166aef980d4021544aec329e174235d636980ded0e455bcafd89759e01fe847e5cf","first_seen":"2026-10-16T14:35:05.834632Z","last_seen":"2026-10-16T14:35:05.834632Z","times_seen":1,"resource_available":false,"data":null}},"time_used":180,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/font-awesome-4.7.0/fonts/fontawesome-webfont.woff?v=4.7.0","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:04.956Z","timestamp":1792161244956,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/font-awesome-4.7.0/fonts/fontawesome-webfont.woff?v=4.7.0 HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/template/jintou/font-awesome-4.7.0/css/font-awesome.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\npriority: u=3,i=?0\r\ncontent-type: text/html;; charset=gb2312\r\nvary: accept-encoding\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:05 GMT\r\nlast-modified: Fri, 16 Oct 2026 14:34:05 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yK7zO7WHEfYx42LBRw65oOGGBY%2BoHKzeT8pOG2cdt0yHSuSvZHdqprDLGHR5wiWiEauCFRxv6Y1ZWmJTil9hTMic949Qp0LmHwW%2FeTQxgtykBbCqfa0SQ6VlUqMgFCb%2BJQG6xZA%3D\"}]}\r\ncf-ray: a4b7c844fe89723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":89737,"size_decoded":90426,"mime_type":"text/html; charset=gb2312","magic":"Web Open Font Format, TrueType, length 97855, version 4.7","md5":"e5421ee9b801d7140c981379cd4fb863","sha1":"80346b4e4fe47548d56bea5949f14546660e2f2a","sha256":"3d605e832696908e7b7c8fa97499a7761fcbfa78cf1d839916a6bff491ab9d52","sha512":"50b95c35982070e98109eb7a5566f5c0872cfdb7153f773f26c27ebb6b876a9fa895ec2ffb159ee6c3138f8b05117b198c986c79a03e3adc05bbd4e01df19981","ssdeep":"3072:J2naNTPBhquuVklaDyqYQjBqIA+9UKuYk1/I39I3AVg:J2alquu2laDy/6A5Jv+O3v","tlshash":"c2b302455c7b861c462d386b6ab382ba3bd04c8e90789378c85579fd2f4c404b77f9ea","first_seen":"2026-06-24T17:26:05.697747Z","last_seen":"2026-10-16T14:35:05.836107Z","times_seen":8,"resource_available":true,"data":null}},"time_used":2308,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":343,"receive":1965,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/font-awesome-4.7.0/css/font-awesome.min.css","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:00.957Z","timestamp":1792161240957,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/font-awesome-4.7.0/css/font-awesome.min.css HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aKxn%2FGiWyypbLWGyh04wO1dMnsmA09X%2BAisAgbJx%2F2ZFpmp86FJLHcQbq7POlKlIPGRKuzLsb1i1I1fPjJdinKu8PIkd629fk8lkO%2F5gM0%2Blj15us6eCLQrIuvnK0lN%2BRnWjckg%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1bc07c18bd9e\"\r\npriority: u=2,i=?0\r\ncf-ray: a4b7c82bff1b723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31004,"size_decoded":8008,"mime_type":"text/css","magic":"ASCII text, with very long lines (30837), with CRLF line terminators","md5":"a0e784c4ca94c271b0338dfb02055be6","sha1":"88af80502c44cd52ca81ffe7dc7276b7eccb06cf","sha256":"820e169ce24824066d9973fd4b6561aae9dcd6dbef6435da905d5a1d6482997c","sha512":"97149632c15eb33690273abfa78636ad0471999363e11bf59ca61a4de32444e6f299db3b80d52b2e9437c645ec235fa8d3b8c20dcc350dbb9e175f12b3849a64","ssdeep":"384:/Hu5yWeTUKW+KlkJ5de2UYDyVfwYUas2l8yQ/8dwmaU8Z:/wlr+Klk3Yi+fwYUf2l8yQ/e9vC","tlshash":"3dd241e8e54c01d66731c48bff81b36862b6fb3dd5854da9f01f290c29d226522c5fba","first_seen":"2023-04-05T11:31:05Z","last_seen":"2026-10-16T17:50:53.877039Z","times_seen":19835,"resource_available":true,"data":null}},"time_used":868,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":367,"receive":501,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/css/style.css","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:00.962Z","timestamp":1792161240962,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/css/style.css HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=90ZOBxr33l%2Fv6ui4vM1n5%2Fz%2FYiUACtnDJBPM6pKThVNlqCmlZFryZhd3L6l8nPFjunJSQvOIOwLO3Bz%2Bw3J7WVP5N4B976uOT5omuMhjg23py%2FM6FBTb5Hvp3XMkvJFVtwh2B1E%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1bc07d452b85\"\r\npriority: u=2,i=?0\r\ncf-ray: a4b7c82bff22723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21918,"size_decoded":7216,"mime_type":"text/css","magic":"assembler source, Unicode text, UTF-8 text, with very long lines (378), with CRLF line terminators","md5":"d1c45f344edcba5771990139bc05a45c","sha1":"8f0a1a6293dfd47ddb8a8d509aac6571d7698e51","sha256":"eab8abc85e8bf7269198316c2a009924aa58aa6821f3be835172242cdafbe262","sha512":"3d525f2a0c06716c1f9baf6b801f498f30285258735d2113cd88e258105efbbc352a11d5cafa0ee121b9f6e74058f153d9b6322acc348f4c7e0095f1bc6fd9f4","ssdeep":"192:hF3TtQU2BD0BQO7yUGh2IV1DUovNoVTKH2lww5L5O1/7C9O0vSZoR9YpbA7ptJmp:nqYRovNo4uLI1P06o7WAu","tlshash":"4da2a4639b4a220d2133da98a7935bad9e7d4002e6010e7d76e73af4476e5ce11f1f8c","first_seen":"2026-05-02T03:19:57.491219Z","last_seen":"2026-10-16T14:35:05.837166Z","times_seen":2,"resource_available":true,"data":null}},"time_used":933,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":367,"receive":566,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.mmtd.top/sands2.gif","fqdn":"img.mmtd.top","domain":"mmtd.top","tld":"top"},"ip":{"addr":"104.21.29.180","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ndkszc.com/","date":"2026-10-16T14:34:09.389Z","timestamp":1792161249389,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"399ee6eb.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 29 Aug 2026 23:51:54 GMT","end":"Sat, 28 Nov 2026 00:51:50 GMT"},"fingerprint":{"sha1":"18:F2:21:F7:61:95:C8:F7:9D:64:CD:DC:93:E6:EC:3F:A5:AB:9D:6B","sha256":"B7:D6:82:9B:2A:6D:E1:B6:CD:D9:F9:C3:1A:64:4C:2A:82:9E:F5:EC:F2:DA:54:1B:97:70:21:C7:BD:15:10:71"}}},"request":{"raw":"GET /sands2.gif HTTP/1.1\r\nHost: img.mmtd.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ndkszc.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 16 Oct 2026 14:34:09 GMT\r\ncontent-type: image/gif\r\ncontent-length: 206948\r\naccept-ranges: bytes\r\netag: \"f2c68a2680ad0662aa9105cfc36535d8\"\r\nlast-modified: Thu, 20 Aug 2026 18:33:46 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=32MEb6euIRPovk6%2BU0O1g02Z%2BJjzyeMF8iGldO2Vkj5NXSTJSBTs6AyyNsQwDELBhB%2BboAHs4M732%2Fut1f75zEbk1GeWXd7rxkHFslCwGLBycevI%2FwcP%2F2AvWw12K7A%3D\"}]}\r\ncf-ray: a4b7c8614f0ac272-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":206948,"size_decoded":207606,"mime_type":"image/gif","magic":"GIF image data, version 89a, 800 x 400","md5":"f2c68a2680ad0662aa9105cfc36535d8","sha1":"fbdafc7721a045fe06f7d8c54207df326e98168d","sha256":"6644e5d4ff8da0ad95fd2783558733032870aebabf7bb3dc2f9c31c628fd73c1","sha512":"33423f7e8e9f606b74c99b851f74a4d6684500520ae5d6dcca87450f4fffd116d9df1175273a2a2c202dd8e026867708efa902ca14ded1e96082d68262c202bd","ssdeep":"3072:1vaBd/8ixfkAbJdM7L70XpqaB9OE098P1t+zZWx5mSHL6Ksuk4T1XQ+yt:1GtltM7f0XjMs1U2mLSBgHt","tlshash":"0214222ec9df270734f5804415a96cdc2a20618fcc07bbbdd55295ba0622bef5623b7d","first_seen":"2026-10-16T14:35:05.838677Z","last_seen":"2026-10-16T14:35:05.838677Z","times_seen":1,"resource_available":false,"data":null}},"time_used":431,"timings":{"blocked":-1,"dns":44,"connect":0,"send":0,"wait":284,"receive":50,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/images/icon3.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.630Z","timestamp":1792161241630,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/images/icon3.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rCjFvdwf9CzU7HLDKtNjfRB%2FiSo%2FB4cgFjWQVDInpiawqFFdqByzwcG%2BksDWeEzJijevH54m8DYuKkZY207OfHvWfSeay8VaREbNdsvow3U%2BiLZl3MAN9FqL1JxI8gyXIR%2By1Ek%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc086aeaa3f\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c830298f723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4830,"size_decoded":5459,"mime_type":"image/png","magic":"PNG image data, 189 x 192, 8-bit/color RGBA, non-interlaced","md5":"f7326c244c8ce2a5fb3d5d9266c098a2","sha1":"9091132ed50bc60800fd839cadb39e4da7af8eb4","sha256":"cf8af609ffca01187c5a6591a02cc1cc4571585c048ab699d0a7e1de059d5712","sha512":"b6ab824999f61323b3805ee5d88f43bd09a699d89f62a6dff364b6dde5f60e18322a95b06338a468c98d1bc5120aa7e0a9423235ecab860d96d588bb71d9d392","ssdeep":"96:nD9AknmWpPbCR/UHlubNHi5hQ9opJxjn1BdXeH9GXXJdjaVDn:nD6knTF8J0oot3d29B","tlshash":"eaa15e01e142ef02322a970579dfa0d7063629885dd1ea09ffd6ccd752654ede80b4eb","first_seen":"2026-10-16T14:35:05.840019Z","last_seen":"2026-10-16T14:35:05.840019Z","times_seen":1,"resource_available":false,"data":null}},"time_used":506,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":345,"receive":161,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/css/jquery.fullPage.css","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:02.477Z","timestamp":1792161242477,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/css/jquery.fullPage.css HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NjqsfENDk2VzALJC0XPuSRh3Dy%2FtFD%2BVOuZo89V8NF30skUjiXvqwRagG0EcYluGPcc2s6zSo6JHJgCFW75tgtbpUcAx0uFqouGe3OrzDuNsE5CStchEkCITy6v3zbPQvjTjjYA%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:02 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1bc07f9eb28b\"\r\npriority: u=2,i=?0\r\ncf-ray: a4b7c8357d80723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3515,"size_decoded":1759,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"528be4aac4465f768ff9e0880e2c4692","sha1":"a887cb13a8fbd976691b5b5c06831caffde1fe35","sha256":"34f8356b9d1a4c8c257d32c69794fe91b18ccd0f43c0232c71d188e4b261bbc0","sha512":"43828c8e508094f08212d94de06fd91e9456bc4f739b14bc3e9afe0e4e5938af31bb5ee70faa2b113f2fb54dfcae12fa6035490d0e11e64c61a2d4eb37e4d38f","ssdeep":"","tlshash":"6d71cefd93c25283a233db78339047ba79f508a27a42015c7ade948457cad7d2712deb","first_seen":"2026-10-16T14:35:05.841361Z","last_seen":"2026-10-16T14:35:05.841361Z","times_seen":1,"resource_available":true,"data":null}},"time_used":552,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":381,"receive":171,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.mmtd.top/right-logo.webp","fqdn":"img.mmtd.top","domain":"mmtd.top","tld":"top"},"ip":{"addr":"104.21.29.180","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ndkszc.com/","date":"2026-10-16T14:34:09.382Z","timestamp":1792161249382,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"399ee6eb.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 29 Aug 2026 23:51:54 GMT","end":"Sat, 28 Nov 2026 00:51:50 GMT"},"fingerprint":{"sha1":"18:F2:21:F7:61:95:C8:F7:9D:64:CD:DC:93:E6:EC:3F:A5:AB:9D:6B","sha256":"B7:D6:82:9B:2A:6D:E1:B6:CD:D9:F9:C3:1A:64:4C:2A:82:9E:F5:EC:F2:DA:54:1B:97:70:21:C7:BD:15:10:71"}}},"request":{"raw":"GET /right-logo.webp HTTP/1.1\r\nHost: img.mmtd.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ndkszc.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 16 Oct 2026 14:34:09 GMT\r\ncontent-type: image/webp\r\ncontent-length: 155902\r\naccept-ranges: bytes\r\netag: \"e334c392588b0abc6b5fd62ecb3c1e64\"\r\nlast-modified: Thu, 20 Aug 2026 18:28:26 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DvZ5NZE%2Fkan9N5DZqv%2Fx9jQ8JU8gscx6dNXw15vKC1vKU83c0L3YumPBh9k7wQ7JPByOsORvCJ%2BGRTuHuutJLKO%2FJQZ0cvj2JvufB8wkfC4HfIbtX8a21D6NRvn0iHk%3D\"}]}\r\ncf-ray: a4b7c8614f26c272-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":155902,"size_decoded":156557,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e334c392588b0abc6b5fd62ecb3c1e64","sha1":"72cfad39d3fdb38436cb4dcefb2d3773f63a3edd","sha256":"b7988486c94d8e1dadce32a62b4c49db56e775cac9cc3614beddd5a960e6879f","sha512":"e17ae32210f616a48dd0629c393e1dfdab502107ed56680f63acb16953290287cd702b8f28e5f3ff393f7735c2ccbfdecc9960b6e259a62e68df85712afbb79d","ssdeep":"3072:7Jo3dgI/FENgBAWUkFHg18nSUZpuMLyIBhqvkhTahVhGKmIpnPJsa:dKdgi+EUkA4SUf9hBhqvhbhGK/VJ1","tlshash":"81e31212d3e1c239c878c97621edfe35b677a70de23630d44645678bae922406bfd436","first_seen":"2026-10-16T14:35:05.842582Z","last_seen":"2026-10-16T14:35:05.842582Z","times_seen":1,"resource_available":false,"data":null}},"time_used":396,"timings":{"blocked":-1,"dns":51,"connect":0,"send":0,"wait":283,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/js/public.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.637Z","timestamp":1792161241637,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/js/public.js HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: application/x-javascript\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PTrJyx%2BpXYTbIV%2FP7JLZLN2Fykuv0%2F11MhbG4%2BGtUQRZ0zDPMtXSKjPiOXfxsYBzQSyClWLgXXVfn5jQvmzYRyenOeDECVhJ6XOPmzQ2u6UQVa9ycUCfT93VXc8hPIvnnCy%2BxcE%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1bc0854582ec\"\r\npriority: u=3,i=?0\r\ncf-ray: a4b7c8303999723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":650,"size_decoded":1063,"mime_type":"application/x-javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"5dc3ecc4dba321a58166fe33865dedc9","sha1":"b2ffed289abe14312c93cf160549f61995b2e110","sha256":"58c79d31d8a7a09a3dd3643b48498d79b6ad7a1ed1efd3a2a51a76dcc99dcc70","sha512":"eb91986069e16824cbef396cc3d8821388a736404ccf1c96469b354c7c99d1f072b966b3cfe8163e2fea0615123f96f761fc0bb85b12bc031a1123a0647906d8","ssdeep":"","tlshash":"3bf09964f8488aad11f2713560371208ae2b286363021e91d0bd45b43e38a7c5ff3c44","first_seen":"2023-11-26T12:01:54Z","last_seen":"2026-10-16T14:35:05.844086Z","times_seen":18,"resource_available":true,"data":null}},"time_used":357,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":357,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/font-awesome-4.7.0/fonts/fontawesome-webfont.ttf?v=4.7.0","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:07.278Z","timestamp":1792161247278,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/font-awesome-4.7.0/fonts/fontawesome-webfont.ttf?v=4.7.0 HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/template/jintou/font-awesome-4.7.0/css/font-awesome.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nfblilgdi7S2gIsbuL1iQG422IsqcKSyTmUJc9aKTeShoRh9loARnQDspgJo4dKsxzqENwTTkaS%2FuMFjThuReLVapJtflrQI8QbQ700vrllq8ilrseYUqmBij9fAihzN1QYK11w%3D\"}]}\r\ncontent-type: text/html; charset=UTF-8\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:09 GMT\r\nlast-modified: Fri, 16 Oct 2026 14:34:09 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: a4b7c8537e5a723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":88,"size_decoded":804,"mime_type":"text/html; charset=UTF-8","magic":"Unicode text, UTF-8 text, with no line terminators","md5":"7d96de5ff827b49091984cf5e0726c4c","sha1":"594bfed70f1ab3786127e000b89c4413ab1b3670","sha256":"06d1a67ec1ae152ed96f208a2ead7ededcd6aea1c86f5cd8d9510bd3f0dd7f9c","sha512":"dbb7775c89495efc824c4cd6a1b5ada1023843d9dfd95808b49598859489c1c5986a3ec320c2e91c548a0b96b41f4292aaad24f9ded51770e64af920f16314f8","ssdeep":"","tlshash":"fba012cf0099449d71dc0449060000b0836971029b777401b2c0238004008114a3336c","first_seen":"2025-03-28T18:48:16.816189Z","last_seen":"2026-10-16T14:35:05.845291Z","times_seen":67,"resource_available":true,"data":null}},"time_used":1745,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1745,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/js/jquery.SuperSlide.2.1.3.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.006Z","timestamp":1792161241006,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/js/jquery.SuperSlide.2.1.3.js HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: application/x-javascript\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FOQEhoLjS8jeE3m9t4x3rsW11FpguNaJB%2FPobr2xyQE6hgm%2BwAA8YOUpUfd3BHwtOzGCTa%2F5ccJubCTwY%2FizUlWjQGNDU7rRsEOwFLwpBot89W9rIy%2FbRO5TGBkmBPZnVy1zeMk%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1bc07e1bda8d\"\r\npriority: u=2,i=?0\r\ncf-ray: a4b7c82c4f40723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11963,"size_decoded":5011,"mime_type":"application/x-javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (11262), with CRLF line terminators","md5":"90d933b43f8d8ede1bcf3bd61ce24c4c","sha1":"5d2c4ea9e0a8d6a4165a893ef1347edf8ca29b52","sha256":"4eef68c1654d3e996dbc418e1892d3fd6ddc5fb9582f71740c3ea915182dd4c7","sha512":"f408a02f068f7e28a66b743296f0382ef79b05646910ad797ee5300598be643da22ed3511fd7b65f780e7101c08d1fde1eaf392017dcb70ec511a456921c4ffc","ssdeep":"192:OrITKvJoHPHsgGuuauF56tpE9Er5MYB5c3TXP3ZO/mpUhClGS5OHxImISLTNSfY8:OrJvJUsgGuvlMYXcjfRUCESKREcS3KuP","tlshash":"f432a55eb56375ce56a7b3f0107f940d232765a5fcca8ca0b1748380ad79a1c212bbad","first_seen":"2024-08-19T16:31:27.156982Z","last_seen":"2026-10-16T14:35:05.846174Z","times_seen":3,"resource_available":true,"data":null}},"time_used":680,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":348,"receive":332,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20260129/1769661791569922.jpg","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.288Z","timestamp":1792161241288,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20260129/1769661791569922.jpg HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=L4LuenJjU7HjlTgcsj9wh0zMPeI66g9AfMu9JvalPWkhddmC5dP9uVgi8lOy3pErZSpzfZMkPBmHvMT%2Bt2Ex5t%2BpCijb4lS6oYao8T%2FQ%2F%2BV%2BLTZVia4JDGZYEKpXL3qAd5MmQfI%3D\"}]}\r\ncontent-type: image/jpeg\r\netag: \"8df1bc08764857b\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82e0829723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":98690,"size_decoded":99322,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90\", baseline, precision 8, 1920x538, components 3","md5":"0db4c34b6228b040d3b24a07b47398d6","sha1":"d5f81d6c198414dea3404f82666a0697dfe5f4ae","sha256":"05779fab3e88856b648cc9d5395edd05f23c2eff7755cf0f7a3c11f68e7907c4","sha512":"97d2bb39915d8f695f4e59b0b2a5eb6afac19014256eec43ec4c4bfb20916038706e4bee4f6c7c626beff283725c8062131b6c1c69f716ec24d835db706d4930","ssdeep":"1536:ztJV2mS3mJBeSeQKgi4VD3Zdk6kcCdCsUOGc47heMuawVRre7qhRw/udb4p:hJPymJBbfJafFl4AtawfeqXw/iUp","tlshash":"06a3f18329140583d75da3a13e139c6d1a4f7bf8a6cb1c7f11a20f16b2f58e1389a7d9","first_seen":"2026-10-16T14:35:05.847695Z","last_seen":"2026-10-16T14:35:05.847695Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1278,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":390,"receive":888,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/font-awesome-4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:03.267Z","timestamp":1792161243267,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/font-awesome-4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/template/jintou/font-awesome-4.7.0/css/font-awesome.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\npriority: u=3,i=?0\r\ncontent-type: text/html;; charset=gb2312\r\nvary: accept-encoding\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:03 GMT\r\nlast-modified: Fri, 16 Oct 2026 14:34:03 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=56T9D9gtjEJtdmMheo26dNDqF1Kyqo0VA%2F5Cg7EsXY1X%2Fsylf6dyE%2Fiz0fFG0LxIsuevfkRu1WB4aGeWFzNLnSBWkvXd2NcvsHf2ZSWIapZ9sG9c68h%2F85iSLMRboqRhqRnc6Y4%3D\"}]}\r\ncf-ray: a4b7c83a6853723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":70819,"size_decoded":71510,"mime_type":"text/html; charset=gb2312","magic":"Web Open Font Format (Version 2), TrueType, length 77160, version 3584.1025","md5":"5489700c108debeb29955f39ec4d9228","sha1":"09931bb75607405d20cebcf57160f315abead9d8","sha256":"31aa0f60092c851ed1f1a4668255b390ee0aff0bacffca74a1cc054778da55dc","sha512":"f578efc5260b9b6972ae4c58479d9ad23995b1eb291b14403e79f706ba4775d14d673950679428765c3063b4f3c9b1cbfef4458d2b7b7b9906d545bef6a50c5e","ssdeep":"1536:8u3y3IIe+BV1ZpPEwTpbxj+phW6ZJXY3+zJAQMjHk2HVxXsZI9nMgR9RLBs:8RIIe+BbjTpNsZJe+1/mkArsZm/RjL2","tlshash":"c09302862d07dc883c044b9f30669df4aa96f1ed1379c7b4d81bd8f1ab1d1b4726358a","first_seen":"2026-06-24T17:26:05.691881Z","last_seen":"2026-10-16T14:35:05.849907Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1683,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":179,"receive":1504,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/home/index.html?ref=","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.399Z","timestamp":1792161241399,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /home/index.html?ref= HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GzEH0stvplbEL%2BzB2EkvoqQWdjBfU152JwYdWZaYjuOdIDPVW0BUOjNA%2FOwzL9n0ni2%2BOI%2F%2BrMwY9yNoXqxGos4t1zOnQgw5e5fI%2BnW%2BxwUqoNg4Sk2Q0bcuo2OpYYfzG%2F%2BYYG4%3D\"}]}\r\ncontent-type: text/html\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82eb89c723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1770,"size_decoded":1586,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"efa1688d9393b4dc1eae3031450a4326","sha1":"46f8a5bdd20d384156fb0d55950f6321850b7e00","sha256":"e2672b30dee8fd364f428801830a7559fd4fd40680b8b8c056eba825ca28b646","sha512":"55a6cd508032354eeb3be377b14358618f511fda69798224a02ac0aca07c52cffcb14c30fad4ca9f7a8519fe3c0862cf279d475c5df9cdd125832d1db0263b0b","ssdeep":"","tlshash":"d131113625801806b533f375ab92eb05feba5403920682127acc2157cffd945c4b7fb9","first_seen":"2026-10-16T14:35:05.851829Z","last_seen":"2026-10-16T14:35:05.851829Z","times_seen":1,"resource_available":true,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/push.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.642Z","timestamp":1792161241642,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /push.js HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: application/x-javascript\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BBKdn%2BGJ1M2vQZtw5%2FlvymVABNgu8%2FABglUAoujFlUrZqFFBc7Qq1LTbrMKUahagIObev%2FeT2jlNZFqDcX5nfW%2F1DDKgWglCI7Jl7iuFE8ldbVqMyky%2BxqFLCrLsgd9XGCo2YbM%3D\"}]}\r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1b7162d39984\"\r\npriority: u=3,i=?0\r\ncf-ray: a4b7c830399e723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1455,"size_decoded":1406,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with very long lines (380), with CRLF line terminators","md5":"26282ede1149d5139807724d11956125","sha1":"c2e5d639403b4239afd015869e81886a98f0822b","sha256":"d0707e212bcdd19428ee298dc5b0cb647f9e06ef5ba756a06b20a1ab9982ea8f","sha512":"94d896ddb8b0d031f522a2ab95f36152b411ccf887683415df1f769a3e12bd8f89dd16fc5ff37cb4abe5500fe82c1acc0a74aaaa5be8d14e768ba383c4a473bc","ssdeep":"","tlshash":"d83114cf641106bc56b2116c997f399cfaad0a2f8850b140f869d4411f7467743a7ed4","first_seen":"2025-08-20T05:58:30.978293Z","last_seen":"2026-10-16T14:35:05.853198Z","times_seen":3,"resource_available":true,"data":null}},"time_used":361,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":361,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.mmtd.top/tyc222.gif","fqdn":"img.mmtd.top","domain":"mmtd.top","tld":"top"},"ip":{"addr":"104.21.29.180","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ndkszc.com/","date":"2026-10-16T14:34:09.385Z","timestamp":1792161249385,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"399ee6eb.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 29 Aug 2026 23:51:54 GMT","end":"Sat, 28 Nov 2026 00:51:50 GMT"},"fingerprint":{"sha1":"18:F2:21:F7:61:95:C8:F7:9D:64:CD:DC:93:E6:EC:3F:A5:AB:9D:6B","sha256":"B7:D6:82:9B:2A:6D:E1:B6:CD:D9:F9:C3:1A:64:4C:2A:82:9E:F5:EC:F2:DA:54:1B:97:70:21:C7:BD:15:10:71"}}},"request":{"raw":"GET /tyc222.gif HTTP/1.1\r\nHost: img.mmtd.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ndkszc.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 16 Oct 2026 14:34:09 GMT\r\ncontent-type: image/gif\r\ncontent-length: 942785\r\naccept-ranges: bytes\r\netag: \"aaaac3055501cc030a49c3895a04be06\"\r\nlast-modified: Wed, 16 Sep 2026 13:38:35 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KEG1dBIJ34zltMu11K86JYfAFI4MexL74bEIIpt41bL4ZBU8S%2FXxHgrW8Oi4V3FROYJNFN6gak1kU%2BEEI%2FoZoYjmOCS5PvTl%2F2f9muJXKewikXBg15ZFJf9aQdvqdUw%3D\"}]}\r\ncf-ray: a4b7c8614f0cc272-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":942785,"size_decoded":943439,"mime_type":"image/gif","magic":"GIF image data, version 89a, 800 x 400","md5":"aaaac3055501cc030a49c3895a04be06","sha1":"3b2e8014482f8e7c57657eff439fb227a8da6675","sha256":"9a0b916c50ac8112b599a335724d768620d497480718f7b88a001e6030f0b055","sha512":"686cbf0fb901f8e995aaf6d5a5802c5e2921066ccb5dfa3f0d83d97b6819ef6bec913dad187830f485a4f5a076008e55b084e7dbf1c1123617e31d30eb4adeb1","ssdeep":"24576:JZQvoJeEV914/nOxk9n2bZxulbzHlBNmbD:JJVV9oO4MgzHlmD","tlshash":"c41533cbd25b2c41b23b7f3b10d9a9b2e94e14ab67342da7633c697194963550e0c6c8","first_seen":"2026-10-16T14:35:05.854695Z","last_seen":"2026-10-16T14:35:05.854695Z","times_seen":1,"resource_available":false,"data":null}},"time_used":757,"timings":{"blocked":-1,"dns":102,"connect":0,"send":0,"wait":275,"receive":326,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/css/animate.css","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.001Z","timestamp":1792161241001,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/css/animate.css HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wOqDWVJfGgqIB13V%2FhQ3DfJs%2FyTWbFaSpZ%2Bz7RtZzORb4n9AIN33filMUdugUWx9I8N8Cg%2F%2FYoImLu6JKVj8kgs%2Fl7QYOV9hEOO4s9U5Uji1TLyawPD1D4gFWPgt%2BpyzaxK2ReA%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1bc07e3ad9b5\"\r\npriority: u=2,i=?0\r\ncf-ray: a4b7c82c3f3e723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":81372,"size_decoded":6590,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"72654d27997cc6099f68ae780e16d4b9","sha1":"5283c12c8558a9453417de49de3d9a8522e79079","sha256":"d7051faafa76e4d173cf2722cb402dae1f2ca6e13dcf11ddf5355b9c0a9c5d41","sha512":"2edeeabd81b32badc1cb89aba73cec3a0b4660dfd8f397167ea416f73e68f85c568f230051e789889b8f8514d53f29ad9879508fd6be1c27f405a4bf26d94999","ssdeep":"384:uQ1Q14x4121e2W2/NlNCHSH0lLC37nqMOjTrm/X532KoNi4oL4TO:n1Q1j121MHSHD32KoNi4oL4TO","tlshash":"56831d6e184111c447b24b69d3de8e6ceb3d917318121eee72c2588f8fa6f6853cd94b","first_seen":"2023-04-06T23:26:44Z","last_seen":"2026-10-16T14:35:05.856054Z","times_seen":354,"resource_available":true,"data":null}},"time_used":1042,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":370,"receive":672,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20250922/1758548348996843.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.277Z","timestamp":1792161241277,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20250922/1758548348996843.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WzlG17WiRMwNG%2BQlcl35eJrfnJfO7e4vZFB7AFAgHvAOm5JCPxDqIFCUHHkVjo3%2BH3hI3p%2BLGmD5lermzCQTSreK7TFnQ%2FKEarWfsla4adu0VgiTAqJ7UMX7v2o9r67Wgza9cjc%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc07f2517b2\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82df820723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29567,"size_decoded":30194,"mime_type":"image/png","magic":"PNG image data, 1031 x 310, 8-bit/color RGBA, non-interlaced","md5":"0e56f2a1bdd2a25b79a5f7eb00baec4a","sha1":"9b8fb40f599ec96b671c7a1a3e6ac549c7c12ac5","sha256":"921eaad85450814693555b64f76c3a155e59d39f2c85669b868ba27af1952536","sha512":"c98f9ffe02804493602b52d4ff17c938ae73e399f7a8ae3996ba1a44c626eda7f7274c0619979a3a680341fbc61b56a8b7e6a754e947d4bf54bd3e4a21b22441","ssdeep":"768:zPqGREleu/y8+EjdbVOuZer2WtywrtS6aC:zPqGiNy6uH/TT1","tlshash":"b7d2e1ef75d2ba94d8a96139ead603a163ff7c7a3567c60300a46427bdc0c8792c2a45","first_seen":"2026-05-02T03:19:57.492598Z","last_seen":"2026-10-16T14:35:05.856656Z","times_seen":2,"resource_available":false,"data":null}},"time_used":895,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":369,"receive":526,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20240926/1727320714278255.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.284Z","timestamp":1792161241284,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20240926/1727320714278255.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a90jPSEAreNWQMob7ka%2FJHSSZL5TWHGGWcI80SdmiRK9D9BE%2F52aIBiFuPevEfRqw%2F8AeVKgQfMbcmI%2Fleflj8AhqP2nB0t89HaFr6wKvKzsMXqtLBA4fOZKVnX3fvECYH6mk%2FA%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc0847a60e7\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82e0826723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3071963,"size_decoded":3072592,"mime_type":"image/png","magic":"PNG image data, 1920 x 1080, 8-bit/color RGB, non-interlaced","md5":"8717d5b39038b41e7e0f2b59126be421","sha1":"209a02d1f5a4e05fecb34892225b94c4d8496ceb","sha256":"29be117a426bac9efd027f8fcfcb4b31862d9b6163543784e3a7d42609416af2","sha512":"6e586f9c973903eef61a46b4a6a9c6186f20775f2647cace26013b975c00fc1d6e11b0cf4d7731025962131101e60eee4d4ea0c616a40613d9a241df27ea3519","ssdeep":"24576:57/fCKczF0Louu33Q35BK+pDQ7leILdL9GIMQRQhhgarA:1/fC1zF0weKZMQRQbgarA","tlshash":"4b25338564dce9779f72fc2c5083b11025a924b66772865507f7dca0f3af2eb6720ba0","first_seen":"2026-10-16T14:35:05.857946Z","last_seen":"2026-10-16T14:35:05.857946Z","times_seen":1,"resource_available":false,"data":null}},"time_used":7684,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":382,"receive":7302,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20230424/1682336948872097.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.461Z","timestamp":1792161241461,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20230424/1682336948872097.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fdv3bnN5ZAkaEaGx%2B5kWiUS1nzoQSZ8cDa3ndK%2FqZCgnAroxV2prdSFtC2sbGz%2BLIWlcmodOgfQTQnZa64IoqHz6oIjcmiU0GUb%2BIKfRwwLuNkMZYigB1J3DUe%2Bp7yjObIa0zTQ%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc0886d2f6d\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82f18d3723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":365186,"size_decoded":365815,"mime_type":"image/png","magic":"PNG image data, 511 x 316, 8-bit/color RGBA, non-interlaced","md5":"8b9143eaba3848f31906fdb000cb9777","sha1":"7d22d8ffcf2165c4735b13c1c54e10edf669c8f7","sha256":"ae93918dea0e4d8b22d06ec688981c72026b075c72f9a8d9fc5bf21d6aa2239f","sha512":"36d47f47d089067d39f09fce894cd72a96f245d4c9d93ac8a0036ffbe430f87507f313d2900b5b238c7031bbc93f4a5bd1826db29c805c2d667eb1a1b56f7067","ssdeep":"6144:Q85V9k/pZI5cu3IYzwyWWc8TNzIlZBcMrHPy2mCQlZNt6qL5Us/MHOv2Euvitoq:xVe/pZOVwaTNUfBcM7PoXjDagMHw2ENN","tlshash":"d974237bed8bc4a750947667de82c4d708c47ad423325c3decf64c46623b9b2ae83919","first_seen":"2026-10-16T14:35:05.859318Z","last_seen":"2026-10-16T14:35:05.859318Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1871,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":354,"receive":1517,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20250718/1752830910200276.jpg","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.466Z","timestamp":1792161241466,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20250718/1752830910200276.jpg HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6qkmTDkszqXpDVMCrwvuevqwn%2B2OB1%2FV9trDol%2B%2Bt3jgWR0cE9R0mPRCXyo3wHfNM58D4PxF7j8U4%2FngWW9nIY8ZZbKBY%2F4hAtzSOvpEngKevLaw6Bz0B3VkubMeIgLacjJJOoo%3D\"}]}\r\ncontent-type: image/jpeg\r\netag: \"8df1bc087cb0c7c\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82f28d8723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":250724,"size_decoded":251356,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90\", baseline, precision 8, 1000x752, components 3","md5":"034efb226b65a7de13f5f50a2fcad4f4","sha1":"d8b50fd59377571d5f509966159fe39baa5771b8","sha256":"18673f43336a1d0e9352c2bd17ceffb918c1aaac52027e48a3ed516d3fd325b3","sha512":"0a51dd09c193efb2471ac2c38dbcadc198da184b99b21a043f68b0faaa334e8672b7c34d5fcae7878e9517cbe75320bfe1adff3aa8209b876e70d715db4b28ba","ssdeep":"6144:e5v8GyZJImNjQkqYFmfVyK2u+5vWPrKB1cGpU9C:1vPj5uYFUgfOrKTbpU9C","tlshash":"773412d98253b7d4832912d5748b864122e912687a2d912c38f3be2bd53173a34bf3f7","first_seen":"2026-10-16T14:35:05.860463Z","last_seen":"2026-10-16T14:35:05.860463Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1688,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":353,"receive":1335,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/js/wow.min.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.636Z","timestamp":1792161241636,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/js/wow.min.js HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: application/x-javascript\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JDkfya1uE6MTL2%2F8jOKyogJAFiMDLadafj5zjKmRxrpSi83zZjSU9P3yaTpihxfjeKGzxWYwI5XJoRrOB%2B5yVlltI0z65ljTj8YLc7%2FwJK40IRw21qbePnQ%2F%2B88QHX%2BAjhIBglQ%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1bc0854a47b4\"\r\npriority: u=3,i=?0\r\ncf-ray: a4b7c8303998723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8183,"size_decoded":3609,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with very long lines (8152), with CRLF line terminators","md5":"ed4b12ef0f7e4bf5d5ff3555d18718cb","sha1":"258fa26dec8fcf4769d49eaca6712ef56923673e","sha256":"3162b6468674133d7b6c903e4b8a06f7faf51216d1e7f8b3edc8f326b1bfe461","sha512":"40d8f96697d393a5301d2960394cbea52ea64330a8b706a0982e9b17176bfc0d55394dd4f0fbea2cd1798c938e66ccccc671d803b2802f8b37c2c41f40c1200a","ssdeep":"96:xrZgL1xvPV6GqKyR6TYdtHFMLzA4pOROVEE1fosvGeaMozHImBaokbl:xry9PVfSnAPAjROVEEdos+eatzHILoe","tlshash":"17f175c9ba967035c75792f2833f0106b23a5aeea028047cb5b98dd57d38c58523bf78","first_seen":"2023-03-07T01:03:44Z","last_seen":"2026-10-16T14:35:05.861784Z","times_seen":2771,"resource_available":true,"data":null}},"time_used":685,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":353,"receive":332,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/images/mkbg.jpg","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:03.202Z","timestamp":1792161243202,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/images/mkbg.jpg HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/template/jintou/css/style.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Fz%2BxF85ZFWewX02AD9Kai6fvpw2nK87iXZvYWr6ulOBHQN%2F3oiT0NkK1NEjwBhgyDCKuxXQEVYcZTAf6gs%2B20GSbO%2F709FXZ%2FXYLjFyrEYQDn4tJ%2B3NTkOB19OXqES5G8yx2SvU%3D\"}]}\r\ncontent-type: image/jpeg\r\netag: \"8df1bc0873e5e72\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:03 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c839f830723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":81563,"size_decoded":82197,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1920x1080, components 3","md5":"9e329950857edf1f03a70e30a1b80e68","sha1":"1fca7ec046f3511f3fcd837cc0da584b00290f4a","sha256":"074ab4dacef3916bd27aba32f52159e5558bdb412671ef8ae79788840a0fb028","sha512":"eccf7d217e6739af51a7a6f05dc977119065552e012bd0f6d2fa65c58c910f422f252b85a4c6b63e124a752742ef6f7fcb7de3f23d68bf612b632904d8a889d2","ssdeep":"1536:pMO0Z2xPzfZXg1fzCwQrwu28XsyVB59Wx7GYyw/TokoH6j/j0wt8LmhYdgN0Z:eAPzpczSBjWEYpTkAj0wgmKdV","tlshash":"6b83e193eb26e30fc1fc037688c7cd343b6b55e2a38358679680663962f63546e4dad4","first_seen":"2026-10-16T14:35:05.862434Z","last_seen":"2026-10-16T14:35:05.862434Z","times_seen":1,"resource_available":false,"data":null}},"time_used":983,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":340,"receive":643,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/css/public.css","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:00.959Z","timestamp":1792161240959,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/css/public.css HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: text/css\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QY1a6U3Q%2FMh8jcDkI4WbzPLKlQzsgx2OLXZgaIIUlKOVKsm2H2zWv%2F4ewfAhvT4JOyt5WC%2F%2BYvwLRRqmClc8ZOHs3b3wAqUvJSqyKDaYL0Ehi7sMb8iwnPee2CHcssoPy916W40%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1bc07c24a93b\"\r\npriority: u=2,i=?0\r\ncf-ray: a4b7c82bff1f723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18604,"size_decoded":4005,"mime_type":"text/css","magic":"assembler source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"b14891e8d11c995bb3392ce741b9bcb8","sha1":"a52771888c82225289e88518fd72157032e626e9","sha256":"750c280bbab812cd237df1bd34ab833a0141afb9529ef6d3552380f2bebd8497","sha512":"8364e10533ca3081d0b64d790e8c454497bdda2bcc5555d2e730b7656aef108dd7421537f805144e8e632aae361d396b892a226e85c3e3928ee21cc67e72a233","ssdeep":"384:NIf5V8SNdiP4aovu4VE+OSJIvSIZU4Snfv0f6/E:NIf5NiP4JvVE+OSCKGEHFM","tlshash":"778215e36737324aa0ad13fbe113fadcde2e95062e0116bc8bd16d54d04c5732a527ba","first_seen":"2026-05-02T03:19:57.502142Z","last_seen":"2026-10-16T14:35:05.863754Z","times_seen":2,"resource_available":true,"data":null}},"time_used":863,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":370,"receive":493,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20240926/1727320735918387.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.286Z","timestamp":1792161241286,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20240926/1727320735918387.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZgejF4WS9cTuvq%2F%2FmbwN5DufGAarwOUf0kdng3ywmc9MOcowM3SjghQkazUU8VrWlP4fsGk7EODdV%2FmjseBNmphf71dJUKoUlkBRM8mOCEaYqFWZmpS%2BBRUFIO67GD2WEVruqO0%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc086b833e3\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82e0827723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3216124,"size_decoded":3216751,"mime_type":"image/png","magic":"PNG image data, 1920 x 1080, 8-bit/color RGB, non-interlaced","md5":"3f5058b83aa61add38643a7964612d4c","sha1":"192310dff12f61dcacb1fab516cbf07816f1056b","sha256":"044522f5c86e07bd2ea78239187bca1104325324212ba168f7fe1cae766c35e2","sha512":"425e9d7256a05474d82f5c07c479feb3084ffa4b559e934e48aa85820a54e5e3336d6864b436b15575e68fee1076f96a23f7d4917c4cf8949fc3500c1919f67f","ssdeep":"24576:Ex6FGkR+bMsPqzqUOhbPIHHUyU7S37cDFsG4OyG5:c6vR8XC+bqUymSYJH9","tlshash":"59253364e5f844f5d0db844ca4440f6f4dcd71b1e9b6c8e5b2a09ad03faa8b090f9b5b","first_seen":"2026-10-16T14:35:05.865218Z","last_seen":"2026-10-16T14:35:05.865218Z","times_seen":1,"resource_available":false,"data":null}},"time_used":8422,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":394,"receive":8028,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/analytics.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.641Z","timestamp":1792161241641,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /analytics.js HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: application/x-javascript\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BY%2F8IXvZmtuzAv7bgasu0wYgZvDpYUjxRh6oxLF4%2FO3G%2Fx0%2BJ1NaHEB4lk3OYjLvjFYWx%2B3PH2E%2FzL7WGKWAxRYhm8lEO6EUi1NM%2FUEAtvIHAOglz15J5D9dsAxcf7OtoPjjaO0%3D\"}]}\r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 14:34:02 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1b73d8162f88\"\r\npriority: u=3,i=?0\r\ncf-ray: a4b7c830399d723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":241,"size_decoded":854,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"53d5cd567d6faf2bc9f7b24515fd09ca","sha1":"53f2f62b3d86d2c2061122ddd0ef77c489305d34","sha256":"72eef8b83c2d65c8b3732dc0d31b0ec76d02ccc3c2ec50b4093bdd2cc5bc866f","sha512":"57676254c4b13e2c5087ac4f16c86e887e2325dba3870e65e6372f80c0ba337c8b97571d5d11f54dba4d843b62ea1848a71036da878a8229efdfebb6e06f188b","ssdeep":"","tlshash":"4cd0a75f24052d784f8d12b6607ae69cf561211c61aac452888ddc5a4c30fea646568c","first_seen":"2026-10-16T14:35:05.866603Z","last_seen":"2026-10-16T14:35:05.866603Z","times_seen":1,"resource_available":true,"data":null}},"time_used":383,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":383,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20260129/1769661817124655.jpg","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.289Z","timestamp":1792161241289,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20260129/1769661817124655.jpg HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eeuZXSEf0JxzoWbDZWjcqJSd%2BEPdWhf9yM%2FSwBEtNVvKVGZ3xvUTqCLnNmG8%2BSLo%2FqlqycD4T%2BBITF3k%2BquhcvgIhATw4LpFvLMWBwZJDB%2FJq56yB12TXF22JswG0h3M7FAB8EA%3D\"}]}\r\ncontent-type: image/jpeg\r\netag: \"8df1bc087d49611\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82e082a723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":137725,"size_decoded":138359,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90\", baseline, precision 8, 1920x538, components 3","md5":"151cf6c804bd0dd9578ecaf76658af6c","sha1":"0e5ce4141a93766ee3dc47928d095e2b97aedd62","sha256":"2f2ae9e66441fb33556bd7495e1d96b9507aab8145a25d0409aee3bb62490690","sha512":"1e1d7ec121fc207058a097a5cb12dc2948d0cff3524adb7850c503d92f071a626929b6b1e19a5dd76a143a458468fa4e738548326d08b2b169e2115eeb9c2583","ssdeep":"3072:zUoKTBL4/5ectouMls7uqHD3kpMlOe6ES0vMVF7R0snHb:zPK4eRmaqHw6lrdR23Hb","tlshash":"f6d301034805a792b07c57f4f89f2d6445abb70fa7e67ade08660cd63fa81b01d9d12d","first_seen":"2026-10-16T14:35:05.867718Z","last_seen":"2026-10-16T14:35:05.867718Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1181,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":346,"receive":835,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20231102/1698923951101322.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.456Z","timestamp":1792161241456,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20231102/1698923951101322.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Dy0ZjPcpDqaVVhCPMR%2FpRE5LzKEa0hIn81ehuMU%2B1TA%2BKDXbE%2F0QhnnqEiO1poguKZJf84pg8swt8AKuwdJgc0PRckYAYwzWvOz%2Fvtygoh8j%2F3UG%2FQI2OjCpbeL6TybLOnFI24U%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc0896068c5\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82f18d0723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1107976,"size_decoded":1108609,"mime_type":"image/png","magic":"PNG image data, 848 x 918, 8-bit/color RGB, non-interlaced","md5":"f31c5136dc0203e9a4dcfadd8fdbb662","sha1":"727f535d9893db85145c87766f895c62b8a5c32c","sha256":"f3da103c0d713c6e2a0711bacff4a4d0103114eccb1c666c273cc8399069cc43","sha512":"3c2e5102a52b1a417fe6fc7ad9aa6576df6865444bf12198b5992c7a3895333ff4637e923b5adb2606799db21b0c70511d1e9edcb8af1852765d0d26ce78fc38","ssdeep":"24576:LfdcMvfoGE5aRh8mxxMM3C1LeSU71mZ2YM51lf7:L5vAER+GMM3CZfUVYcnf7","tlshash":"6825338008d75c7ac71788cc64cdd16651af2058b595ecfa1fb6dfeb835b4a203a83b8","first_seen":"2026-05-02T03:19:57.464227Z","last_seen":"2026-10-16T14:35:05.869074Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3332,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":348,"receive":2984,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/images/mkbg2.jpg","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:03.208Z","timestamp":1792161243208,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/images/mkbg2.jpg HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/template/jintou/css/style.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GNZHmqiw%2FhAXszbkGr8lrbESX3AZFvjGUYv0FuNshUSSs2nN5lOrJwJxln%2FP5JRdBLZ%2B7zEwBoMSSoYHjmQ0uz6ANwa%2FEAiQY3rTVgYDddWMTDrx7Vot9dkEgHTwXBUT9xmmgB8%3D\"}]}\r\ncontent-type: image/jpeg\r\netag: \"8df1bc08847085e\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:03 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c83a0837723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":312412,"size_decoded":313040,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1920x1080, components 3","md5":"d214f754acc958f5c28f2a70a9afc3f6","sha1":"13dfc9f30fcf773113cf75d04441fbc111cf90f2","sha256":"f7e48d91bd5b3bb56c609a4b1f9fd0ddc8ef6f008581c9957f55cec0003de31e","sha512":"b902c4efdc5fcff389a005420bc18d5fc4512fd2d09c68584a1e5e2e3f56c09913ab7957a26163b9cfd0fb82160c3dfa16f926670538eac41c7d0ed165af202d","ssdeep":"6144:RzoQdxj3W2pEeo4in3Ng6xRy0mbMtQQd1BOUKS15eGrZxxg9YMR5y:RzLWXeo4in3NDQbMttdiUKe8FR5y","tlshash":"cc64230b46fb3ba5293b203d5f497426a3774210d8c7d46b4bddb788e35852683da9cc","first_seen":"2026-10-16T14:35:05.870406Z","last_seen":"2026-10-16T14:35:05.870406Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1953,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":367,"receive":1586,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"8pe7xml5.63775.wang/yf6usqyu.php","fqdn":"8pe7xml5.63775.wang","domain":"63775.wang","tld":"wang"},"ip":{"addr":"59.152.51.132","port":443,"asn":26658,"as":"HENGTONG-IDC-LLC","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:06.395Z","timestamp":1792161246395,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"8pe7xml5.63775.wang","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 10:14:56 GMT","end":"Thu, 19 Nov 2026 10:14:55 GMT"},"fingerprint":{"sha1":"C9:EB:48:20:5E:0D:7F:08:F8:B1:33:88:87:C4:B7:E1:F4:27:CF:AE","sha256":"18:ED:01:94:FF:CA:0D:41:19:08:65:A4:8D:12:98:06:72:B7:61:29:13:AC:A7:02:BB:43:1F:29:58:A9:30:AE"}}},"request":{"raw":"GET /yf6usqyu.php HTTP/1.1\r\nHost: 8pe7xml5.63775.wang\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 16 Oct 2026 14:34:08 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":605,"size_decoded":774,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"b35455d0af2718173c5dc8d942dfaca1","sha1":"d6c564accfb4f2202f4f0f902b223e5f1441539b","sha256":"aa78668c17bde1b1dea7fc1f83386a8b21a2f8ca3922073990d7aa0770ee2185","sha512":"ee8c35870c5035f42754ed1ed0ef08712509c10d694dcc3056f73496e2c32404712134c78437548746133d529516360af41222e61e2de2d0342055570545882b","ssdeep":"","tlshash":"e3f0ddf79043d03ce3010050a4b3968c657a4855765b887299dd367b6449da8dca2f98","first_seen":"2026-10-16T14:35:05.871531Z","last_seen":"2026-10-16T14:35:05.871531Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1910,"timings":{"blocked":0,"dns":1043,"connect":216,"send":0,"wait":217,"receive":0,"ssl":433},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"8pe7xml5.63775.wang","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.mmtd.top/left-logo.webp","fqdn":"img.mmtd.top","domain":"mmtd.top","tld":"top"},"ip":{"addr":"104.21.29.180","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ndkszc.com/","date":"2026-10-16T14:34:09.379Z","timestamp":1792161249379,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"399ee6eb.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 29 Aug 2026 23:51:54 GMT","end":"Sat, 28 Nov 2026 00:51:50 GMT"},"fingerprint":{"sha1":"18:F2:21:F7:61:95:C8:F7:9D:64:CD:DC:93:E6:EC:3F:A5:AB:9D:6B","sha256":"B7:D6:82:9B:2A:6D:E1:B6:CD:D9:F9:C3:1A:64:4C:2A:82:9E:F5:EC:F2:DA:54:1B:97:70:21:C7:BD:15:10:71"}}},"request":{"raw":"GET /left-logo.webp HTTP/1.1\r\nHost: img.mmtd.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ndkszc.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 16 Oct 2026 14:34:09 GMT\r\ncontent-type: image/webp\r\ncontent-length: 99518\r\naccept-ranges: bytes\r\netag: \"8bea9ce44b1ed2d14fa831b9b442fc1b\"\r\nlast-modified: Thu, 20 Aug 2026 18:27:23 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1gtf5hloun12D68ZvdOyUvfKWvgJez60jy%2BlmDlyiAEdh7q0GKEge024oYnpJHqAVmBragv3xM8YYGt08W3638gSn9SSgnUZLYMjB5Y0X6vMGxs0VLGh34avCLDFMlI%3D\"}]}\r\ncf-ray: a4b7c8611e85c272-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":99518,"size_decoded":100166,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8bea9ce44b1ed2d14fa831b9b442fc1b","sha1":"12e91f60cb3d35225d1e6a6e1a9c1ca62294ce73","sha256":"ae2cc3507ca1e88e5513bd58240ad45e36763c06f4fcb2b9ca097d7c9ed0df01","sha512":"bd45362f47986cbcabffb35d5df9e61f5bafdcbae52257ca9b22609607ac3ec5ac4649120df51c5378374f18e53f1ff4acac3596d74498359b15b58a70664b33","ssdeep":"1536:QDmT0Rs5u/zqlsHWJ3mQiZUWhDG7C1m3m5dgRa43tLu8UmCo78/Q7bGarOG4MC9V:Q7w5iHWJ2QmUSqosw43tLulbQJ3qtNYE","tlshash":"6fa3120bdda755f5d301e33536037b63ab42c30edaf63256a168e56d80c0ef94d261a7","first_seen":"2026-10-16T14:35:05.872716Z","last_seen":"2026-10-16T14:35:05.872716Z","times_seen":1,"resource_available":false,"data":null}},"time_used":383,"timings":{"blocked":-1,"dns":66,"connect":12,"send":0,"wait":269,"receive":24,"ssl":12},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.mmtd.top/lisboa4.gif","fqdn":"img.mmtd.top","domain":"mmtd.top","tld":"top"},"ip":{"addr":"104.21.29.180","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ndkszc.com/","date":"2026-10-16T14:34:09.399Z","timestamp":1792161249399,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"399ee6eb.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 29 Aug 2026 23:51:54 GMT","end":"Sat, 28 Nov 2026 00:51:50 GMT"},"fingerprint":{"sha1":"18:F2:21:F7:61:95:C8:F7:9D:64:CD:DC:93:E6:EC:3F:A5:AB:9D:6B","sha256":"B7:D6:82:9B:2A:6D:E1:B6:CD:D9:F9:C3:1A:64:4C:2A:82:9E:F5:EC:F2:DA:54:1B:97:70:21:C7:BD:15:10:71"}}},"request":{"raw":"GET /lisboa4.gif HTTP/1.1\r\nHost: img.mmtd.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ndkszc.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 16 Oct 2026 14:34:09 GMT\r\ncontent-type: image/gif\r\ncontent-length: 241082\r\naccept-ranges: bytes\r\netag: \"ed5d1721cc2f73dd813829b98e41007e\"\r\nlast-modified: Thu, 20 Aug 2026 18:37:06 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d%2FrtfRxZTpVkC2k0c70Kb%2FDsdGnLAmM3GGs2844YR9ZCDSEQ9mZHtX%2BBWs7QHX7swxdIZ7Cm%2BSIBNJvyJMojE8e%2B4FrSaUXkVR9TXeHjBDm19VN2fV21g%2BRW0Hu%2F%2BFw%3D\"}]}\r\ncf-ray: a4b7c8614f19c272-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":241082,"size_decoded":241744,"mime_type":"image/gif","magic":"GIF image data, version 89a, 800 x 400","md5":"ed5d1721cc2f73dd813829b98e41007e","sha1":"a37d315477a2f084d988f0a29d40d5183742f104","sha256":"3cf3b5aa989e34ee21de55753ff2471a35e4e9694dca7ae66f01330e033c6776","sha512":"a1eaaca62bac3ddf705d9bb280ad01721768aaa3d2dfe8f925f7c71f8fbee8c733d3d6a9275386de34ed67c4cd5434697447af3242323425683cd774d11994dc","ssdeep":"6144:p6IcS+7ZGqZ2Nmp0B5txobAXzhTR3z6g2mqI7iP:sfn7ZGq23B3xobAdRD+7zP","tlshash":"8d34233709ebb47e7b93abadd1da9651624dedb6a5894180d21333197ed0230fcca730","first_seen":"2026-10-16T14:35:05.873761Z","last_seen":"2026-10-16T14:35:05.873761Z","times_seen":1,"resource_available":false,"data":null}},"time_used":381,"timings":{"blocked":84,"dns":0,"connect":0,"send":0,"wait":280,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"redotpaycn.com/","fqdn":"redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-16T14:33:59.934Z","timestamp":1792161239934,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LjharR%2F46DdjZmBBM2CUs1JpdNUMKacz771DzEDbM01JiFTbaihIK1iF7m4p3%2FrcTl3LZldqG2n6p4v83rqnARj6JTjyYfr71D0kV20k6VrIR6dFMFvEYAaHlg6DjnbWDw%3D%3D\"}]}\r\nlocation: http://www.redotpaycn.com/\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:00 GMT\r\ncf-cache-status: DYNAMIC\r\npriority: u=0,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c825dbf8723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-16T18:26:25.445628Z","times_seen":19150143,"resource_available":true,"data":null}},"time_used":380,"timings":{"blocked":-1,"dns":18,"connect":21,"send":0,"wait":341,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-16T14:34:00.325Z","timestamp":1792161240325,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jZo9RUlSd%2B%2Fhp85ifUBeItoXRbESLaVcReE2YiEBjqRhV4MtJuMPb6r2dLzyUXwpHH0%2Bi%2BcGO%2BOCnmToxK4tgsZgrQuZLAbnZFbq1ZmePbvAW2KX7AkkWxyo6Zh8xsDgHRMwjBc%3D\"}]}\r\ncontent-type: text/html; charset=utf-8\r\npriority: u=0,i\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:00 GMT\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: a4b7c8281d33723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Popper","description":"Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.","website":"https://popper.js.org","common_platform_enumeration":"","icon":"Popper.svg","categories":["Miscellaneous"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"WOW","description":"Reveal CSS animation as you scroll down a page.","website":"https://www.delac.io/WOW","common_platform_enumeration":"","icon":"","categories":["JavaScript frameworks","Web frameworks","JavaScript graphics"]},{"name":"Swiper","description":"Swiper is a JavaScript library that creates modern touch sliders with hardware-accelerated transitions.","website":"https://swiperjs.com","common_platform_enumeration":"","icon":"Swiper.svg","categories":["JavaScript libraries"]}],"data":{"size":146557,"size_decoded":37662,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (39866), with CRLF, LF line terminators","md5":"2b18d2fed53ecb1a63dd7204a223d61a","sha1":"8706c2cb77c98a04b618530157221f550bc4d35b","sha256":"13c1c7332eb1e978da2715ffd23c7b03b3c1ee3c937efc22280cb037d13df449","sha512":"39f607e1db6eb8936875c59804f5183d29db534615449acb82d769a672263e393cf914fe7eb36357be1b9e74b915b3bf53de3ae4a1ccc462b7f6df412f4bc6a1","ssdeep":"1536:zmOz66sMlUBXOf7oLQp6AAIHCrSM75SuEVH1:zrz66NU8f771","tlshash":"13e3532026d014ff00b3dae4a9a03f5af9d0a607e627551871fd23d68fb7f50c9a7a94","first_seen":"2026-10-16T14:35:05.874902Z","last_seen":"2026-10-16T14:35:05.874902Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1472,"timings":{"blocked":0,"dns":9,"connect":1,"send":0,"wait":405,"receive":1058,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20251028/1761641685407965.jpg","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.280Z","timestamp":1792161241280,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20251028/1761641685407965.jpg HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6N2PDwWXe0v1u9Rhy36vYt3D1dMgVANwwaU4RiFmI8PvCdMVKGq81KlFvav69zZ47y%2FhCbYJQyF91xbyx9h0xI4sTrdPl4cakpy40liyQvDqBiVbqM6wdOyc%2BmaBvoHXHHLTO08%3D\"}]}\r\ncontent-type: image/jpeg\r\netag: \"8df1bc0804a5f08\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82df823723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":669175,"size_decoded":669799,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], baseline, precision 8, 1920x1080, components 3","md5":"062141f3fcab4e61ca0347c975a4e658","sha1":"c71fc7bcf02646cf33e241b93ac9bc93af47cfb2","sha256":"a9e22a14489ee36e05647aceb7d3af614f3166edbf5457ba877117d7973f534f","sha512":"48c1da3adaf60de1190f38d4c6a070fddd27981a6d4806097f3bbef1165c72b21db9f5d94c4d95f1e12284337040992e354ad325709340b95430acc91453964d","ssdeep":"12288:CCBEG9istsLkTI+30z5dP5CNDHK5paYgRdza9Jo88P2UNfJ:FV3zTIE0Na9MpaYsNR88tR","tlshash":"38e469a29c717b42ed26091967912bae100c2e2f16e4534cb86ede8f3787cdf719f845","first_seen":"2026-10-16T14:35:05.876264Z","last_seen":"2026-10-16T14:35:05.876264Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2659,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":393,"receive":2266,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20260129/1769661764359732.jpg","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.287Z","timestamp":1792161241287,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20260129/1769661764359732.jpg HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O38e9GiHpru1BfAjw%2F%2FWp1C%2FnElGpXpGPsT2dTwUJSSPK4gRORLsYi1p7HME0WVVW64ezI7rcmdgZpUjwMW3DdhaJ%2BXACIBSFT9H2Kp4%2BS9IFadPtzFsTDHLix7miGG%2Bb039U2Q%3D\"}]}\r\ncontent-type: image/jpeg\r\netag: \"8df1bc086bcf8cd\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82e0828723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":100630,"size_decoded":101262,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90\", baseline, precision 8, 1920x538, components 3","md5":"fe1d78cecfa9a99c824b0bee86f92d0d","sha1":"4b79ed9ed415136965df3601f60314157628032f","sha256":"a8cff37c2d9209d7f56a84178e56e98a4fc9e1352a2701f1299bd4e5bba51c6f","sha512":"5ff422d86f7973c176338a6a42d952a79d2d8fe05be1abe637fe1d7ae4d23216778c600adda27deb05d3b2afcdabe0f28d8d6649b05dcbdc95f6ee8631047e82","ssdeep":"3072:lRp5b8evZnb8FVkSnCMid5NX4BgY3XOFvO:lRrb8etb8FaMidzg+dO","tlshash":"47a3025b784642c2be1e17e9de430e594f1ab60572273f8573e34e9fb78432a4c290ad","first_seen":"2026-10-16T14:35:05.877493Z","last_seen":"2026-10-16T14:35:05.877493Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1414,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":385,"receive":1029,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/images/more.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.291Z","timestamp":1792161241291,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/images/more.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lkK%2BTJt4XcsQjOCHHm9dMQDWVtcoNpoI%2BzE8WYaWfak8RYFZHPIDkxDqnxvYryS6C4pp5yl%2F3JKLVp9Y6%2FvzRauYJeAGklASXPkr4fkgAO5lnOknxLPXV4c2zd2CBy%2FlGTMCb1I%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc08699358e\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82e082c723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":263,"size_decoded":892,"mime_type":"image/png","magic":"PNG image data, 59 x 60, 8-bit/color RGBA, non-interlaced","md5":"70fcdaa61f3b2282563a93ef823a1a4b","sha1":"d064fd0af5b0c6e1fddfff4e5673bbc5342197bc","sha256":"615b2a6414c63d3c25c044c2ee7a211b38cb68837f4d55e9b6f7f1456b82c833","sha512":"33bf594bdb2085d787d1819f36e8256fdf505846a45d6bae665ee42467bf380233735f9b389ec8616f5ce9926ef5c2e3aa6e3e780b9dd37399a91bee4afaacba","ssdeep":"","tlshash":"3ed02b51caa6381c4dd403e70276410d4c60261f6a2c1010608fa56b03010c437632cb","first_seen":"2026-10-16T14:35:05.878738Z","last_seen":"2026-10-16T14:35:05.878738Z","times_seen":1,"resource_available":false,"data":null}},"time_used":341,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":341,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20230613/1686652918192691.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.463Z","timestamp":1792161241463,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20230613/1686652918192691.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AD06JDPM1UkEgRv96ZKmdAFg6ekH58bmgg41O4I618QQ9hckxjgxJFIj4W1vc6wde3aMAFZsD4ok28aIDEq5KkYJwfWOAUyWy7X0CRre08NwD94iVXkfXtroydWFkXM7dqNbk6c%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc087cfd149\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82f18d4723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":230902,"size_decoded":231521,"mime_type":"image/png","magic":"PNG image data, 480 x 301, 8-bit/color RGBA, non-interlaced","md5":"17bacedbd5813eea25ed22b1cc0ec559","sha1":"3a2c123806f8486818e88d507ea83ba232e54f63","sha256":"3f324b3b0773efbdd79a3f04f4dd1a9bcb8d7e6c29aa77dbeaf1f4d156d22704","sha512":"b0697c8e0ffb6712f65686e62150af042eb01af48a3d2d3691b60fd578e6447209ed5ca8b80c0d331207c867e1066108d59b2626d10de182f9bca5340a2703c0","ssdeep":"6144:rJPC2sWOYCZeL/29VUT12un3tdEdRsA600fGIsp:VPnyVUTgun3ismvII","tlshash":"1c34237391887220c128a9e1fc057bafc07671a2777db5b44a21e1d2a4e7bcdad53cc6","first_seen":"2026-10-16T14:35:05.879812Z","last_seen":"2026-10-16T14:35:05.879812Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1460,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":342,"receive":1118,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/js/jquery.fullPage.min.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:02.479Z","timestamp":1792161242479,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/js/jquery.fullPage.min.js HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: application/x-javascript\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=siw%2FHI6evmOTbeyFpMOhSpUWN1xDS8ZfXFFTMHgX1OObspsatp%2BPely1WqutkTZsNtdq4D5BNaw%2FJaq5UtCNmeu5M2Md%2B4Jh0IKE05i4ONBRgz4%2FbJxMKYjoCpnz1ztuKdgoJAo%3D\"}]}\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:02 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1bc0800ec270\"\r\npriority: u=3,i=?0\r\ncf-ray: a4b7c8357d86723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13766,"size_decoded":5305,"mime_type":"application/x-javascript","magic":"JavaScript source, ASCII text, with very long lines (580), with CRLF line terminators","md5":"c478adc5a33db2374da4884b3bd47e18","sha1":"8c48ef380e2b04e59fa0209c615a64bd1ec41e63","sha256":"ac8afe4054815d0d987aa214e3837936c38a4bd73cff9b56770f5e8bd1ea23ba","sha512":"aff9e19b4dd2cc5e2dd1d862d3c8b15d59d7f0be70fe40a23b9313e4bdd1ca48adbaf157e65a27112fdc50aee64d706fdc5e74085b39dd109be7253cb1c0dd15","ssdeep":"384:ApslHGlSZrQFnQeBzTwRO7lfCeXY756alH+lSB/QobfnXCAe1:dIorfe5cRafCe26aoICAe1","tlshash":"21527585f92172f680ff22eb611f81416136ac73895254d1f46da4bc2e79ed803a3f9b","first_seen":"2024-09-28T08:42:23.375956Z","last_seen":"2026-10-16T14:35:05.88105Z","times_seen":11,"resource_available":true,"data":null}},"time_used":667,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":334,"receive":333,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20240926/1727320687442131.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.283Z","timestamp":1792161241283,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20240926/1727320687442131.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5ufnysaZEfKzUZDcsX0vq3qV9FoOzlqiMKFZJHBXfQmKwcnXT6cloxlFWVpWO4RgsYwvRIKDXwC4NMmX6%2Bura9Y5%2FBcNh1%2FSbty7ximcTfAkFln0mPovvSdHs%2FVBMxA9YxS6SeU%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc082332cfc\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82df825723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2167131,"size_decoded":2167758,"mime_type":"image/png","magic":"PNG image data, 1920 x 1080, 8-bit/color RGB, non-interlaced","md5":"123d5940c50b334d26db2f7b1a0e1b83","sha1":"0a466aafb3b19f771dfda64b00c302d501be6129","sha256":"d4354cae875a6ad08e97c69b92fd0531ee3183d16997b4553bde7375e9a71aa8","sha512":"6fd2b9cc2b4faae29ba60a7a001e6c2aa36316b704a67a147b9bfe36ad44079c3f0a6ec647a1618bacc6d99886491cb986a95bde5badf3c26d3f2d13a382dc0e","ssdeep":"24576:KAlj/LET3vkSBmYX/bhAc4rQpcp/QjRsJ15+cgNMt:K6L4J/bKSpctwsDg+","tlshash":"56253385d2fdd8a66eb230123395fe8c2a9690e4144976ce39c5edc8662f3b06607773","first_seen":"2026-10-16T14:35:05.882924Z","last_seen":"2026-10-16T14:35:05.882924Z","times_seen":1,"resource_available":false,"data":null}},"time_used":5503,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":389,"receive":5114,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20230613/1686652963737082.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.464Z","timestamp":1792161241464,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20230613/1686652963737082.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F3FqOUBOhB7qmfZXB0u7129P3Bx6M%2FFjt%2FtR%2F6nNPJSZKsG8orSNGKo8eUmuxn6obPmggJRRXGK3rzhfGEMlFHIYdx18O1pRN1rOcWS7CLWIbjOKAsN7VZgOur84UdPDjKOs9tE%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc08890f35d\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82f28d5723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":303716,"size_decoded":304343,"mime_type":"image/png","magic":"PNG image data, 480 x 301, 8-bit/color RGBA, non-interlaced","md5":"f482cd68f39b9c2e91084cde1bd11246","sha1":"8ad49b5a7f6c216391818f861a74d7067402549e","sha256":"39f1e2a15a226fdedcb001af70ac748580b9fe4ea147fbc4eb8b4044c57fb7a9","sha512":"970316d162e704d09c26aef38aff0b9e1ba194cf782edd873dfc8e56b327befdf9aa0f7925e833cad8a0dcaef47a026d7a5eba44259ed68243cce71b14352bd3","ssdeep":"6144:mn86ra2WFTDOAlRSjzal6s/1TFrivOqmX3Gyq+5RL2dXXG5LdkPmQF9U:mn+T1L84TFrivAGyqK+X2XFEU","tlshash":"f65423e6df6fee31166ec6aa3bf556d6e471b8f63271c0724982c61887e04c1f1c4a09","first_seen":"2026-10-16T14:35:05.884202Z","last_seen":"2026-10-16T14:35:05.884202Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2028,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":387,"receive":1641,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/images/icon2.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.628Z","timestamp":1792161241628,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/images/icon2.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=quKmVOt%2BWvo69GxHJ8heXMLfSOkbMRJazUQQJl8KMEk9ToUeSeutRmXmUMNJ4gOSEZDQTcEu3VaYHWR9Xr7VKnytDbg0ZV85964Hx8My74XqYkmnT6b9DmeQgEddJ0CaPBRp980%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc086c6831c\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c830298d723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7161,"size_decoded":7782,"mime_type":"image/png","magic":"PNG image data, 191 x 192, 8-bit/color RGBA, non-interlaced","md5":"846e43452d94ad1ed6b03129ac0069fc","sha1":"c0bbbe1c31f29a18ed06c12bd4e477a486d743d9","sha256":"f39526a4c477642436c6378837b90f718f11f6b6686bee462fea5beb8a64e3c5","sha512":"51349ab43c2b933a24546e7e253dfbadd94df48a9ff04e254f9d3e0fcc88d41b482d4960ac28335799bb2e768fe11159bce5d39b03a9b2e1dc0da670ecb36e76","ssdeep":"192:16knk4sv1FXz1TgEArEgShdx5y4NNpZvM2:1Jnk4sX5TAzw7NNp5L","tlshash":"52e18d62ed509b42a64ded0a51c6d146bb3a6af04f42e560bfcec81352821bd4c0f7af","first_seen":"2026-10-16T14:35:05.885636Z","last_seen":"2026-10-16T14:35:05.885636Z","times_seen":1,"resource_available":false,"data":null}},"time_used":697,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":357,"receive":340,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/static/upload/image/20240529/1716946323581477.jpg","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.639Z","timestamp":1792161241639,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /static/upload/image/20240529/1716946323581477.jpg HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wlxXF%2BPJ1sfmeLcTO%2FifD6NUqb2Hw5wNUO8HnTxY0THOGhj31QwRUHD8JrVBpz7o58UO3ydt0JkrL7UajOfRmH9pYYLq0HnQlXNHFsSxVFcyCIXnAYGhR1QzLyinoJaANurJ5Bo%3D\"}]}\r\ncontent-type: image/jpeg\r\netag: \"8df1bc0871838d1\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c830399b723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27616,"size_decoded":28240,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 258x258, components 3","md5":"07d24e3b8fcbf65755c1f7458e3e1a48","sha1":"bb8f6584cd246a9a277fa82dfe96a3ce88ac7180","sha256":"7bab209513fdd66073ef039dab2e718364426e51b0a4ffa2eb3753f6e646176c","sha512":"6cc2d75ccaee474b6ccbf3defd8782e879c20d0fb6c85d074ae895effdd41a73d17837ab2fb9b558241f0eaa45700186aec35c49e6364f5b6b1b3e6128cbbf54","ssdeep":"384:orauWR8emtj4bmqRqaqerZ0rgLQiuynwNgRgrJkrOvJuSVk/HInrH/o/J0AaUNXP:oraaemECaLLQjmNe9Vzbo/J06ZtKquc9","tlshash":"66c2c0136e339e5abd0a87b4bf326dd433c4dd449e81ac0529d2cda0f3ea063406d6e9","first_seen":"2026-05-02T03:19:57.487166Z","last_seen":"2026-10-16T14:35:05.886806Z","times_seen":2,"resource_available":false,"data":null}},"time_used":895,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":366,"receive":529,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/images/icon1.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.467Z","timestamp":1792161241467,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/images/icon1.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lGye0aBmm9%2Bf2zOXpatQr0HtV%2BnjulVCC%2Fogqrm1ehwUiciMzUn%2FXJqFAovGNuc9X%2F9aaQDJGlWGCpC1rFy1QbXwqfPE5lz0jLtCwP%2FXvpASatq883rIa3Q9WIpUFmRNLghb9P4%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc086ac48bc\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82f28d9723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4830,"size_decoded":5461,"mime_type":"image/png","magic":"PNG image data, 189 x 192, 8-bit/color RGBA, non-interlaced","md5":"f7326c244c8ce2a5fb3d5d9266c098a2","sha1":"9091132ed50bc60800fd839cadb39e4da7af8eb4","sha256":"cf8af609ffca01187c5a6591a02cc1cc4571585c048ab699d0a7e1de059d5712","sha512":"b6ab824999f61323b3805ee5d88f43bd09a699d89f62a6dff364b6dde5f60e18322a95b06338a468c98d1bc5120aa7e0a9423235ecab860d96d588bb71d9d392","ssdeep":"96:nD9AknmWpPbCR/UHlubNHi5hQ9opJxjn1BdXeH9GXXJdjaVDn:nD6knTF8J0oot3d29B","tlshash":"eaa15e01e142ef02322a970579dfa0d7063629885dd1ea09ffd6ccd752654ede80b4eb","first_seen":"2026-10-16T14:35:05.840019Z","last_seen":"2026-10-16T14:35:05.840019Z","times_seen":1,"resource_available":false,"data":null}},"time_used":499,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":337,"receive":162,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.mmtd.top/thevenetian.gif","fqdn":"img.mmtd.top","domain":"mmtd.top","tld":"top"},"ip":{"addr":"104.21.29.180","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ndkszc.com/","date":"2026-10-16T14:34:09.394Z","timestamp":1792161249394,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"399ee6eb.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 29 Aug 2026 23:51:54 GMT","end":"Sat, 28 Nov 2026 00:51:50 GMT"},"fingerprint":{"sha1":"18:F2:21:F7:61:95:C8:F7:9D:64:CD:DC:93:E6:EC:3F:A5:AB:9D:6B","sha256":"B7:D6:82:9B:2A:6D:E1:B6:CD:D9:F9:C3:1A:64:4C:2A:82:9E:F5:EC:F2:DA:54:1B:97:70:21:C7:BD:15:10:71"}}},"request":{"raw":"GET /thevenetian.gif HTTP/1.1\r\nHost: img.mmtd.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ndkszc.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 16 Oct 2026 14:34:09 GMT\r\ncontent-type: image/gif\r\ncontent-length: 251441\r\naccept-ranges: bytes\r\netag: \"7b99463428f7d30d471062896b92ff90\"\r\nlast-modified: Thu, 15 Oct 2026 12:29:28 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P2BjBKBWhnYG%2BlTn27nKinnBGFvMtFZUxbWFyz2h0vSI9u8%2BQgjrHESuj9I8fzGCnrIRLmqC0FG2jSAtTELaSL%2BLoFZUE%2F%2Fob5%2BdUl1MCErzZH4lrtoM7EDEZspVZAQ%3D\"}]}\r\ncf-ray: a4b7c8614f02c272-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":251441,"size_decoded":252099,"mime_type":"image/gif","magic":"GIF image data, version 89a, 800 x 400","md5":"7b99463428f7d30d471062896b92ff90","sha1":"c6f351ccf5cbc81544d250d164b68d8482bda3c8","sha256":"70e7fd5881343dd23ef394501899b9d1f99a6f6979a9d2dfaeed20dc3a132e0c","sha512":"cf169c5a7c1f8e0af9a59758f4fec07f455e97dfb1f5decdf5ce54adf56beadafcb43303f690a755ffb4effa273eeee0230d17a01fe95cc608ec5c1a2f456e2f","ssdeep":"6144:GJeorjbvYIRrGtiMruaVuXh7Y6qRv1xWon7kEpnMqCu:GJDrjDHGthVuFTYxWonAEMqCu","tlshash":"19342359c65ac999cae7f4b618fa00d2616e66b0197291cf3f201aed8319f05f0fb171","first_seen":"2026-10-16T14:35:05.896466Z","last_seen":"2026-10-16T14:35:05.896466Z","times_seen":1,"resource_available":false,"data":null}},"time_used":359,"timings":{"blocked":84,"dns":0,"connect":0,"send":0,"wait":270,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/unimportant.js","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.009Z","timestamp":1792161241009,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /unimportant.js HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-type: application/x-javascript\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aun%2FKxR9%2FS1dcq5tUm4rZqV30KQIso6liEOW7t7ilI9ZGzf7Ud5zzPHy%2FEE9djmGha0q2Rgus6AnWHtbLWrr4%2FrcdnPuyVCnZCnggwr5kIWj8%2BUV5nzrgYR9IsMI%2FqM%2BCqiGoyg%3D\"}]}\r\nserver: cloudflare\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"8df1b731a3af704\"\r\npriority: u=3,i=?0\r\ncf-ray: a4b7c82c4f44723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1230,"size_decoded":1291,"mime_type":"application/x-javascript","magic":"ASCII text, with CRLF line terminators","md5":"b87d6b895df572bfa9602eee007d36a2","sha1":"13c4c504ab2e9666f8443ec9d4cc9fe7484cfd58","sha256":"73e23109a2a07c522d0aa2341ec2531161d989717259c6fe6bd147020b9ca272","sha512":"c8406c8c67a68e90b03f8c914c951008a51b46cddcc3ce0c6c596a5b246b4fdd52e726159d8253fd77e7943e6f1c4d92bf65dbb8bf88957827e1ea1aad4a5595","ssdeep":"","tlshash":"332147764861507c45329337b1b25e3cf9b9801bd3210910b54c3d3a6fb8e05d967dd8","first_seen":"2026-10-16T14:35:05.897668Z","last_seen":"2026-10-16T14:35:05.897668Z","times_seen":1,"resource_available":true,"data":null}},"time_used":377,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":377,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/images/more2.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:01.451Z","timestamp":1792161241451,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/images/more2.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=93GaTMRIO2Qo2AR2SvrWM2nYAbDLy473YNB%2ButFz%2Fy%2BJujdnipZt26cWfu7oUIi4x1IKoolX1434V1%2FsZQtRFYX1qfsLuuUqZrz%2B2UdXD4n4Jb1VAg0FVz0uaF2T06zI%2BedrjhI%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc086920dae\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:01 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c82f08c6723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":279,"size_decoded":910,"mime_type":"image/png","magic":"PNG image data, 59 x 60, 8-bit/color RGBA, non-interlaced","md5":"b45fc4b2a59f798eba70c05f7b22af1a","sha1":"7c02ec529991867e48ddddc8d96cc7c2e5b29fda","sha256":"4f11b3d6ad4973e46598ea8357722db70cb95e2c7d045a921165bd83f6d8ad8e","sha512":"82fe4baa8e3afe1fb2251ee5c8a3b8c0d670ef75caa8035254b37558e7021055701b33bc9b207017a3426d3cca062b12c33780c9570cea94b12898177594896c","ssdeep":"","tlshash":"d8d097c4ff801c3789c93a2f620bb8b05a2026109001e323f92b893eab022245248702","first_seen":"2026-10-16T14:35:05.898759Z","last_seen":"2026-10-16T14:35:05.898759Z","times_seen":1,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.redotpaycn.com/template/jintou/images/line1.png","fqdn":"www.redotpaycn.com","domain":"redotpaycn.com","tld":"com"},"ip":{"addr":"104.21.15.240","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.redotpaycn.com/","date":"2026-10-16T14:34:03.205Z","timestamp":1792161243205,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"redotpaycn.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 07 Oct 2026 12:20:55 GMT","end":"Tue, 05 Jan 2027 12:20:54 GMT"},"fingerprint":{"sha1":"2D:F7:4D:0D:01:9E:01:58:42:03:96:B0:7E:8E:79:F8:51:A3:6F:A3","sha256":"B6:05:9C:46:07:5A:09:FE:31:3F:04:A6:72:AE:27:5B:27:33:7E:E6:D9:BF:BD:F5:18:B1:22:B6:11:9E:5B:A2"}}},"request":{"raw":"GET /template/jintou/images/line1.png HTTP/1.1\r\nHost: www.redotpaycn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.redotpaycn.com/template/jintou/css/style.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HfFaBhE5zR4IT2mRai9%2BDzDQveLjOLlcDmAm03UGhIp6vDlOHQxmBjspqKPpQrAxvXhpeyd7PYkNHUTLOkgU37QlFtuvQ87faPa0ie3Ymdb2j1Pw3YknjgjZuv8NxNNPQOJLJq0%3D\"}]}\r\ncontent-type: image/png\r\netag: \"8df1bc086bcf8cd\"\r\nserver: cloudflare\r\nx-powered-by: Nginx\r\ndate: Fri, 16 Oct 2026 14:34:03 GMT\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a4b7c83a0833723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2309,"size_decoded":2930,"mime_type":"image/png","magic":"PNG image data, 93 x 4, 8-bit/color RGBA, non-interlaced","md5":"f6638f372ce554ccbb55c1910a0c86c1","sha1":"f134c9a7be3d337fffc45cdede2fd3f37e076923","sha256":"a089cbdb1fda0c3321d83054f84e234b33be76b5459485a0b02fcb86d5abc7de","sha512":"ae09f46a281ad00981b276888bbccc8e45aa88185154eb08d33b6a26077b798eaa01be2507e9658b496640b52745726400ffbf5f72403f3a8b6077bb4ee4a7ec","ssdeep":"","tlshash":"23415249f892dc00659cab47fadaa22657332780d782e481acdbc81758e12fdcc1e7d7","first_seen":"2026-10-16T14:35:05.899919Z","last_seen":"2026-10-16T14:35:05.899919Z","times_seen":1,"resource_available":false,"data":null}},"time_used":337,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":173,"receive":164,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-16","alert":"Sinkholed","trigger":"www.redotpaycn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}