{"report_id":"481cecf2-083a-4a3e-b954-7023d93377cd","version":6,"status":"done","tags":[],"date":"2025-12-03T01:47:37Z","url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.76","port":0,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"title":"qu8q.shop/","dom":{"size":123833,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (63377)","md5":"25ad76a20b22f6e77cb96c519cab434c","sha1":"d3ebe4ec1737d6447d8470745858be18ccc6c2e6","sha256":"75d54d56411c4da792c4fb20a0caf75b4274f1998d2597b0670034b785008b52","sha512":"55bb8b9dbce56aaf5ade0cf9d4f764d716a332a59b5bf5060d70253bc8a713714b4b24f3687dfa10ec50308e6fbf804eb08853f2f0e97cc76d411ff7846ed4aa","ssdeep":"1536:rVYYFiYZLw6wVBIutvcpgDAxOHLrrxRco/7:CE+AxOHv","tlshash":"78c30468381860f71677f6d6f0256f1bf99ea317cf19916196fcc2884fdad20b8131a2","dom_hash":"domhashbf0f4ce92e4f13a349d7e0587ca12e27","first_seen":"2025-11-08T03:51:01.855878Z","last_seen":"2025-12-07T03:25:24.120729Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.76","port":0,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-07T01:47:37Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"9c29d718419785022b347378791e4192.5qt6u.sbs","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-06-08T13:09:09.265192Z","last_seen":"2025-11-18T00:59:46.130764Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":471,"comment":"","tags":null,"fingerprints":null},{"fqdn":"qu8q.shop","ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":806,"request_count":202,"received_data":3067989,"sent_data":87696,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"106.54.228.253","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2025-12-01T05:08:43.792059Z","alert_count":0,"request_count":1,"received_data":579,"sent_data":440,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"0a1a2acb97185419dbd2d2dd1ba338a4","sha1":"3e07aabc2e05f20609084b4879c50416db961f6c","sha256":"d436015772f09d7ade1cb1ed4de1913ae77014a37fcee4ccb23d3ed1077eff8c","sha512":"214010dc28bd7ebf43d8eb40e5d8589599f32e101bb2f6c16010a07b8fb6198bbd2e54922f75ce13b98067f172c8e9ece676518fb0e8d86a804340e48d739f4a","ssdeep":"","tlshash":"bbc08cd4a0c22d001602642054bf28e49024802770481b028ed8d8992e220b09233e98","size":138,"data":"","first_seen":"2025-12-03T01:48:02.557619Z","last_seen":"2025-12-03T01:48:02.557619Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"e2b87c029dfbe09d1d31b3673f714215","sha1":"c62a4c454e50c76a773ed093ea802e35dca617b0","sha256":"70fb219a451241a9ae18eeb17446a04456dbe1b57e38b54895ce56a7bdcda971","sha512":"d86e2ee0247bb182273ec124fd3608629aa2a1c0e3809e2f694a46caf490acc0bfb3b0bb9dd8c66cb71f4d147a44b0413db789f10641b26ea0602e889bcf12a4","ssdeep":"","tlshash":"c7c08cc4b0c22d006a02641054ef35e89034442670881b039c98d84c2e320b09233e98","size":142,"data":"","first_seen":"2024-08-19T17:25:10.036675Z","last_seen":"2026-04-20T19:54:01.711149Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"a103b1dfc4b685b06d8b3c68cd429d88","sha1":"94b222fd828a1e3d78a5188eb5301df19e717a3d","sha256":"156a4377e90e0d38435b517a6c5c03808b9dfc11dc090c4e07b59977e5356c63","sha512":"26ec98a59e2313349e46bc06b701b24d729b4e8fac9cf6a7eae9abb55fc4e32fdade1afaa009b6ec27039a942ab40dc9084be667e8657d28eada81620c357f48","ssdeep":"","tlshash":"9fc08cc4a0c22d002602641020af34e89024802670481b038cd8d8882e330b08233ea8","size":140,"data":"","first_seen":"2024-08-19T16:57:49.553404Z","last_seen":"2026-05-14T23:15:35.126611Z","times_seen":39,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"88272cd21bba387abbb9b8db6732d407","sha1":"6beb0d01d8d0603ca07dcb331d54ad5ee159a282","sha256":"8473dbf5c9a05de41a120d2ace7e080d6c4dbcab40f133f81cf6e4ca9cc9e851","sha512":"94926478b34d1868cca709b3c793bc2e46f03ac41c3f281aba84258384ecb0d4cb9283b107ae959a71f77633f3b7b448924e431d004f458da82257fac6d1d2bf","ssdeep":"","tlshash":"a9c08cc5a0ca6d101a22681010af35e4a024402670481b02cc98dc482f220b09233e9c","size":140,"data":"","first_seen":"2025-10-08T20:57:16.045697Z","last_seen":"2025-12-07T03:25:24.974998Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"2e1d853b52557efb75ea168e4ceca800","sha1":"2157ae397f3c8c07620156487c42246edd6f5b59","sha256":"8d535a8b9deccf4814608f42417256fbe426fd6976f6e406266e20c5fdebec16","sha512":"743a2ff852bab50db0cefc9a7dda1e11f4ec2a2893fb586de50a727d53cf3f6a11ff1cdbb4f24d1febdb9db217b89c8ddc2f546f4b1429d932b24932ddec559d","ssdeep":"","tlshash":"05c08cc4a0c66d101602641010bf25e490348027b0481b028c94dc483e270b18237e98","size":138,"data":"","first_seen":"2025-10-23T13:40:37.83649Z","last_seen":"2025-12-03T01:48:02.563389Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"89b9c31195a4dfd355d357164bcd0ef4","sha1":"10575a90fa8b176e97dfa175b164da4e7f292821","sha256":"d2e13f8fba89e10153d08bc2fa256daab00993c131da5054a25222f20d5bc22c","sha512":"3008b55aa9fd158712d472b2b37422540965626fb34ce6590d91c603422b56aa7b5810805517dc6cc15bc24d225ba630f8396063bf470179b52e02a36bc96e9e","ssdeep":"","tlshash":"06c08cc9b2c36d041a92a41824ef24e4a0344066b1485b038ca5e8892e220b19237eec","size":153,"data":"","first_seen":"2025-10-08T20:57:16.121722Z","last_seen":"2025-12-07T03:25:24.922013Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"8c863d3f3a77d9b879e3b7cd0c807043","sha1":"01087e0b6e8fe97fdf354ff82046baec6874237d","sha256":"dfedcc7dee883ae969e84864fd08acc8374b968c57274e37f0ad2c7d330b92eb","sha512":"4aab27423e33eebc212fbbd8ec420e16e72f27a8858ac5855b20adea5633f73d0c292b4d40f91dc63f1b387af45c8f17ff032749f5970ffe77564cd8f39c9a88","ssdeep":"","tlshash":"a0c08cc4f0c22d002a16641050af24e49034842770481b038c98d8482e320f08233e98","size":140,"data":"","first_seen":"2025-10-08T20:57:16.030879Z","last_seen":"2026-05-14T23:15:35.102474Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"8499ac86734b4679c740057f8f25cab1","sha1":"a0733c856c566fd2fc0552ede4ea6a5730ed117f","sha256":"6a0a8802844bed4c2a85db228710022209e2d5437c3c63a981ed787df35e37de","sha512":"963a35cb55b754f250740d7fe48b6d902eca96739bb7e1366fd817df04c9923c0bd052a641dff493cee547dcd11d3293a1c5d1b889502c003258c114bb6e4c4e","ssdeep":"","tlshash":"1cc08cc9b0d63d542a02692010af24e4a0248026744c1f528da4dc482f330f48233fdc","size":152,"data":"","first_seen":"2025-10-08T20:57:16.131568Z","last_seen":"2025-12-07T03:25:24.900133Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"de9503a8fdba14ec47b9552b0a7968ab","sha1":"f28efa95ddde9c0727973b9f8d11aeed69dd2a40","sha256":"7e53e0eafc450f26bf191c48b415c77c00bb0f29135401b38a3f2d1905cb3b02","sha512":"3852f29070be33d7181a0eb17a3269b12edb45db7d17b696d8d1dbe93825d1a763a17bc5ae9f06ea07d3593e722fa599ed622fa1771b9024f767c4b440dcca75","ssdeep":"","tlshash":"29c080c560c76d005a425571506f35e86034401a74581713cdd4d8553e320b08337dac","size":157,"data":"","first_seen":"2024-08-29T17:44:43.71652Z","last_seen":"2025-12-03T01:48:02.573767Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"8dcbcda6b2c68116f8d0511d3cbb63e5","sha1":"96c04868dd4223cb175c0bd4d674d72de7ea3b3e","sha256":"c6405ff3a453f99d98e4ec07c972452d3947ecbea033190a198545014ccb7f66","sha512":"37b05ae9462077cf35cbf54aff2671618a474543908460b0f248da9d52edf31da543092218ef5b177c2842a466f51f5f97c2efa2fdb858658876e277f883d06b","ssdeep":"","tlshash":"9ec08cc5a0c26d001612641010bf24e490388026b0481b03cc94d8482e221b09233e98","size":139,"data":"","first_seen":"2024-08-19T17:25:10.024167Z","last_seen":"2026-04-28T18:12:46.644864Z","times_seen":22,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"1ec3d0d474635cbca9c8755ac6110bb7","sha1":"c91b3ead7142bef0bc2f88e45f99e6a1441b5183","sha256":"c211e222027079548058e4e13bc84ae89e9255e800869b11e8324e5c52eb0ed3","sha512":"13aa8fa0eec7e46b81f4b3cbb447fce51e8bc6cc192f705bdd654d47810da991af30fbfdb55e941b67153f3a53b278a247f1e5deb924306ae3404b54ccef0eb2","ssdeep":"","tlshash":"ddc08cc4a0c62d001602752010bf24e4a024442670881b03cd99e8482e220b48233ea8","size":141,"data":"","first_seen":"2025-10-08T20:57:16.05195Z","last_seen":"2026-04-20T19:54:01.510955Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"f363371d9199f1446a5afabcf47a96d5","sha1":"3f664773c2e1e08947141f5eea20b2beb116679b","sha256":"8db19f36c50546fed5c22eb8792edd6a73fcada5d9bc574e004f7828cf713778","sha512":"8228749b77d207330c79276216841c21d1ddd41ea7315113ff46f72c272ba96f69794db935991300670cfb9b745fcc2b1778f92e33054c20fcaa51a11d28d83a","ssdeep":"","tlshash":"5ec08cd4a0d22d001622652210af24e4a0244026b0482b02cc94d8492e230b08233e98","size":140,"data":"","first_seen":"2025-10-08T20:57:16.068138Z","last_seen":"2025-12-07T03:25:24.905664Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"652741b4008425f2f78d94aaed0e1923","sha1":"117b75129ab3f61ad10f5d4451c6a291d3bb4ccf","sha256":"1e8c5b257f261df99454fd78ef58248993c4d3b71f557487810ef90189e94a77","sha512":"0c426aef34183c99d5357dd804cfb4ac2e5513741dd0932253c464d487dc3258e81607906a593e125af1fb4269e5b1816cf498f33948f2821d9422df667e07cf","ssdeep":"","tlshash":"11c08cc4a0c22d206602641010af24e4d024842670485b038c94d8482e730b08233e98","size":139,"data":"","first_seen":"2025-10-08T20:57:16.106646Z","last_seen":"2025-12-07T03:25:24.84223Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"321e757dd8b0ec63a3e2d23bfbb0eb39","sha1":"7bddff487f0e477c2c12de983f88d55f62f3cfda","sha256":"109547e99d557d80a72abc5c6894eaeee771b22354b8a9234a77c6dd64a3e6db","sha512":"bf1d6dc5c402d32d87a04333e184c1c36b27180161eaaad83f17ef59ab24b0bb5e6e63283cb40a93d0e868082c456e17d92421f7d11ae61a761c747b26872362","ssdeep":"","tlshash":"3dc08cc4a0c62e001a12a41010bf39e4a024812678481b038c98e8583e230b48233ea8","size":141,"data":"","first_seen":"2025-10-08T20:57:16.048912Z","last_seen":"2026-04-04T12:25:15.253184Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"9fb9d2c62d0b53b369d827901c46d31c","sha1":"bb623e7486aa9ba44851ecc6ae01db5fe42d83a1","sha256":"b02ca87ad43e5ca61f953b2e414559e63f426c8513f7808707f39a4ba04ab219","sha512":"48cbe981398942910959f746a8225a91578752b67121817ae3b6b85859d0e97f9d89e96f1672b63d758f3148f3f37034017fd93d83415097616a90af285f0a18","ssdeep":"","tlshash":"afe061c3506e394c02108119304ac0075bb908b2de8549611c5837a58af9e4bc569455","size":363,"data":"","first_seen":"2025-03-05T00:30:25.174857Z","last_seen":"2026-05-31T15:28:13.961746Z","times_seen":455,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"8326c2d040de8d60e8c54e62769e5f09","sha1":"92e3ba76e363f24e58011edbefa0925c2160fa7b","sha256":"2428cd11947cb9d2fe0c566c51e5d208e117fba3db3fc3a7acd30c9e334acc8b","sha512":"d060321861cfefec28632475f065af7b11bada8a3d4ef7bcbc1a8d162b7c406178a2f4f96ff9f1bb8655720076810e6cf979a502383e57b61e251fedc684c8f6","ssdeep":"","tlshash":"dcc08cc4a0c22d501612659410bf25e49024802670485b13cca8d8482e220b08233e98","size":140,"data":"","first_seen":"2025-10-08T20:57:16.078084Z","last_seen":"2026-04-23T09:09:10.047999Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"0b2878c3adf5bf51ee5bad51d4576b21","sha1":"9f83852f67cac255b861146da5000dbc51767ab9","sha256":"e8057a09adfb71262b41f107da30ed82bd4be7434e9cca00ff6b22331b859fab","sha512":"117abdfe7468b01f54ceab0c1c12c1bed07a35b724372f27988f3a0b89c167377ad1a3d727ec984fc2969876b5caa2f5e88f3f766a3b078dfd944035ea8a3bdc","ssdeep":"","tlshash":"29c08cc4a0ca6d101652681110af24e890244026704c2b02cd94d8482e620b09233e9c","size":140,"data":"","first_seen":"2024-08-19T16:57:49.550375Z","last_seen":"2026-04-23T09:09:10.05799Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"41e537fe3d8a2fcd3a7bfeed36ef6342","sha1":"dbc02b7c6bf19c935a10baaaf5251b2cedcf5af1","sha256":"f7e975df4ab4dc2bce5b3a3f5e17d7d3469270b71378bc66554518f79c513d0e","sha512":"12cf6e9f79e73c9472c317e651ffaac01062b4f6273fb356c49a189a389bb5f0cd76c94b802d77aa4e8819b1e4183cca32bb58f72e7a934c287b7a8ba5c51a42","ssdeep":"","tlshash":"dcc08cc5a2c22d149aa26414a9ff38e8a0344026b4489f12cdaad84a2f230b08233f98","size":155,"data":"","first_seen":"2025-10-08T20:57:16.116306Z","last_seen":"2025-12-07T03:25:24.880107Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"5f5b4297de525fd32ff083c9ec2e1184","sha1":"0de7288449e66542bd501ce827dfe42db6f2a0eb","sha256":"3aa19f71bb447cb1da599bad82244d3d281b7f9f21fb14af6770978ff75a27d5","sha512":"badcc59c001804ad094727b97774863282647bad16730fc92d12f1a5c07ebcb7e525eb4bccacffc459bae496208956969c5aa29496dc40053ad4169f98eeba46","ssdeep":"","tlshash":"4ac08cc4a0c26d001602681111af26e49024402671481b438dd4d8582e220b49233e98","size":140,"data":"","first_seen":"2025-03-15T00:38:43.900347Z","last_seen":"2025-12-03T01:48:02.586395Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"c2a430365a17b96bff27a3c4fa9bdc90","sha1":"ab712074f2cd86d4a9f20f6ab053c16d43d27d6a","sha256":"f780ba601e5799f63d3ba3287f35eb69b7f2051ac862033e86fb254566bb6b9c","sha512":"d476d7e5da097f741c73a23f0125e1602a8f763a3846367a4a8de6bfe775f182ff6768561f87495697848971790044f509972b63a91ab83db3399e657f874c58","ssdeep":"","tlshash":"f1c08cc4a0c36d602a03a49924bf35e490f4842bb44c6b469de8dc993ee20f19237fe8","size":163,"data":"","first_seen":"2025-10-15T09:28:31.790866Z","last_seen":"2025-12-07T03:25:24.972296Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"9d7fe40b7e352f9078cfa6c79ce9620b","sha1":"e9b34aee163fa29843bdd8c88facb3cbb3a6435c","sha256":"9370f69d867a24c8612e8a19eb3e6fd6ad078b3eaaa06ff7d082988275d92674","sha512":"1584ae9732ce37e00c4b6b160a16c06befe0e4d5ea522e3416f33df7f72123b5f131080beec5bc5830a20bfb1a2e118595826d845883caad33d4117e309c60cc","ssdeep":"","tlshash":"3ac08cc8a0c32d202612681110af34e49024802670481b128c94ec482e334b08233e98","size":140,"data":"","first_seen":"2025-10-08T20:57:16.02764Z","last_seen":"2025-12-07T03:25:24.959782Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"2fc28da0437382ecfdb2f6da3a2e431d","sha1":"6d0a18a0253d155abe5ae94c53896485f421979a","sha256":"73f446293a98223da0aef4a4920f090e0e7fbe2145a2a62b91ffc017880e6212","sha512":"1c27823490524b291983277b5d4c6acf79d438862f75046459f51a9972001fc769d37127855929fbf7f4a438f812f07e3d5d3faf1ccadff097fe4fdd4f1f0aeb","ssdeep":"","tlshash":"96c08cc4a0c32e001702a41054bf28e49024802771481b429c98d8482e220b08233e9c","size":141,"data":"","first_seen":"2025-05-15T10:51:40.925324Z","last_seen":"2026-04-20T19:54:01.670741Z","times_seen":35,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"6d1924eb6c11a6bc5979aeeb9353569a","sha1":"bd797975ec8ef11ea30c990b40a50bc0abcee6d9","sha256":"fb5f131d3916ef4ec865495185f7f0f086bd840a6ecb0dddbff45be8fcda3b9d","sha512":"c691e96c76a2d20fe0cf10a4491edb8395286476b8604637a49b94e353ecb2b26cd7f4582b43e866de9eb9d6526cca688ae0a18ba7db13441eb6efb96e08aefb","ssdeep":"","tlshash":"a6c08cc8a0c32d101612682010af34e49024402670481b02cd94d8882e220b08233eac","size":139,"data":"","first_seen":"2025-10-08T20:57:16.036455Z","last_seen":"2025-12-07T03:25:24.916886Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"74250d9b0a47b4cb8a7b70a480db255c","sha1":"32a252d4d171980f55e043ee6e6eb4d93e302e45","sha256":"c2fe5370ba653a0d4ef7563c808de69e8f524015824ade78dfac043d5560c63f","sha512":"76e3fa51883a2d9af517db69cd139252943ad1200b7812dcce1018f017cfdc1e06e78b7fa489fa9411e6c16942088bccd8103bfcef7051cbe3140b858d38e682","ssdeep":"","tlshash":"86c08cc4a0c26d101a16641010af26e490244026708c5b02cc95d8482e260b09233e9c","size":139,"data":"","first_seen":"2025-10-08T20:57:16.043943Z","last_seen":"2025-12-07T03:25:24.93985Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"44ab2da0604d1138154a13b534229e1e","sha1":"2fe744bbec8d88b9c0608307f283057059f1c2da","sha256":"190c3ff57c2f093091ac1b167e1e7d7c71e02b79ffe0c93207f16d8eebd92162","sha512":"c55bd2aed61b020c541d5992e81e59e4cdb2eb102756aadeae3fc8ef86fb55d7cf3de99384ac32ba009a2ea778d4e8d3fbbac9d1e9e1db330ebe05b1a0135b63","ssdeep":"","tlshash":"efc08cc4a0c22d002606641010af34e49024803670482b03cc9cd8482f320b08337e98","size":140,"data":"","first_seen":"2025-10-08T20:57:16.086075Z","last_seen":"2026-04-04T12:25:15.308696Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"e713a8c81f3a1456764ac3e572b7518b","sha1":"75d00e1c22a1f1e6397a73a282b9bf903863053b","sha256":"6453fb84bfe5c4bba47ebc2636c3c7d3af57a4b9c242848d19a674af0507b499","sha512":"19312bf317b6dd6550dfc6fb715d19d93541f8a6c899f286a722f0fc19bad2b43ac1ef8313cb52d992fa39d56a6de1cb22673ee8c118baa18eb2883781491ac0","ssdeep":"","tlshash":"f7c08cc4a0c26d001a02641214af64e49024802670885b028c94d8482e220b09233e98","size":138,"data":"","first_seen":"2025-03-05T22:53:38.309191Z","last_seen":"2026-04-04T12:25:15.346114Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"82786ce0496e3378a002bbc7f284f42e","sha1":"1c03bf68552719ed1de37dc762043887ce5ce931","sha256":"d152774808092d5f42ba6cb4516cbe2091c724008e22564ac889d5f5edf1aac8","sha512":"462a2e7d0e869b10485c0c5a244c0be2a016c4c973a33b9fec708d345f0d55f6e48a53be3d4ace6390374f487fad43ce49e7f15a1a6c3829164f66086b6d0d15","ssdeep":"","tlshash":"44c08cc4b0d22d005a12741020bf29e49024802670481b03cd95d8482e620f08333ed8","size":143,"data":"","first_seen":"2025-10-08T20:57:16.055255Z","last_seen":"2025-12-07T03:25:24.914118Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"359b6ab4cf62cd298362bd5a6fb00b64","sha1":"ddc3f6dc079ab0db1bc1c3cc9200e7ee6df417f5","sha256":"d61a5935428bd860f6e115e13fe6cf00fb4987cab4996cf076e81041a6c3e5ce","sha512":"84c64248c2be4bf316e1dc66218751ddfdf0023b6cc8bb64c55f58e6a261dd180ff9d07ab7ee55f3972f4d7c3dbccc658e357df939820affc896a381da1b01b9","ssdeep":"","tlshash":"88c08cc4a0c26d201612685011af29e49034802a70481b02cc94d8482e220b08233e98","size":138,"data":"","first_seen":"2025-10-08T20:57:16.047296Z","last_seen":"2025-12-30T20:38:26.676377Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"bb1f61bfb36e1f51f784deef1629091d","sha1":"600ca993af6bdac0292103537e079d1f6d956cc9","sha256":"c3067c0d867e49a58e3cb755bc663aeb615b3502723021ab0c6c013d2ea158a3","sha512":"f069e47a16ed094dd892a3e0c56a9decc887682e780fb0ed5bf23fb47523b18d4fd735e5b0330cfe42a58f984aaaad3c287a08f20e0d162a9d47e543efebacd1","ssdeep":"","tlshash":"74c08cc4a0d63d001612a51014af39e4a024402ab08c1b53ec98d8482e230b08337e98","size":145,"data":"","first_seen":"2025-10-08T20:57:16.06668Z","last_seen":"2025-12-30T20:38:26.697918Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"dc5326a693651193f0603352edd97ad3","sha1":"c94aae7e375984c07495b5d6950a4e8fd4cad993","sha256":"213b8a9a586e2aed3139a148b7e7776957d273274257942fc036fde4f1290ca4","sha512":"154645904e73d2030ef1478fdb50521432b840a17bd887d9cc33038dd96bf735b7e8e34cc2ac9282635ffd2995bd1704e1536df89965979d47ed7c50cbd4b1ca","ssdeep":"","tlshash":"c7c08cc8a0d22d002612641154af24e490248026b4481b428cd8d84c2e320f08233e98","size":140,"data":"","first_seen":"2025-10-08T20:57:16.053694Z","last_seen":"2026-04-23T09:09:10.043917Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"da8d5f7f605f6d40997bed3a34ac59ed","sha1":"f828a4f4a687f8278b282e45534ecba6b4b8f409","sha256":"7485372cf0d2d822397e633a8489afd95ed1d2d0799fa674005ad87cfe45a633","sha512":"6b3905d967c1f79b172fae8b8c8f226bfe0e3a2fe0fccdd95f1e1c2779ae56e922bdf71e1bae9ce7ab2e6741cb2468ebb12a1cffb119fca7a97051485c8d998d","ssdeep":"","tlshash":"5bc08cc4b0c22e101602641110bf78e4a024402674481b028c94d8482e220b48233e98","size":139,"data":"","first_seen":"2024-08-19T17:25:10.009378Z","last_seen":"2026-04-20T19:54:01.690032Z","times_seen":40,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"2fab7f862c1e782565e7f5dceb13a87d","sha1":"8aa713600feecf32ffeb13055161df092fb0d443","sha256":"43e26be7900e5d6584e2c7b5b95c6e62ef3842357b8a8bce1e131b58e984cf23","sha512":"73675e770654e9186171e21051b184f2f7bb9930df24ba3c100203681b891f8987a7ed1dd889d3dc32221561fd9c91a90220c4ff00786533193822ce56354470","ssdeep":"","tlshash":"00c08cc4a0c23d001a02686414af24e490244026704c1b138c94e84c2e220b08233e98","size":139,"data":"","first_seen":"2025-05-15T10:51:40.935552Z","last_seen":"2026-04-20T19:54:01.570987Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"4ca72f2165f5598ed44b6b6f6a336bc8","sha1":"6ec15f876e58cb2b89db2d8c7e56e4a75452ff99","sha256":"1fcb73c7633b7933245ba3e77623a8734ca4b934a1fe882b04bb61bf6455f658","sha512":"d7130991fa01418e96eb9b4feae4cc4203c6b10d8dab85b741032cefd9a2d278860e87594d0047165ffa07d8a9402516830905a14172eb51bc243d719db2cbeb","ssdeep":"","tlshash":"a0c080c660c72d105e135561546f35dc6035442f744c2762cdf4d8593e620b49337d98","size":164,"data":"","first_seen":"2025-10-08T20:57:16.040342Z","last_seen":"2025-12-03T01:48:02.596138Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"c89d151e49d9ae5317ce74e9d23225bb","sha1":"f77a3cd818b784714dfc7d58eb9d1cec539a1b3b","sha256":"d424ed0eb84a81e00c2139d13efa0ec1c8a4e5c786bb62567cc8dba335e7de8d","sha512":"a287b6a3354a2f716f50d2d2124e072f23e06add37234ea8e2db22adae4a1585824a5c8e4c4fa72eeb7fdd83dd55443d484e19fdab1b8d4927944585cfe74251","ssdeep":"","tlshash":"c7c08cc4b1c22d206602641011af2ae49024483a70981b028ca8d88d2e220b08233e98","size":144,"data":"","first_seen":"2025-10-08T20:57:16.026269Z","last_seen":"2025-12-07T03:25:24.950454Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"823f2b3c4ad8088c2f67783a55a6794c","sha1":"3800bcc61442725c52cf2ff30c4940155f725fb4","sha256":"3880a14d108b187cc9d462011d1d34cb9900739bfd933ca7128051d17805251b","sha512":"ddd4f612ccff0f1e7bf766ffe55dde0c5bb1dbf82fc32313a913a67277dce22ff0e60f2ea83b1162ba77e88094cdcda8a4348666fdbed307024ec7c8b9eeebaa","ssdeep":"","tlshash":"cdc08cc4a0c22d001612645010bf24e490284026708c1b13cc98dc482e2a0b08233e98","size":140,"data":"","first_seen":"2025-10-08T20:57:16.079517Z","last_seen":"2025-12-07T03:25:24.897588Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"14083b45036d6f13a41641abf8db09bc","sha1":"bef23870ffd0659f65b3f0ff1192b4a8dafd7a97","sha256":"08e9407689524ff370c8ca8dbcb68183c67d15d8f84d6e67a05f34e99b51ffa4","sha512":"d42f2bbe1f5af6e41130a5fb8e2e604d94308556c1c04b7fb981d37d0913f3ad2a4d639bafb95864947b8d916a595e096e48711bd2b0838a9573cb49fe71e236","ssdeep":"","tlshash":"b4c08cc4a0d22d002602641420af25e89024802674485b028d98d88c2e330f08233ea8","size":142,"data":"","first_seen":"2025-05-15T10:51:40.966444Z","last_seen":"2026-05-14T23:15:35.130426Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"a6081a6601e860d1724da7f25f7d9b11","sha1":"29ec251b59abe6a3fb02bd6efecc0f12f93edaa4","sha256":"81a04457a3550ba1cfc4abf52930f951462c1d76b681afc0e22d6748607787b9","sha512":"9880f0f37379b9e14bfdb2d901d210c9a7f3563c66575e6f0aed4d796bbb89b9b66908f7160d58074db5a95c4f69598837508f7188998590b2277be62b0e5ab3","ssdeep":"","tlshash":"2fc08cc5a0c22d002a42641015bf24e8a024842770481b128ce8d8483e220b08233eac","size":140,"data":"","first_seen":"2025-12-03T01:48:02.598456Z","last_seen":"2025-12-03T01:48:02.598456Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"d87935efde511119c38fefaf44515ed4","sha1":"2f976397cfc7c0e0c37680eb7dfaf0c47cd3686b","sha256":"9c4daa4370e0305bb422c9abdd751b924eed48c7936bb6194b25d27d3002f590","sha512":"e7a9d5f47c379e53711d46c89e6bc38f0d70d627e7ef56cff0aa86aea7d2871d0267726435a6eeb42ebe885548ce800ed6ddb78201caee9f8c9abcb4d0f11258","ssdeep":"","tlshash":"5dc08cc4a4c22d001616655110af24e49028402670486b02ccd4d8482e220b09233e98","size":139,"data":"","first_seen":"2025-10-08T20:57:16.134785Z","last_seen":"2025-12-07T03:25:24.952969Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"c312ce7dbdd25a3f4266973c2395e13d","sha1":"5fc355950abd81a11221e046c9d6839a674d3900","sha256":"c149bcca67382e9677085dd2526bcd005f1a4121a370394d932d87897c85114a","sha512":"cd4a0c8e1874a09947f4956c18b2beef83b4340f71eb1b3d0f52992ebe504dc167a9463fd0af414d851228822b3c6ab36c2c0e4b50a9d3054836f59362dc6f04","ssdeep":"","tlshash":"90c08cc4a0d62d105a26682010bf35e4a024802774481b028ca8e84a2e230b49233e98","size":144,"data":"","first_seen":"2025-05-15T10:51:40.875678Z","last_seen":"2026-04-20T19:54:01.598234Z","times_seen":26,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"37aec041c9cd75a6ce68a2742027c9e4","sha1":"77404dd6bbb005ac92787f4dac42f100ba64142f","sha256":"a3a9c19e9a65bd2c5ba3187839606e0e3fcde86cfdc1dde9b40260527678169d","sha512":"c68647f18fc7779c9ea8320a847be6a8bb03e2ed413e6ca83201ad2d456ea937b4debc46a7ee1b4ab358095f65f4e4c1ee95ac03372bc491bdfa753be308668c","ssdeep":"","tlshash":"1ec08cc4a0c22e001642641010bf28e49024442674481b038c94e8493e220b08237e9c","size":137,"data":"","first_seen":"2023-12-19T15:12:13Z","last_seen":"2026-07-27T19:38:28.032247Z","times_seen":1065,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/assets/pages-index-index.78roOzgh.js","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e42def0383336ae35b3c011719ca6584","sha1":"653c93f88540ed592c99682b93b5f836b36443d7","sha256":"02e9feb36546848b060c2118efaa28ab90c19c806cb164f083a0be0c7a56537c","sha512":"7418e46567d82aa0f626e7dbf721817124ab59d5cdadec2049934ad3e99391534283429e40fca6c415214cc437f3234d35f7eef96973b651eef244136c689238","ssdeep":"768:c+eTMvgG6Q7KzhWoeTMvgGmLfSbbpFdle7Fn3dNITK0CuHmxsA:NewvcVewvyL6V0V3sThCuHm","tlshash":"d1130e67d150c99c7bbba2eade6916a0148d0758f1db00283e7c6fa914f87b0713ee35","size":45393,"data":"","first_seen":"2025-11-08T03:51:01.935851Z","last_seen":"2025-12-07T03:25:24.526065Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"1ce8ee4fa20f2b38d6c300136aba3ff5","sha1":"43fef85002a61ff9b567ae5bec601b582624ee4b","sha256":"eca68ae7e33a3a6fb20a1015462fc3a521078e3cb78856875262222d1d0759aa","sha512":"801fcc1f5b5ebca65a530c51ad5930976a1a2b706b15e13f9548a1a5852f2fa96cd4a89e786326c24bae9401e0cef63019bed104c7d75a850b75766b4f6f2df5","ssdeep":"","tlshash":"dfc08cc8a0c22d011a02a81554af24e4a034402670481b02cea9d8482e220b0c233e98","size":141,"data":"","first_seen":"2025-10-08T20:57:16.113461Z","last_seen":"2025-12-07T03:25:24.915098Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"3ede6641e4cb2be757ed8711e4c35cf0","sha1":"e43339e3a7ccccb4ac5f321594dc714feb1512c3","sha256":"f2ef616722111b5384982da97326e7d93b330cb24265164ed6b9d71c468134ab","sha512":"b96114172d7e7b87cb54821615bdd8b583503d0398a5aac3ee7d405b940ea18124b78a726dcc3baa6ccdf97846aee210e2e443dd94c0615cb465b59987bc2bca","ssdeep":"","tlshash":"52c08cc5a0d22d001602681510af34e490248026b0481b03cc98d8482e230b09233e9c","size":141,"data":"","first_seen":"2025-10-08T20:57:16.032454Z","last_seen":"2026-04-04T12:25:15.302611Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"12a319f0c4d6e82b25b1b4323433aac6","sha1":"0eef446bd3666c56638b50490073321b71993f14","sha256":"91335efc82120eb3c470892b6d84931733b79982d76ce1b7845005cb4e20a60c","sha512":"cdb6d106b9f5bc001b4d9284971b279af5a20c99fbecfd1123a0c61f6c7a1a5b43f624d47a0311689741dd1d26305fb7e74875451352e9811607398def5403a2","ssdeep":"","tlshash":"6cc08cc8a0c22e101a02641410bf29e4a024402774481b038c94d8983e220b08233e98","size":141,"data":"","first_seen":"2025-10-08T20:57:16.065059Z","last_seen":"2025-12-30T20:38:26.693265Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/assets/index-DtgRzBWv.js","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"c8faa46b51d4237b4f93507979a256eb","sha1":"0c92bc6c20a550d1fa126d22244b05cd49a59290","sha256":"281c1806e3b390a22fce97e9d6d2591119b6ed2152ee02f2c7275bea5e0a4301","sha512":"4e09d300a7a5f61d185fd186e85e3b86c98b68c67753d2da955074229f466a004c9877d8f84ccd9cea194311c9aa83b836d017df1f44ea945c01b5ddbd72061e","ssdeep":"3072:K+dUJel4DWp4wKxpSUGMRw0VnH87cSJ9JaQHsj+LaHrVRrqlumlIv5xK7Ary:K3wl4Da4bLzVnHtM0rqlBIvW7p","tlshash":"b9344be63185b43243aa19e2507f3505b3391e54780ad4ccf06ca9db3d7aa8a52f7f6c","size":243453,"data":"","first_seen":"2025-11-08T03:51:02.050587Z","last_seen":"2025-12-07T03:25:24.511551Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"4cf08bfede2781e15cb16237e6ffb65a","sha1":"ed9f91cdf733a5c9aa55a1fd7105bc0aeaad2aa0","sha256":"617932f9f494a16f2e9a9683f281b0894c0e21f0c0afa01705acba12d8d6ac40","sha512":"ed4aa98ce72cf10df26e46477632e4b2dc9e390acc0a63018c2eb4d874d6396b8946b5aa44deb0ae3e2e3b1b2ba86d8f71ea18aa98b374d71ccac0c0cf5aae3e","ssdeep":"","tlshash":"3dc08cc5b0cb6d202602641014bf29e490244026744c1f12cc94d8882e630b48233e98","size":143,"data":"","first_seen":"2025-10-08T20:57:16.042101Z","last_seen":"2025-12-07T03:25:24.921395Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"140660152b8bfd2c5f5b9e901aed3e18","sha1":"e6a1fbaca9fb5e252c7a2f52ecc4322b5ae13b68","sha256":"8ec2970505484b40472532bec668c946605b3ccf02f9c13306a585493c6b5bfc","sha512":"12ddc615706626afae7ffb70a3c06fa6c9172562b1f061fc8d2f6bdff2c1299987a7637665229161e52c213a6696ea370cb37871b17fddc2b091533b5018f383","ssdeep":"","tlshash":"8fc08cc4a0c62d001602681010af34e49038802675489b12cda9d8482e220b08237e9c","size":140,"data":"","first_seen":"2025-10-08T20:57:16.069613Z","last_seen":"2026-04-20T19:54:01.649978Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"7b6707b43725da3870844f3d181c0692","sha1":"0e0eaf891bc75131b50914b5e51fcde68548cfa6","sha256":"cfd2811a79c223699cd343f4fc9cc8a6e34a672fd5160e8d5f81a4139f4be352","sha512":"6cd6c7e0ce014669fac2a0de9a4b484295956280f22b25f74a7433051f616657d6a7e422d0644b10ef8f12eec4050a4d641e077718db153fb11050e42b3df9c3","ssdeep":"","tlshash":"13c08cc4a0c23e001602651120bf28e9a028403674481b029ca4d8992e260b08237e98","size":143,"data":"","first_seen":"2025-10-08T20:57:16.081072Z","last_seen":"2025-12-07T03:25:24.917962Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"3d5272693eb411e5b8b13a243f76c720","sha1":"6a586ab8e0a4bf12bbc60eea6ca9f2418625a22c","sha256":"9582f31f9eb892b8823a780e579d464d54e26d97d65dc327d2b2bdd92d47c4b8","sha512":"03fc5614f48fc9a2e3c4a30626fdbacde74c1fda09ffa9d1cde0393d31cd5fe1588e270c241f4cedb473c6e5cc224ff16c141468a29519ea6159accf3e3a18f1","ssdeep":"","tlshash":"a4c08c8350e2080c8210861b848880050b8808b04f9308a22cd85b7ecc9ae88c8f804c","size":148,"data":"","first_seen":"2023-03-07T01:10:06Z","last_seen":"2026-06-07T08:18:02.151537Z","times_seen":15899,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"9c29d718419785022b347378791e4192.5qt6u.sbs:8001/apple-touch-icon.png","fqdn":"9c29d718419785022b347378791e4192.5qt6u.sbs","domain":"5qt6u.sbs","tld":"sbs"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:16.496Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: 9c29d718419785022b347378791e4192.5qt6u.sbs:8001\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T00:57:15.584388Z","times_seen":17827927,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/br.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.508Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/br.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:19 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-1f10\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726439=QLHfXzQcHU+/W9e8VZSSf0g70ZVVR3gGzGwwje9rBHVHza7Yt8wgF7B4H3StKTb5UUbJpmoUOvvq5sygHT45oSjYCEFP9Bv58IrLsh63Oc4/vMSbLNGWDi1m7j9FyJDIR37k9WK9e0JgHkfFZBg1+ZSbskFnMoTPZdqOPihUCE8ZxgQ772H2IN8bRUfDkHPj\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 20D9B568-B54A-44C2-B60E-1E65A1CE80EA\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7952,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d84438fc3d3fd74e711971f3c2050e8e","sha1":"91f4ebe7d8c83a80221d48549328a0bfb8ae4d93","sha256":"6196be18e8a519343d49c29a87cf9a7f0c96dc50477b3c5849240e4ae57b9cc5","sha512":"5fc1646d2830cd71ffb5a846ddd50de9ebddab3b0ed31d5d9749b3bbcf0ccebc8895e82d06e3d56ad1af03b4add8bd1a2879ccdb80a9791e621c0fd96dcbff4d","ssdeep":"96:2/OoMSBUOat6xhf5WsJsRU7md0p39bgW8w0zdYsJn4d0C/zWLMpTRa4g:22oMSqOait5WsJsvUnU4d0qppFad","tlshash":"b6f169bc862cd2fd9ea696bc9f2ad0f0920eb1adb0e9c351976cc17031935c9e14f855","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.854053Z","times_seen":109,"resource_available":false,"data":null}},"time_used":1923,"timings":{"blocked":1605,"dns":0,"connect":0,"send":0,"wait":318,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/er.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.624Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/er.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:21 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-c63\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726441=JHGeMlqLy0gB5ak0wqadFpXGs3jM0Lo0M6zpM+XNz231JxpbP0A40EIy6YAGOKWCUUKvhgxieDl2ZDNrB4enQOS9H/6MwGnh5UiaeNYNMLt++1i3qhK7sfzsnGPa7MewtPpo89eienZJybDLK4IakcYHNlxcLcw8BoCYNUG75GMW74KuNPfLYIP7Dw0B494o\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 724D392B-2BDA-4918-AE72-274CB75DDB3B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3171,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"39d5e7faad3ff46a5d3e82289fb47d99","sha1":"5a15db6d03e6b92f65b7ab674ef0b7aebba77906","sha256":"22833fd8f1ebeab4a2fa3d737d189a5bb615c649f9140e7784b7581e6d64cf98","sha512":"bc0ebd1bccf418a63fbf6740719b3adf94430402765c1908e3ec9e35fba00a2936cad18936c4916b96dd320c34457100fa8fb301190ac93c859f70a5a3a2ab62","ssdeep":"","tlshash":"a451f069d394e3b8ed9283f04a35b4b0aa9e967ea0e0d70956fdc0f072164d8d39dc91","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.893498Z","times_seen":108,"resource_available":false,"data":null}},"time_used":3785,"timings":{"blocked":3469,"dns":0,"connect":0,"send":0,"wait":316,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ir.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.722Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ir.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-36b8\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 4DECF041-463D-4BCE-8062-360646CE7E3C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14008,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"152c66cf01196ff2ae089101c3ada6b7","sha1":"8e5e3f21c1c8b4dbba42fab1e3b4b8330ebdde89","sha256":"1548fc5d8eb7f45e956cfd55a956f4b1592fa47803050ef5338804e4a1f203c1","sha512":"ea93eb5b224ed00e3b8fd61003512c0a49e826830cec60c7b7e44b4ca05ebb43c78ea0f4c7c7f0efdbf9df9e417cd08f73012ba91a8a5a2276f81bd87adea661","ssdeep":"384:Mx8ktMHBeBYyWuqhdWNiLmhcLaN/xpjejNvT36RGVL:Mx8ktMHBeBYyzqhdWNiLmhcLaN/xpjej","tlshash":"d6523835b3286675582247f647de573820ee36ef7504a28be6582301213cbfdd8ad6ce","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.886661Z","times_seen":245,"resource_available":false,"data":null}},"time_used":5192,"timings":{"blocked":4758,"dns":0,"connect":0,"send":0,"wait":434,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/mg.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.778Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/mg.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 276\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-114\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 70E9E68C-2023-420B-A864-829B158CEA86\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":276,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"074e275f43789d9d6f47b19c5e5bbf8a","sha1":"0981d87cf153f4a9c3df914aa567d4c7d4c6778e","sha256":"4626307f723e60de2811328eea868eb0c7eb78b71c818e25da8fb860f11f0fba","sha512":"6ff19125fd818c6dbb5284d0704d332bd22b565f744812a64cc6beb3db930d25433e677663a56f131d69e6b275dd1693ffb47953eb23a97c5977dc3575d44110","ssdeep":"","tlshash":"4fd02b65853a2854150942b4c75d3cf120fa34ac608405cbf0b01050230d7df3c939d5","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.907764Z","times_seen":224,"resource_available":false,"data":null}},"time_used":6459,"timings":{"blocked":6152,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/cd.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.579Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/cd.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 335\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-14f\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 0918A433-22F0-4A95-ADD6-754E8F232730\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":335,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fa9cbb33563810f50a69e44f2d07dc80","sha1":"29ad75a25712e57d6ccc6714dd0c26b533f38675","sha256":"6552e907bb6a7a2ef2be2cb001601a1bbe35544d4962ead285afd2799029a104","sha512":"c6ad47228886960f0e87d30bc0d3adc7bbb2ce6c426e1804b1072b2dbd2f60c3b2541fbef39da5d92a204513ad7c9ca24aeec05bd7ec481640507cc2b9b8b4a7","ssdeep":"","tlshash":"67e02684a22e55781517063647a8b5814aae70ddf10806fcacf72b212120bdfa8a3870","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.874984Z","times_seen":228,"resource_available":false,"data":null}},"time_used":2933,"timings":{"blocked":2621,"dns":0,"connect":0,"send":0,"wait":312,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/gq.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.621Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/gq.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:21 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-13cb\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726441=JHGeMlqLy0gB5ak0wqadFpXGs3jM0Lo0M6zpM+XNz231JxpbP0A40EIy6YAGOKWCUUKvhgxieDl2ZDNrB4enQOS9H/6MwGnh5UiaeNYNMLt++1i3qhK7sfzsnGPa7MewtPpo89eienZJybDLK4IakcYHNlxcLcw8BoCYNUG75GMW74KuNPfLYIP7Dw0B494o\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: B44C93AC-2F6B-425F-BE1A-39CA1AD80281\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5067,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3e39d590bc5fa7d5bc15c63b87a275bd","sha1":"e9c57aab19b00ce905a483c5b30a760e7a2586c4","sha256":"db43429e77e5d6e34cf04f07af5c0f2eae54d944ac66775eb0adf243d968d1a8","sha512":"7c0d005939fbf8285a96999246ac5c48f798ed33f07f61031ee19de05e2f9463982935664aaab38b5fe1ff6782d5285072623ea8b9815c9491a901def2677da0","ssdeep":"96:35gbBj8jDdKDWITUJf3fUCjdR223g65YMsd9SnssW1fgzYdwoR2:JE18jDdub+vUCjb2hMm9S1WyE0","tlshash":"8aa1dfacc658e2f92d67dbbcdf7e62a1a14de0cbd5e9c305a244d53032a11cee04f846","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.782327Z","times_seen":110,"resource_available":false,"data":null}},"time_used":3752,"timings":{"blocked":3418,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ee.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.627Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ee.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:21 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 295\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-127\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726441=JHGeMlqLy0gB5ak0wqadFpXGs3jM0Lo0M6zpM+XNz231JxpbP0A40EIy6YAGOKWCUUKvhgxieDl2ZDNrB4enQOS9H/6MwGnh5UiaeNYNMLt++1i3qhK7sfzsnGPa7MewtPpo89eienZJybDLK4IakcYHNlxcLcw8BoCYNUG75GMW74KuNPfLYIP7Dw0B494o\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 8E8A0DF6-4FF0-4B79-963A-EE9D6BA7E031\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":295,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"33bfc43ffead8fe0ad05b6cfe0d7d2b5","sha1":"532a158b9c6307dc239814b9df13d9b5b41d8565","sha256":"d9f0ae29d1c4f2cf8e4fe9ea4241cc48323efce872d3ffe618be7a682dbe5489","sha512":"0589ab76c0b5a85395f692fea2ce6d723307e88f7fde60b407f54b978a8ce423dc78d0cbd770f99623fd65d7d7c768414f203882979e993116c46858cd66c34a","ssdeep":"","tlshash":"46e07264422dbc084300413dc3e869a1123bb00e6b990088b4a03216228c9a3bcf8b2f","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.811927Z","times_seen":230,"resource_available":false,"data":null}},"time_used":3909,"timings":{"blocked":3486,"dns":0,"connect":0,"send":0,"wait":423,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/gr.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.667Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/gr.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 820\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-334\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 94B624E7-5013-48EA-974C-47E36E3C0162\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":820,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9e5fc0c0ece0f33844a5fdf5b2b4a50c","sha1":"0a34648f2d2c55f024e24a6012ffd5b73a3a2db3","sha256":"91b8feb4c319a41386a2d039ccecf86c456412772623e2bbf1753bdd397b9328","sha512":"99401403839c9ed5811f41087344bbcef897283e40d5247310f7b4254f95d41c38bcce12acecebe94f1cf949212d0dd289cfa5a23c1fb47377561e6303afb5d3","ssdeep":"","tlshash":"e9016de5552cb8540d4a037ccbac72d3d0b3a4cd600c45ddf9b42579364d7bfac88aa2","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-08-10T18:48:37.662398Z","times_seen":229,"resource_available":false,"data":null}},"time_used":4613,"timings":{"blocked":4160,"dns":0,"connect":0,"send":0,"wait":453,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/gn.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/gn.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 269\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-10d\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: B04845D5-CFFA-4713-A102-C1EDC95BF07C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":269,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cb017cb559382ae9d22c6f1260028209","sha1":"2016c1d13523a446013e39d690375477de342524","sha256":"52446710b8cc391168599e29562004b1fc0f0b3690de6c035ea11b3973ca6cb1","sha512":"3b71c34ff09d72832bcf372d86e65e55f9a3a9443c7b1da3f871b7ef5a5a6d4e3287bcebe5e30bacbd46deea713e9929103d308145f96898a97010fa528ebd1b","ssdeep":"","tlshash":"5fd09565833d64141709c738576c39e559f630b4604810cdf4d01150330c3af6cc39f8","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.923227Z","times_seen":230,"resource_available":false,"data":null}},"time_used":4657,"timings":{"blocked":4233,"dns":0,"connect":0,"send":0,"wait":424,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ls.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.769Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ls.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:23 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-4a9\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726443=I4674F6+qGthWbm4v3Tt0iNbk3z6+po3UlqQ2MaISR5nR2xgr5MqYkIFQwdSOmaKQbq1BcSDP/84sx/DiinN0x7TrBe7BNmVVDYIU5FRdHsNlW74GjU/fuv8I2g3NyT+ijVjk+QCSxrC2nJRjJe6Um3OQ2z4lS0yfuytGceq6oqL+9hqJ65LMguuPQhCaKAr\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: F6E871EC-D547-4372-B772-56645C075C33\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1193,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"51bff392acd001230ada918efc29f1aa","sha1":"32fc83b6080ef050d0ec59070df781bd1aaaa801","sha256":"b8518393c074bf61c866dd9d81dd17f32f3328b4399909172b070f2a509917b1","sha512":"eb549de77a7d252cf348bd9342ceef07464823527c3b26731b0271f3583aa0726641a90766cd7a37dbdddc7a9025c1cf740afa1faad57e4fec3b6962d8339ed5","ssdeep":"","tlshash":"3821fe81c360f3b4de636fb8db1131f0a08f3169e2a5929a526c807473142dbdaed8c5","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.936991Z","times_seen":109,"resource_available":false,"data":null}},"time_used":6084,"timings":{"blocked":5749,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ne.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.805Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ne.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 259\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-103\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 03DF4DA9-47FA-4E1B-B57C-457F0578A858\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":259,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fba70678c3fb8b1a2b737d7f214b8861","sha1":"313965995dd364b4dd7fdb04695ebc64d6477c51","sha256":"bcf78c3c37a01c2663d63a5c182616eec768bd98e6a568a7d9bf3b307b1de168","sha512":"098c9ed588dca9848a3a7e64e09b58aa2081bc0b32772df1d43731b3643f9d8db85dd33806ff14b19a248efde15c6af97506138aceef737558c4b06ccf9983ea","ssdeep":"","tlshash":"5fd05ba6517974449b09c2b11a5e36d3c1eaf0cd725c03ddb8900455324d2af7cc5610","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.800976Z","times_seen":227,"resource_available":false,"data":null}},"time_used":8013,"timings":{"blocked":7589,"dns":0,"connect":0,"send":0,"wait":424,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/assets/icon_service-BhveKycS.png","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.361Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /assets/icon_service-BhveKycS.png HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:17 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Thu, 06 Nov 2025 05:25:21 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"690c3141-10c6\"\r\nExpires: Fri, 02 Jan 2026 01:47:17 GMT\r\nCache-Control: max-age=2592000\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726437=LQku4o/SnmHfqPhRUlKy429dZqXOiNSeVmzGEaAhs5aJ8K5DOwu4623no8Znj4Sno8cFlmRH1nXTof7eCehL2VDWrvRACwFRuXYqkgJ55Z3zlc4foh+4eqPcc++qP7/VQrMo3q+QQaV/6764kvf3+8hwMcM7iqdZT8vPF7GaiI0CeKj5TyMcj8xwf9/ixwMY\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 2E64028E-5F7D-47FD-AC26-CBE3439FD0D7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4294,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 114 x 114, 8-bit colormap, non-interlaced","md5":"573fdc326ac5dfccbe504cde6ad1790d","sha1":"16eb6adb5708dd9a4071c27d2273c203c8d88043","sha256":"39c863dfbfb51a0362a46de973e0aa3c3b7a7f6090c4a14856c1faa26a6a70bc","sha512":"2b078b0e9cd86f62ce29290e50778ded150c67b99d3263d3373687ef3de7232d08eb5b8d7fc406ce1795ab6bfa5ced7c1481930c52b0d1408db03e0b19cef66a","ssdeep":"96:ZoVYoAqv+lVvLKCWjncW3LaWTsA9pCwUYBvTdT9Oil2/Uv65:sYXw+vvOLjJ3LRIAXUYRFDv65","tlshash":"e7916da39bdecf3ae95a91b2f312470884b0f233917f869b445849474c66c1fc87980b","first_seen":"2025-10-08T20:57:15.911973Z","last_seen":"2025-12-07T03:25:24.769082Z","times_seen":11,"resource_available":false,"data":null}},"time_used":308,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/bf.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.520Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/bf.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:19 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 330\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-14a\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726439=QLHfXzQcHU+/W9e8VZSSf0g70ZVVR3gGzGwwje9rBHVHza7Yt8wgF7B4H3StKTb5UUbJpmoUOvvq5sygHT45oSjYCEFP9Bv58IrLsh63Oc4/vMSbLNGWDi1m7j9FyJDIR37k9WK9e0JgHkfFZBg1+ZSbskFnMoTPZdqOPihUCE8ZxgQ772H2IN8bRUfDkHPj\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 6CF66C26-FEBB-4C44-B76E-A7F0A6280026\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":330,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6f4be314b69c46b786f95dec235ef3bf","sha1":"fd681d8338dddd9dbfb648f2af3ffb35a4896aa4","sha256":"2e63b1ff3fd235ebbdc4b4f9677fae569acbba329d95c19fdc4d76569523c0e3","sha512":"be212b7a84467089a5857a6d39abfc2f11ef4a4727527c43029d05701b7785b0ccafd12f73465c37e57c652eb355bed72539e9d812ddece10eb2573dda03172f","ssdeep":"","tlshash":"eee026a66b79281dec49c77a8f9cb0c9426a748d500404ccf5f015343155affb8ca9a5","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.957077Z","times_seen":234,"resource_available":false,"data":null}},"time_used":2199,"timings":{"blocked":1889,"dns":0,"connect":0,"send":0,"wait":310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/nr.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.800Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/nr.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 595\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-253\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 656863CA-8AEF-4649-83A8-CE46E1EDF90A\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":595,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2a4b8df8a8fb55af68af77b30746e4fd","sha1":"c32388bf339e0923f447b1873c7a7b3ae78b52a4","sha256":"d576480467c6aba9f1fc8cb05780c174585cab7666b396eb789e613e6aa71440","sha512":"9885b1b5471d1beec12c9094c64e00d1d7fa38838a0a90f2dcdf78a6c274a6f339d13d50fed9728332b6eaec8d579c2d3d21ec69feea18fde0d91e846106831a","ssdeep":"","tlshash":"0af0ac6360b5d1e45b194b7feb7834c20caf331ea046028cb0d01e2c11bd55a53d8ad1","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.860217Z","times_seen":225,"resource_available":false,"data":null}},"time_used":7824,"timings":{"blocked":7399,"dns":0,"connect":0,"send":0,"wait":425,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ws.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.843Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ws.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 664\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-298\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: ABA0BCB8-8BCE-4871-954C-30BAF05CB907\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":664,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7ee294e00c323dee0618f7b79ecb3c24","sha1":"7cdb5b06f24821f6c84c7162db62072d90852d48","sha256":"cbd7963d3168914c705915816faad6b5623d320e92e969164528a12a8435e846","sha512":"7c526ba595f11968cf5e819bba698d5b901e201ee3543e529e2fd41441130d71120730c539b4a296182299adfc550ddaa2650c29254f170426a7abccd0072cc4","ssdeep":"","tlshash":"33012df0d160e934ac8a13b0d338b9f260bf105fc0d2978650b440e4b22aad31c8cce4","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.7486Z","times_seen":226,"resource_available":false,"data":null}},"time_used":9381,"timings":{"blocked":8930,"dns":0,"connect":0,"send":0,"wait":451,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/sn.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.847Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/sn.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 395\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-18b\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 788B3A94-1D5C-428E-BD35-B391AB93E495\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":395,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"01244441b09003e578e148e0761b7a34","sha1":"6e938067ee027f78f8e6fc6ffb22de0f762fe633","sha256":"10e504398b5af89eaf3bc2d73daa4d0bf44a74713cba9bc1c5e1a9c3b2eb4882","sha512":"2c6b0e37ad130f35221123d9d5f28f47e981cde24d52c7c9125d2bce546577783a2850454c8fbf77405adc7a6ad354a92833af9250656c2ae46bc2e82c809328","ssdeep":"","tlshash":"a0e0615992ba64940604c7fa477cb5e575ef30a8504545cdf4c03164330dbbf28c7ee4","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.836829Z","times_seen":227,"resource_available":false,"data":null}},"time_used":9360,"timings":{"blocked":9052,"dns":0,"connect":0,"send":0,"wait":307,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/za.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.856Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/za.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 780\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-30c\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 06AA4CFF-490F-4299-993C-1A6451296F64\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":780,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d6fdeb9091d789e9cdc70277bec8b248","sha1":"67dcdea82461c91f905d6e5da91ac847538e4d1a","sha256":"355d99fe9f372e181ff2699af8f2a389abfb8e3e17b99ca12a8879960b06e5d4","sha512":"3c1ce764462cdd14a4ca71bb83bb0f4ff06b5ac0bcc0a6ae9474a0255c956213a3fc7b08f96e9ec6f432d66c3890f0ef7ca28f7f3f20ef144b86c46626ec5814","ssdeep":"","tlshash":"4901fda2a1b66a8c4d4947f4cfa864c450bf30cd858c0bdcb0f420269d4c3efa4d6b94","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.80276Z","times_seen":225,"resource_available":false,"data":null}},"time_used":10125,"timings":{"blocked":9687,"dns":0,"connect":0,"send":0,"wait":438,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/se.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.863Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/se.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:28 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 205\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-cd\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726448=scd548NbFsDlriR0p8lcpUSKGtPYT/fhUWpMVJoPGmWaQsF6U2I4BLnmRc69+bG+K/nZb5Nxfo6gYAUxm5/nVRo3rZ9J/GkSGOnre0pGmz3P/71ZNnUJKWEajfGx+N9q7mMdvR0KEp7aCj0WGUT104FuneAtUScTjVMzQbAizsq6TW7mypX6QZoLYJ3c+43j\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 4A41DD24-9FD1-4E66-A3F1-2D4587466B25\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":205,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ed7cce0b817a6d982353556692d07c72","sha1":"d6fd277df40e71c58887cbb7544a9e1ed5c406d5","sha256":"326d8c385607d9181420613bc771f76d6a96c8d96d1788b4767fbf3ac40be681","sha512":"82c763f3280a4de35f674dcc89cdd425738de3f14aa54f500143072f5a1cd9dfcba2ed70b7fec916bd3fa1cf388ec04f5a29e76e1fcd21754c5af144f1fe8a48","ssdeep":"","tlshash":"fed0239dd43dad54055486114e743dc941ea50c5608400fdb4d405151155fff7cc2570","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-08-10T18:48:37.60168Z","times_seen":231,"resource_available":false,"data":null}},"time_used":10469,"timings":{"blocked":10045,"dns":0,"connect":0,"send":0,"wait":424,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/to.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.873Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/to.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:28 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 310\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-136\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726448=scd548NbFsDlriR0p8lcpUSKGtPYT/fhUWpMVJoPGmWaQsF6U2I4BLnmRc69+bG+K/nZb5Nxfo6gYAUxm5/nVRo3rZ9J/GkSGOnre0pGmz3P/71ZNnUJKWEajfGx+N9q7mMdvR0KEp7aCj0WGUT104FuneAtUScTjVMzQbAizsq6TW7mypX6QZoLYJ3c+43j\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 32354E08-B5BC-46AF-A155-80B7BB0E09B1\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":310,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1ddfe3ef7d3b3e03876ea1ffa7a6a21b","sha1":"991d2399e6fec165a19031b165cab72a8586ef00","sha256":"265ff565379075453d36c328aac36c58320216f06596acacb05380d6a5ba5d94","sha512":"df01a3f1ec3324394039fdca773fc1c9aeb8683d3192e2156a18c2cf33fa98aa940c697161ee83823d178993a56d815a208229fb9ecbafadb8725cce02cd1c28","ssdeep":"","tlshash":"f3e0cdd951686a186d1d83b4cfec36d640b9705be08d14c8b9912122250d7ff7cf5d95","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.962878Z","times_seen":225,"resource_available":false,"data":null}},"time_used":10993,"timings":{"blocked":10684,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/kh.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.524Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/kh.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:19 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-1b16\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726439=QLHfXzQcHU+/W9e8VZSSf0g70ZVVR3gGzGwwje9rBHVHza7Yt8wgF7B4H3StKTb5UUbJpmoUOvvq5sygHT45oSjYCEFP9Bv58IrLsh63Oc4/vMSbLNGWDi1m7j9FyJDIR37k9WK9e0JgHkfFZBg1+ZSbskFnMoTPZdqOPihUCE8ZxgQ772H2IN8bRUfDkHPj\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 8F758DDD-EDAB-4BEA-AD31-19E6923D2432\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6934,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"91021ed0ae9958bbc698fa7a5d733311","sha1":"6d82c8d3083ac306b6dc80ac035f444034f3daaa","sha256":"0bc0c14090d6aec2e3e43d1bfd088d27bf4f347132764e4af352d822afbc257e","sha512":"f0e65819fbfcc619ad012086856c18c7d7cbaab3de346fbdf990acfe7d55d1122fc0913bc8f308da84da2520629f84af4451a45db408a7db491359a57aa0ea5e","ssdeep":"96:+9euAXG540WF4PG+JjE58eAfAQu41UF0Qmc9szJd5RXEH1tZCyKUd:W54vqpJWBQuuUF0QWPXEH/ZVKUd","tlshash":"1ee1231cc264f06ccc2b8fbcdf6e90b4c0ded1ea50c4c396d659927022251edf69e994","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.806648Z","times_seen":110,"resource_available":false,"data":null}},"time_used":2363,"timings":{"blocked":1930,"dns":0,"connect":0,"send":0,"wait":433,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ht.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.699Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ht.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-3749\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: E8AA830B-70A7-490E-84C4-695052649284\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14153,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"93e0666959e1db9eb6e46fc73a1b3e6a","sha1":"2af473da42c7a7ab3a6b85f3ed981a569ce48183","sha256":"1412de0169eb86ec879a9d0890b417800d30ad2e252076b2400cb2ba553cc005","sha512":"6b54eeec2418f3b62280092211a7015fa41f74352dceb5f2e5afec5e5430ea6ba840ce1c1066aa1985142c1755ffd2be76c3b599e55a9a7eb3fb0fbcc343a2c2","ssdeep":"192:0n34UZTkbBKxJKfkL+1rozCd0f6E68mX1W8fL5e3QPHZ/0L:0nhZqnfMrzXfTmVo2I","tlshash":"4352df3c4668e3bc9d42c3bcdf79e0b4a14eb0d9d1ab83486559827022d35cef1af995","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.773111Z","times_seen":244,"resource_available":false,"data":null}},"time_used":4781,"timings":{"blocked":4464,"dns":0,"connect":0,"send":0,"wait":317,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/mw.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.779Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/mw.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-e53\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 2ADE453B-6689-4311-A545-3F16F7550FB7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3667,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e597bb9ea33fa2cafe1b365fcd6a17d0","sha1":"61b92946200136821962223c1121cb9b2ebf38b1","sha256":"1dbe390a572a838456f3c57156af5e39c783ac16c4e9b984605d6d690d135b5b","sha512":"33b1b0c1b4a6a2a1067ecf9542a24971d3e0428ff9a475952bb756c145eeae1b1e627e0f54fb1f2eda2f104d60960d2e89f24a4bd2c93593ee5c54a56bd4ceb8","ssdeep":"","tlshash":"ed71ca3c96ac92bddc63cab8eb7261b1d68e80ad30f5c365835dc57031921edf65b881","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.931581Z","times_seen":109,"resource_available":false,"data":null}},"time_used":6726,"timings":{"blocked":6291,"dns":0,"connect":0,"send":0,"wait":435,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ma.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.797Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ma.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 239\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-ef\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: A9861280-B79D-42D3-9AA8-DC9DD277E779\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":239,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fbc96b8d8ab94d0ab93d43cc82a32a0c","sha1":"9ae321751348ee554dfb22a231700f4997c32664","sha256":"f3056f9a88978f102e5f9c0acf72735fde7cede6118c90e773141a108c52881a","sha512":"9734ed2010b1641c4a5119d87af2558ed35feab262b2b261ba15a365ff04243a372d37c6c4b7a353ee41ca7c362939047060605d517af1ca723cd7bb33e52f32","ssdeep":"","tlshash":"cbd0978583bcbc05569082a0aeac31e011bf1080224c01ecdcf1343172046cfb8e75a8","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.773669Z","times_seen":223,"resource_available":false,"data":null}},"time_used":7402,"timings":{"blocked":7093,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/tr.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.876Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/tr.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:28 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 522\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-20a\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726448=scd548NbFsDlriR0p8lcpUSKGtPYT/fhUWpMVJoPGmWaQsF6U2I4BLnmRc69+bG+K/nZb5Nxfo6gYAUxm5/nVRo3rZ9J/GkSGOnre0pGmz3P/71ZNnUJKWEajfGx+N9q7mMdvR0KEp7aCj0WGUT104FuneAtUScTjVMzQbAizsq6TW7mypX6QZoLYJ3c+43j\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 829F2B26-BC31-4813-90AD-A5275BB2F40E\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":522,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"74f2fcab46239afe8a5187a6788c4c84","sha1":"8285cd35970d429e679a6a9ff6072992e6076035","sha256":"5cd3569e722cfc5f8d92dfe0fc98c450d577100edc003ba43e258da2596a6499","sha512":"f2072c39eb811932fe9f1e2e9fa8c2d552b7392217b3c9c2bc2e7ebf2e29c24945de9df19f85df8b999fbfbd3d251bdea91b2cf4e44a634f76202d2c5aa197d5","ssdeep":"","tlshash":"c7f05096617c96b44b1d53ffa37c54d1505a399c049b11acf0b3007079746bafa84cc5","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-08-10T18:48:37.661165Z","times_seen":235,"resource_available":false,"data":null}},"time_used":11175,"timings":{"blocked":10756,"dns":0,"connect":0,"send":0,"wait":419,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ae.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.883Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ae.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:29 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 237\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-ed\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726449=vpeLL07hSueq0AZCW6GeZzDzGXWNqgbHdB/f9gPaWa5wNt3jaQKShVLZJ3pCKPgDVau5/AM3hUP0wq5SjFAkOc6CuqQCVF38P64YVQmqr4RgNwtd4wSSZrqQ+faVlTTccpGqvwWY0z09ahWFehlg/sZF4asfYvoTSYjCKHs880Ypey29i+bTJXY1/7lnEDNX\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 2FCA1CAB-E477-4BDD-9ED4-56AC73986F79\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":237,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c75a64404d1c79674cd039f779c5b01b","sha1":"bc1e591ca362d1fa086d3246e95fedad05a79f75","sha256":"961e46239a77ce93278cc89d872f33285254d43877e5cc3a93ad9b628d23b565","sha512":"3f57b9f49ef50c2bedb528abab7d4d20098be520791ef82579a2e9eb66852ce8485030aa4b481cb92918876cfdb09cec1de11a5bea32bd0287d9fd57759dceff","ssdeep":"","tlshash":"9ed0a7e8813979445505c7700f9c32e3c5ea20c6704c01cdf870156d124e2abfcdea50","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-04-10T22:06:57.005808Z","times_seen":231,"resource_available":false,"data":null}},"time_used":11594,"timings":{"blocked":11143,"dns":0,"connect":0,"send":0,"wait":451,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/zm.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.894Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/zm.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:29 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-14ea\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726449=vpeLL07hSueq0AZCW6GeZzDzGXWNqgbHdB/f9gPaWa5wNt3jaQKShVLZJ3pCKPgDVau5/AM3hUP0wq5SjFAkOc6CuqQCVF38P64YVQmqr4RgNwtd4wSSZrqQ+faVlTTccpGqvwWY0z09ahWFehlg/sZF4asfYvoTSYjCKHs880Ypey29i+bTJXY1/7lnEDNX\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 3A050B1C-9F74-44E1-AF34-4CDEF5E1E192\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5354,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"024fff450bad4aea323c7744c7c06c05","sha1":"741aa3830f35eaa66fd8f1ed79b6c6464aa242b7","sha256":"346516ab7c44488c4534961050cfe22cfcad958cf79c29842bdbad27c45176a1","sha512":"bbfaef8391698036261dcb19cdf22f5ee385ffd8d920da4b1da3d5461ad1736860c1a612bb52d236203e249021ac24f0b065459ab5247060cf07de9a9e527d84","ssdeep":"96:vJzmEgrhiAYllU28w9JpbpLUPgF2eHv1MbipM396nuo4K:YVrhiAy228wBFrYePmbiI9w","tlshash":"59b1f56de358d37ceda74bf8db2570b0a08ea69a81e883649179c5b033541dce29fcd4","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.877271Z","times_seen":110,"resource_available":false,"data":null}},"time_used":11938,"timings":{"blocked":11622,"dns":0,"connect":0,"send":0,"wait":316,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/lu.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.777Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/lu.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 214\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-d6\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 347FE060-AC2A-4C0A-B6A9-8A7FCF0C81B9\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":214,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cf1bffc1261f51c3de401acb9c1c638d","sha1":"bd08b4ca994f58d052fbe60674baeea479656694","sha256":"116142d553ec812f710b8f81c98bcb30c9c798674f690507adac7be9fdd539c8","sha512":"3cf1b2e1261fb4aae069703b542f834972a815cfc4aa3435297c49924deac525f65e3674defad97a58ec16965cd69c10df0b0d4b3f1b535b362a702fefb38802","ssdeep":"","tlshash":"8ad0c99991397d489a05ca715fa87ad281ee20ce608801dff8b0053a224a79bacd6e65","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-04-10T22:06:57.102825Z","times_seen":225,"resource_available":false,"data":null}},"time_used":6413,"timings":{"blocked":6076,"dns":0,"connect":0,"send":0,"wait":337,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/favicon.ico","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:16.506Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:16 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 4286\r\nConnection: keep-alive\r\nLast-Modified: Tue, 07 Oct 2025 15:25:27 GMT\r\nETag: \"68e530e7-10be\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726436=dWxekXApCOqnLmgC3rJO2Y4/2/juyi7Qa3S8JKotnF7LCHBePs3hj0nW6lImPnG/T0LAwOQiexmqKAIrYqkfTX8GcfdKtifLsnX2m3GOMPST4pUIScvNBQAZ6z/xjY0hh0q4qgY1I9NezFFTgRc0wfhZZpBd0CTRsfEycitA4hBflcP1dVWQsXYPf0HVK0Hc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 3D9C777D-BCCD-4FFD-A9CA-AB7192C0EF9E\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4286,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"26c9734c0f922e6ab57484d0b4e71e01","sha1":"b4a25d7c5867a24c03a6200ca5cf329e26ecb258","sha256":"9a91a2988c20fb71d3c98eb28a7e3ac6c49a2c856a850a03758795a2d39cc420","sha512":"d738723b3c2204da1bd4a7c0621806f39f68749d2db9cde09b48af4371ebfb63f83d0e70b056d41424d272ee0462bd9a247afe40f0a761bfa42bae6f88693896","ssdeep":"48:+HMFZzz1VSoulsWd7Cpd02ks2a6loO+E1B4EKtr/Lb5785:+sFZf7Soul7Cf0Js9xkQB157k","tlshash":"ef911712ea81d084fc479b325d3b5de1d7c7beb7ae30a609e9cdb47b5b731820409259","first_seen":"2025-10-08T21:10:05.890837Z","last_seen":"2025-12-07T03:25:24.488712Z","times_seen":18,"resource_available":false,"data":null}},"time_used":646,"timings":{"blocked":325,"dns":0,"connect":0,"send":0,"wait":320,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/et.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.630Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/et.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:21 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-48c\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726441=JHGeMlqLy0gB5ak0wqadFpXGs3jM0Lo0M6zpM+XNz231JxpbP0A40EIy6YAGOKWCUUKvhgxieDl2ZDNrB4enQOS9H/6MwGnh5UiaeNYNMLt++1i3qhK7sfzsnGPa7MewtPpo89eienZJybDLK4IakcYHNlxcLcw8BoCYNUG75GMW74KuNPfLYIP7Dw0B494o\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 06E54A83-1823-4AD0-9347-D33B9BC04D89\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1164,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c7498faef6688d801aa1d37ebdbe33bf","sha1":"159c8d4ba3d4836f03dffa5abc3b7fcdd225214f","sha256":"ff86c2f2dd8b8fe854588adede507461b66fd9be80b5d7050e1b468ba096c850","sha512":"b236969e86255c022ac4d31e5b0ed948d4d2a8e4eb5f354c3dbf8e0b998b70a790c8688f54cd17a09a6bea4b05bf1bced5673df84324c79a8b933ebef9af5a4d","ssdeep":"","tlshash":"ff217118e2f0d238dd9247f8c27abaf4109f718c508426ed70f094e571686cea28c1d6","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.888219Z","times_seen":108,"resource_available":false,"data":null}},"time_used":3947,"timings":{"blocked":3635,"dns":0,"connect":0,"send":0,"wait":312,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/is.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.711Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/is.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 469\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1d5\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 9A113A70-B1E2-4A00-81CB-E43A8508E778\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":469,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4778ebacb4b634756afb235aa941ac51","sha1":"51212243f92252abd295d533a1936233ae857735","sha256":"8b98a049885f7c76c63cb4b18d89cf3cb5b4489dabcd5659e3e377bc6f806398","sha512":"3ba5c3d6d4a1136bf19a8c3a8644ffe28c12cd9c54ed572326f00600bc1d79fac12e8a995d89f00782f36a397522c359a5fabb0c9746de4d2ea5e4d03d08b253","ssdeep":"","tlshash":"51f05ca153b552808f0943f4da6c36e155b630de554c00ddf8a8276a161dafb6dc22b5","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.836006Z","times_seen":225,"resource_available":false,"data":null}},"time_used":5037,"timings":{"blocked":4609,"dns":0,"connect":0,"send":0,"wait":428,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/pk.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.812Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/pk.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 671\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-29f\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: D85843F4-5F01-4D39-A735-BA952B641A0C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":671,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0b084cc386ca21b36fc1aa802afa8724","sha1":"f8354cfd2973d216577267841bc314a66b346695","sha256":"5c6794c2dba659f5d67c954d674f931acc2a1eef51193c1c03cd74ffb4913e2b","sha512":"cdfb50bff56f885bc765932fa708bc54f52672a9c55e500e27f65eedb05c55fcaf41904038419d0256f62bae3e3be77b66070bf32170d857d72d214d1c731638","ssdeep":"","tlshash":"b801fe2da57ca1bd0a1a0374c77cb4d1013f300c64431698348812317818aee65df955","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.924051Z","times_seen":228,"resource_available":false,"data":null}},"time_used":8210,"timings":{"blocked":7889,"dns":0,"connect":0,"send":0,"wait":321,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/pa.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.814Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/pa.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 682\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-2aa\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: F3510E24-F1B6-4232-9682-23B8F5F9B165\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":682,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"03f88324f388ad166b5402a69191b810","sha1":"f9e7ed8555e9c989498086f5430fa19d35d381b3","sha256":"b9179d222fea48477cb03031f72f1538a41c052f0c3a9b2bb8a96663f2297583","sha512":"99b57a5f68627d58c1ba26aeab72af5ad9789bd5af58d14560b373a35f2d114b7ea0782478f72790cf717a00e37461888bcfc496758b290f473f1b4e989627b6","ssdeep":"","tlshash":"0b019990a739a0f60f0a4378876cb1c650afb0dcd2480088b0d429397259bff6984bd1","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.880924Z","times_seen":225,"resource_available":false,"data":null}},"time_used":8314,"timings":{"blocked":8006,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/at.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.432Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/at.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 219\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-db\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 3BA807CC-95B0-4B79-B95E-A19E5D0D1F82\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":219,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3cf4d904014b6d88020b453cb79f6aff","sha1":"a57ddb64044772bf0ac00779f7255859bbff777f","sha256":"6d3d3273e3bf65f6021a1ade350268f39d5c7ef9348957a990b86f6bbaddb074","sha512":"3555a030092ffea0a9619e66857b7667f12084f37753c808944f76e8378f052cb209ab73b95bccf052c9078f3eb5bf6da05382f67db2442f7ef1b342fd419c87","ssdeep":"","tlshash":"0fd0a765576878182d1d5330ca58b1c114f53c58a00405defde0012521186ab6ccb991","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-04-10T22:06:57.035325Z","times_seen":231,"resource_available":false,"data":null}},"time_used":1122,"timings":{"blocked":814,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/bn.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.514Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/bn.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:19 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-376e\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726439=QLHfXzQcHU+/W9e8VZSSf0g70ZVVR3gGzGwwje9rBHVHza7Yt8wgF7B4H3StKTb5UUbJpmoUOvvq5sygHT45oSjYCEFP9Bv58IrLsh63Oc4/vMSbLNGWDi1m7j9FyJDIR37k9WK9e0JgHkfFZBg1+ZSbskFnMoTPZdqOPihUCE8ZxgQ772H2IN8bRUfDkHPj\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 727D7BEC-A25A-4BA3-A9CB-601695FEC63B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14190,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d25471e5778896a6bf19303d4f9f3a69","sha1":"c61ca6576f96b8c9a7d12845347808bf1a9f37f5","sha256":"72a88a9979e835e11bc6fd40ebd6c13369a8de46f36b81be7604f4c76fdb3cd4","sha512":"d61ed9843494cba6fd0685a92c5ec061949c7fc0b7b3c667abd2d247549b0e9fe443a0883ef8dad13829fc00ef6efc0fcc610b409358ac4c9b67daf16f2436d8","ssdeep":"384:6fhwnhKN3qQupIF1mzUKDqAdcCnYCN6mLWsQtZq0:o5fjAzUc8w5QJTV","tlshash":"6852cf7c8358d2bc9e57dabc9f3690b4924de1aae1e4c3518a6dc57027930c9e38fc58","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.82872Z","times_seen":244,"resource_available":false,"data":null}},"time_used":2238,"timings":{"blocked":1800,"dns":0,"connect":0,"send":0,"wait":437,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/dm.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.610Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/dm.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-3a03\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: BE44D03B-B6AD-4C98-B2C0-0FA893BDA459\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14851,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"286aafe66e116a6cfb0b5093729ef60b","sha1":"1e84115856ca424fbe11da51d8115a482aeec971","sha256":"df05d81c846d0d6afc5bb9358f0967a4e525960f16e2d369b46b554e3819384b","sha512":"fdae6450f934d3d7067b2af8c15d84a6aa59d391ec84a11029f4df3e8918c084e6f62536b663c183a95bb9e399f025e036fa5c6058cb43d3e917bed680c75360","ssdeep":"192:lpYQaS/1GH4H5YxWDpulJ/S1jH5loxWaBmxmVmsmimC7d1:jYQaL4ybK1jH5loxWaXn","tlshash":"33626280f55c5174ca1b0bbcc7db7af4841e6119e359439c713a40f82b386dfa4ba7a6","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.920612Z","times_seen":248,"resource_available":false,"data":null}},"time_used":3429,"timings":{"blocked":3095,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ga.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.647Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ga.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:21 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 248\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-f8\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726441=JHGeMlqLy0gB5ak0wqadFpXGs3jM0Lo0M6zpM+XNz231JxpbP0A40EIy6YAGOKWCUUKvhgxieDl2ZDNrB4enQOS9H/6MwGnh5UiaeNYNMLt++1i3qhK7sfzsnGPa7MewtPpo89eienZJybDLK4IakcYHNlxcLcw8BoCYNUG75GMW74KuNPfLYIP7Dw0B494o\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: E0F53E89-0175-469A-B021-8F1A59F10C98\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":248,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3c58965deede5821ae59935e7479b468","sha1":"898481c44c65932f529119cb73537f076ce7bbd1","sha256":"a20c4efd0ba3083de1136caa5aeddf5303f00563f4651aa597200b97b8802f4c","sha512":"a1db4d6abfcd0146e8e16377a8f076dc4d0a0ab793fd9549d8e506b6020b6ff48fe5a902a85a95994dfb306364e36843e6b3ad941ad715abb65e0b2c7b87947d","ssdeep":"","tlshash":"3dd02e6a6a2c3828281dc3708a8c72c192f63488a00401e9faa01534220c3efbcc39a4","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.928503Z","times_seen":225,"resource_available":false,"data":null}},"time_used":4193,"timings":{"blocked":3762,"dns":0,"connect":0,"send":0,"wait":431,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/mt.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.783Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/mt.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-2157\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: F2F49ADE-B6F2-4AAD-94BF-35B531D7CF3C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8535,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a90b4aac9743aae844ab4327839fffdb","sha1":"f208750619ae3da54aa73078471a177d9e494d5f","sha256":"3e2bb06ac35cab37aa6d6f2331455252e37586932ed9bdae7c4c1dfdbd3c4e31","sha512":"4d2a46ccd76ea7fa7f74002c93ef2d1db922704c0d980e014a12d4ce88cf0b0bed0a4dd1c8978efd9a3671b9b5e14642085bd671db02c734398310b69f8b3528","ssdeep":"96:v9pFGcwNGhrEMlfQAT9rGo5yLh/SjzuFSixXunFO1r3KDEryWpNisvUoDPx+phIM:l31wE+Ml5BzYxZFSmu81sEFvUO3M","tlshash":"6502fabc8628d6bc9c5bc7bcdf69a0b1520fb0d9b1e7c350a299c03021972dee15f586","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.753775Z","times_seen":110,"resource_available":false,"data":null}},"time_used":6747,"timings":{"blocked":6430,"dns":0,"connect":0,"send":0,"wait":316,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/np.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.802Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/np.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 956\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-3bc\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: C06C7799-5535-4194-A9CF-42FD6133A497\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":956,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f583f13da917989c68111e7c4fe2a798","sha1":"c770fcf7d2866b63b06e59c213fd2f952e81302b","sha256":"d548132a04931606f071675cff52835570259a3b26be794c7302c10f4ce401d8","sha512":"b33de5848e57c0d864f6fef537256d19660e3752d2859c4934c065f1d4efde0580754731bca92c7d8857edd175dd85d29069c0a16d60028dfc9ed2693025fc89","ssdeep":"","tlshash":"b5111028c379d2b4ed0787f0867039f4216f31a881984a9c69fc56b572150de42998e1","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.973984Z","times_seen":223,"resource_available":false,"data":null}},"time_used":7898,"timings":{"blocked":7461,"dns":0,"connect":0,"send":0,"wait":437,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/sd.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.859Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/sd.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 437\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1b5\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: DB5238BF-8D93-4F61-9947-C63B3638FBB8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":437,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"503fe3b4a2484bfb15de096bf3c1e12c","sha1":"a1a29cdcd9d4e77c6e661db0dae90d77b8654510","sha256":"cdd6072cede6c683d7a143b44679ae909b6732bff70fbc544ea01965d0356220","sha512":"2d151bc84268b60f34e8cad0e2a5b130a32197a200ee276310272c072fc729401f511a7dd181bd1ea1f3c2af558814c03a792656e82010b1c3659ca383d7b90b","ssdeep":"","tlshash":"20e0a39151bee4d81d4643b85fec35c741ae308f218901dcf460262d251d22f2cc1375","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.91196Z","times_seen":225,"resource_available":false,"data":null}},"time_used":10266,"timings":{"blocked":9816,"dns":0,"connect":0,"send":0,"wait":450,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/cy.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.592Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/cy.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-1718\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: A18107C3-AC47-4432-9AD8-658EC5712F8C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5912,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0cc4fae5fd4a78364370c73938e19c43","sha1":"25187bbf14b33db40261aafe6110105036e049a4","sha256":"d10e51cdba94c8a6b9d7371bfa80f0f9cef6d4522c07c116fe0a107d0e3e3638","sha512":"6e9f725ddb37bd55c7618c21ebb8815679efd46f21537ca30e394e114484e44dd913ff3bcbd082a731335165d22fb5ee20ac95fad9efb20d5feb5a681e714e5c","ssdeep":"96:+GnLEWc1Xej+tEq89HXWtAJZBBz1DUMeb3WF20a4NEe+kxp5FWHkD1MSC15ao5P3:BQ9/EVXzvMWIReEeTdFWHkZz2RD","tlshash":"d1c15b7c8a68d3bcdd96d6acaf76d0a8920ed09ad0e2c351c25dc43025d34d9e25f49a","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.79238Z","times_seen":110,"resource_available":false,"data":null}},"time_used":3236,"timings":{"blocked":2799,"dns":0,"connect":0,"send":0,"wait":437,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ge.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.658Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ge.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:21 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-544\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726441=JHGeMlqLy0gB5ak0wqadFpXGs3jM0Lo0M6zpM+XNz231JxpbP0A40EIy6YAGOKWCUUKvhgxieDl2ZDNrB4enQOS9H/6MwGnh5UiaeNYNMLt++1i3qhK7sfzsnGPa7MewtPpo89eienZJybDLK4IakcYHNlxcLcw8BoCYNUG75GMW74KuNPfLYIP7Dw0B494o\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: FB76BF6A-3769-4A9B-846C-C67BB3EF8616\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1348,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"bf17d28f796aa3164b9369706c74cf88","sha1":"c30f2b56362934a45c49a1bb25e73b5742356025","sha256":"4c068b71c64641f90a9587cd866583e91e0583c99a8a6304dc87173015b799e3","sha512":"5b2cbbeb1af12f50066f90a89c0f2ec6df6fa79862d528fef7574044c7374e9b4ba2d2c1c941e7fb92dea1bdee50f3f62c2e9e04e3dd401a8289cc76a5e78752","ssdeep":"","tlshash":"182194f8191513f4654e57308a5df77dbe92b87eaba3815291004c40b3a345bd8f7ae3","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.930333Z","times_seen":109,"resource_available":false,"data":null}},"time_used":4348,"timings":{"blocked":3920,"dns":0,"connect":0,"send":0,"wait":428,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/hu.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.707Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/hu.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 248\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-f8\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: AB7233C3-A35F-42DA-BB38-E6D2E1C1A62A\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":248,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8bd4a141988b7ed4633fd297d0c50250","sha1":"822caa1b9cfcec581bb85b27df818a5f3ef3b7bb","sha256":"0541657ad20ad0101351a0b93e6442b19fdcd45f4b20a0e26eb6932651a2a9b4","sha512":"882f665f0ca1903bf4d87a7f65bea8dfb69dbe31e6f61a831d50b4bee2f812882d5b1a0782a15dfe448f8a28d3b4a4ced6fb21cc42240633e19ac4b5b26a94e5","ssdeep":"","tlshash":"ebd05e66a628b82c6d2983718a9c61d199f634cca00406defee0153521587afbcc3995","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-08-10T18:48:37.607297Z","times_seen":224,"resource_available":false,"data":null}},"time_used":5024,"timings":{"blocked":4574,"dns":0,"connect":0,"send":0,"wait":450,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/pe.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.820Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/pe.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:26 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-11b75\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726446=ptucVn3RIg6hfG1GeWyp0AOoGEPAGvUxzyHSXVviuYCOqdey2OA73hpJTOX54tL2yISiTotdyN9pyxfwsajn2g0X54hFpCzrKsSaHVr5h70Mejg6ceFPn+LFJGC2CRvHpMAwSOEi8xEAaElkrPte2SNNVvoHXHWjyZywau+M/ET7sJheupgJLbbmcQTs3DWc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 8E8F8343-E080-4FBF-B4B4-AE240992740D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":72565,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"789db93ddc704254c8258e1ea264dade","sha1":"7aedc283567a3fdd71311152f3238099c7ecb248","sha256":"c36e0925c2ee1cbe2b0d8f26547447b290f2c2425bb9e8af693de92c09718fda","sha512":"dd46e6869862dd12eef65d19af2c404c01be76cfa12268b8a6772ded62541ec8ad30c7608f580fa5bf91e5da8b2474b03b56cdc289ffb5460e6b78e09dd8e14c","ssdeep":"1536:1QWL0A3oKGQb7421mSfArkxjPFO5jo+vLxD:SsV76oUV","tlshash":"d463237cd358d2bcdd938bbccf75a0b0964ea1ada1e1c319577cc1b022924dde29e885","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.845578Z","times_seen":243,"resource_available":false,"data":null}},"time_used":8529,"timings":{"blocked":8202,"dns":0,"connect":0,"send":0,"wait":324,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/uy.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.886Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/uy.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:29 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-611\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726449=vpeLL07hSueq0AZCW6GeZzDzGXWNqgbHdB/f9gPaWa5wNt3jaQKShVLZJ3pCKPgDVau5/AM3hUP0wq5SjFAkOc6CuqQCVF38P64YVQmqr4RgNwtd4wSSZrqQ+faVlTTccpGqvwWY0z09ahWFehlg/sZF4asfYvoTSYjCKHs880Ypey29i+bTJXY1/7lnEDNX\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 88238B08-A2BE-4845-85BA-15EFD6E64DD2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1553,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"00e26d17831d4b8be76a245ef101547f","sha1":"7fbd62978126568a1463f174b7efc8b2b920eaef","sha256":"afe0e50062b0766c1aec2e7eb8a5815737bcba0065c106505d305bc09cd9be9a","sha512":"3a5ea3c7a09d4259dbbd40ac0335eb65e461ff72c26517e9b9d1f215598dd7c2b98b4a11c1536b14ebd074336ccc0e385fb0b8d754aacf7ae703b7097a0082b9","ssdeep":"","tlshash":"7231f161e11d341cd52847d0cbfc919c812fb943834b08eff2786296116daffaada704","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.762204Z","times_seen":108,"resource_available":false,"data":null}},"time_used":11595,"timings":{"blocked":11288,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/al.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.384Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/al.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:17 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-c81\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726437=LQku4o/SnmHfqPhRUlKy429dZqXOiNSeVmzGEaAhs5aJ8K5DOwu4623no8Znj4Sno8cFlmRH1nXTof7eCehL2VDWrvRACwFRuXYqkgJ55Z3zlc4foh+4eqPcc++qP7/VQrMo3q+QQaV/6764kvf3+8hwMcM7iqdZT8vPF7GaiI0CeKj5TyMcj8xwf9/ixwMY\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: A40B29DE-6696-4C03-A104-290992AA7038\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3201,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3275f472246a16bbc8c03ada8e570eba","sha1":"040e37f8d378af6f4e80a5ca67d687206cf5ada7","sha256":"79843ad4da4e741bdbff1400cada76cc69a981c9960dd82341e3c96cc7f52fed","sha512":"46e853b6a87c18897d62ed7faf62c59e5a5d153fce44f02a12d03c3e395f1951688927c782d115b2985202ee3a3fdc0979cc1f18a936eb3fc2c51c7b18485ed6","ssdeep":"","tlshash":"ff619b7dc258d3b8dea39bbcd726b0f0e18fd47d91e083658728c17032a18d8e58e895","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.955388Z","times_seen":108,"resource_available":false,"data":null}},"time_used":597,"timings":{"blocked":285,"dns":0,"connect":0,"send":0,"wait":309,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/by.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.466Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/by.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-16df\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 90504471-F235-423F-A7A0-9D2132FEFB76\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5855,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2d04604791fa6de1a4ca35164df76510","sha1":"7fcb9a53bf977cb2602818fdbaa8ecf67618d2dc","sha256":"86a191ea7ad64d4666450aae746d296eccfc078c054fb1b7d44e011645536855","sha512":"90ef504edc79790a6b502e24ab1695f094ec5508d951e3bedb3e53dd76ff2fca9a897a972534707795e2f5defa25d2dcfeac0d0ba0df3b6838c763d7c7a7f8f0","ssdeep":"96:0zgkR1GN/XLBt511KL6KHTtLT47tvT845N1TeniiUKHiHC1GHEWL4x8MqnutTjy5:0zgg1GN/XVtnwL6KHTtLTov4496iiUKE","tlshash":"a2c107508bf8a2a640467dec096fdb7abb9f72dd087d6031f5bf1201212a286513ddde","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.752614Z","times_seen":110,"resource_available":false,"data":null}},"time_used":1518,"timings":{"blocked":1197,"dns":0,"connect":0,"send":0,"wait":321,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/it.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.736Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/it.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 266\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-10a\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 456F6B79-3137-4A75-8E7B-2D12D96F16FF\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":266,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3d08ac67d6f862552f0c9ee88ef11b08","sha1":"de3800e2e45fe7dc8e9216ed9eea5d59cc7529cf","sha256":"db6974b5af7461294bfd892752370c318468a546cfdc74ca7fdf610b720adfc4","sha512":"e93b3046d6c75e884e34ff941812351b1d30d836ae9af65fbef1f712778614e5ac5a035aa1c5cb3d0b2826bbb7c9d07f6c7328490c1ef9c6d4f2de47d561e46f","ssdeep":"","tlshash":"eed097e5863cf824060943788b6c36d284fb3089708d10ccf8e01161310d3af3cc2968","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-08-10T18:48:37.643084Z","times_seen":233,"resource_available":false,"data":null}},"time_used":5326,"timings":{"blocked":5013,"dns":0,"connect":0,"send":0,"wait":313,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/li.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.773Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/li.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:23 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-1f63\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726443=I4674F6+qGthWbm4v3Tt0iNbk3z6+po3UlqQ2MaISR5nR2xgr5MqYkIFQwdSOmaKQbq1BcSDP/84sx/DiinN0x7TrBe7BNmVVDYIU5FRdHsNlW74GjU/fuv8I2g3NyT+ijVjk+QCSxrC2nJRjJe6Um3OQ2z4lS0yfuytGceq6oqL+9hqJ65LMguuPQhCaKAr\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 0DD854F0-7B98-41E3-95BD-C14348D8CC93\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8035,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"814fc6e1c6455c1efadc67ac0c8cea49","sha1":"063170e37494bd66975a2f8370d18b37af04d250","sha256":"c85d60766121a81ca9308db26c493512871df3bd808a2e87eff22b483b78e7f0","sha512":"5e11a60fc96021adb9774460f17b28bb0b8fefebe2732e47d9c38ed2bfab246a3b532a2566a62ada294b256c6574631b3d7cb4b47f02957acbcd0463e88eab97","ssdeep":"192:IZ9joapJ2iFIA132W7Xm866Qvy48UDRoi:mD2iFDZm8a1","tlshash":"05f1103c535ce2bc8d55dabc8f33a0b4654de0dae2e6c3554269c66023c30dee64f5a8","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.856909Z","times_seen":110,"resource_available":false,"data":null}},"time_used":6297,"timings":{"blocked":5976,"dns":0,"connect":0,"send":0,"wait":320,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/rs.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.848Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/rs.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-2d2c3\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 2064C69C-66F1-45A4-96ED-C2D1E124AAAD\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":185027,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2a3decabae6a66506b2003f71d33ccf5","sha1":"77041469d31db83c1fb5713066e2eebdbecff494","sha256":"776cbcaa09d8b5eacb33b30ff7ba780f8af59138c641b2d626be0ed685cff787","sha512":"9936fa0f7d661efa404f719b2e54efe2ebf9189975a7bfca09d0f2ba7d51b54665620ba72dc510201056e4c3e3dab6ef7f389577f02c80c0a038835d2a3f865f","ssdeep":"3072:dh0fqJLN14og07iy4cgx4yyg44zpgj50UEBOzHM4JsM3WOUGSA9GPkeDgCmpdoJK:SzvUX","tlshash":"d00451385ab4e3ba8e83cafccb3ccda8400e51478973c766456955980ad79cfd22d4db","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.918594Z","times_seen":240,"resource_available":false,"data":null}},"time_used":9772,"timings":{"blocked":9252,"dns":0,"connect":0,"send":0,"wait":472,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/hk.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.374Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/hk.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:17 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-d1f\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726437=LQku4o/SnmHfqPhRUlKy429dZqXOiNSeVmzGEaAhs5aJ8K5DOwu4623no8Znj4Sno8cFlmRH1nXTof7eCehL2VDWrvRACwFRuXYqkgJ55Z3zlc4foh+4eqPcc++qP7/VQrMo3q+QQaV/6764kvf3+8hwMcM7iqdZT8vPF7GaiI0CeKj5TyMcj8xwf9/ixwMY\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 720FA05D-1061-48E9-95B0-2590D266711F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3359,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3a3b4216d7ed3f69f608b21ccad65334","sha1":"65e9a923d25843af952e81c45a3eeeb48a9297b5","sha256":"30a35bf61f1e790f0f523a8cfb9b480aeac365108d16be864dd4b432d5337448","sha512":"2fa211ed0707727f2890f4ce7a4ba2e408331695feebaf6dd07f37c7254722efeac3d1f76fe9c51bea9135e742dd39b004fe631d7fdd41cf88e3f1db3e6a21cc","ssdeep":"","tlshash":"2a61dda49324a578de2303bcd77c72f6912e34eca1d4759862a494303a483ffe4af9c5","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-08-10T18:48:37.642213Z","times_seen":114,"resource_available":false,"data":null}},"time_used":309,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/bt.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.492Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/bt.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:19 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-6099\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726439=QLHfXzQcHU+/W9e8VZSSf0g70ZVVR3gGzGwwje9rBHVHza7Yt8wgF7B4H3StKTb5UUbJpmoUOvvq5sygHT45oSjYCEFP9Bv58IrLsh63Oc4/vMSbLNGWDi1m7j9FyJDIR37k9WK9e0JgHkfFZBg1+ZSbskFnMoTPZdqOPihUCE8ZxgQ772H2IN8bRUfDkHPj\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: FF85A0D0-A7CF-4F18-9EE6-3580FAB7BB00\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24729,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c0c2981252bef7bde8428fcdb817215f","sha1":"2c69c71aee4c31d5c68b202a26af4766eccc6465","sha256":"b2153d4685149daf88dc50fa51e881a6006962acf97015e9654b0ee5b917724e","sha512":"22f4d50da996f7dda3deb78ee6d318b082eb29fc4baa6c97b1813d19454c26cf9ce0e14ca6fb88788c4ebdea42ab929f8b70dc68f0b42fc4e4f1fbdeaeaef8ff","ssdeep":"384:FETcFaUjY/SY7A1fEuNYl0HwW5UK7ccmH9bUimt5IAhYGTVVr8X:FEX56TEV4gc3zfZ5G","tlshash":"64b2ef6cd354e3b8ada34bf8df26a0f0e59e95bd91e4c355466cc67022501e8e29eccc","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.770992Z","times_seen":247,"resource_available":false,"data":null}},"time_used":1917,"timings":{"blocked":1486,"dns":0,"connect":0,"send":0,"wait":430,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ca.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.531Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ca.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:19 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 635\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-27b\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726439=QLHfXzQcHU+/W9e8VZSSf0g70ZVVR3gGzGwwje9rBHVHza7Yt8wgF7B4H3StKTb5UUbJpmoUOvvq5sygHT45oSjYCEFP9Bv58IrLsh63Oc4/vMSbLNGWDi1m7j9FyJDIR37k9WK9e0JgHkfFZBg1+ZSbskFnMoTPZdqOPihUCE8ZxgQ772H2IN8bRUfDkHPj\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 2FFCDA26-D9FB-4E17-BD0A-F123213BE194\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":635,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f20d74f9aa5b56961d9dcf05eb3fe185","sha1":"c4921c39dbd2ea09ad6374c68b845e290ff0f58a","sha256":"52732d0edc26206ef3aa7570bf628ee352826262678fd77d1072b308d253ae90","sha512":"b59311391609de0bfb8ac89566e441d78c6f14dae08f515ffc5578516fa1914c3bcfa3708514873f415f7bf5bd4938f49d70a4ab304a86987ac5d07f9a2be13d","ssdeep":"","tlshash":"7ef0dd4c939952f4be208b791a2424c4b88ea0efa0d053ada544946837522cabdc94c3","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.971579Z","times_seen":237,"resource_available":false,"data":null}},"time_used":2500,"timings":{"blocked":2166,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/cv.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.532Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/cv.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:19 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-54b\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726439=QLHfXzQcHU+/W9e8VZSSf0g70ZVVR3gGzGwwje9rBHVHza7Yt8wgF7B4H3StKTb5UUbJpmoUOvvq5sygHT45oSjYCEFP9Bv58IrLsh63Oc4/vMSbLNGWDi1m7j9FyJDIR37k9WK9e0JgHkfFZBg1+ZSbskFnMoTPZdqOPihUCE8ZxgQ772H2IN8bRUfDkHPj\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: A0C8D152-2988-48DF-84DD-20BCB51152C8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1355,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"101bc367183ebc80382f65ae26b0f061","sha1":"10354c1eee8d92aad3bb75f88e364d8bf063d910","sha256":"f04704daa62547ce91a7158bec11ccd3dbb30c1a85d21e4d82d134b4c4073355","sha512":"6658fa04a29d42da4f08f68d0c9e0af38dbf0b10b8532e8651170bd71f68ab34c90e1edb118f692a3f5e4b91f67651c2867f9d5fd12e4b90a811453b2f091483","ssdeep":"","tlshash":"d9217e5bf19c9634dc180be1936569f0d75b6285c1c0e06c14e9bbe0a721ced878d8a2","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.81914Z","times_seen":109,"resource_available":false,"data":null}},"time_used":2611,"timings":{"blocked":2187,"dns":0,"connect":0,"send":0,"wait":424,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/km.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.573Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/km.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 985\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-3d9\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 39C0398C-6362-4C85-9028-65E82E5589C3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":985,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"345241647fbb05f08093c286a664af58","sha1":"f52388aebc61b5c9030b97f08b4d8c9cfcc7b439","sha256":"0e375c18f23a66012a87cc46adc0b1990956437983493841a5c7f3cf60e9073b","sha512":"85670d503a97007d808eac5c3de74cf86ad52fb5250786145805f61cd417340441d105714142d96162f39fa46b083e362f6f06d5b86034bc1ce9d0ae6f954765","ssdeep":"","tlshash":"5d11bdc09274b2b44d1a87f09a7877e1d0df2079e09a42bcb0d9837433553de99d4ad5","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.912906Z","times_seen":233,"resource_available":false,"data":null}},"time_used":2818,"timings":{"blocked":2498,"dns":0,"connect":0,"send":0,"wait":320,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/cg.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.577Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/cg.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 432\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1b0\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: C182DBC2-F696-4A20-83ED-8C95AEE637BF\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":432,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"88d1efefedbb0e8da636964b337eec06","sha1":"34423a995ace05457ff5d5145b24c20a1797c4c4","sha256":"e7afcf74c2104ce7fb28d24b11a7f28f4094512451aed54a9fed38f2ac102890","sha512":"27b3f3f9be1d70696a0c4b759fb9d60b6e019b2c6121f50b814e1309c9cd73dbff50b7cbb23058118d44d6374bbe4f0fc92e482e8f8ef27806c5eff0ce841e0a","ssdeep":"","tlshash":"8ce0554197bce0086f2603a9abac38c581aeb08809cc82ecb484126e356c62f2dd2520","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.78587Z","times_seen":225,"resource_available":false,"data":null}},"time_used":2990,"timings":{"blocked":2566,"dns":0,"connect":0,"send":0,"wait":424,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/jm.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/jm.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 358\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-166\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 89FF1366-804E-4829-A2A7-92B3780E0234\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":358,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"188655d2a20306effdffff0bcfe58f83","sha1":"885b3392a69e80cc48aeab95444d0ec66e3e9101","sha256":"4ccd95f149bf00bc290ffdeefcad47dcc1d7fd448f3fd596caadd322ce11d967","sha512":"2cf0622b2227abd4ac77309410711d235af7b27c1f5671ea7d4e6ebf691ea264ab62d228f688865efa284929705dd34e2e6f1de2f4605070562c61603bdc5983","ssdeep":"","tlshash":"01e068758bba745e084807b8cbd8b1c141ee2085600804cc7db001116598b7fdccb9a0","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.738924Z","times_seen":223,"resource_available":false,"data":null}},"time_used":5368,"timings":{"blocked":5049,"dns":0,"connect":0,"send":0,"wait":319,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/lv.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.764Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/lv.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:23 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 212\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-d4\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726443=I4674F6+qGthWbm4v3Tt0iNbk3z6+po3UlqQ2MaISR5nR2xgr5MqYkIFQwdSOmaKQbq1BcSDP/84sx/DiinN0x7TrBe7BNmVVDYIU5FRdHsNlW74GjU/fuv8I2g3NyT+ijVjk+QCSxrC2nJRjJe6Um3OQ2z4lS0yfuytGceq6oqL+9hqJ65LMguuPQhCaKAr\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: FCC4920E-C963-4343-87A8-9D20F5357C4D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":212,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4c627da588fc0578911d693bf9e3d732","sha1":"2d12b5513fb922949eebe1500500b2e0c83b840a","sha256":"dfdb4d0f913fe7d4d8a05ba635e0a4313aa00cf512a360dea98dbd0076ed3669","sha512":"cdae428c5f73fac67de94c9a084a587372adc7b621fe914a01b29e0dce4c25bc458ace77fe69051bdd5def2bcfa1bce98a6c35d6b18dfd0970d901fddf84fa3e","ssdeep":"","tlshash":"96d023d9c93d7d501e4c86304f6836d280fa304d704c04ddf4e00510224a2ff7c908a1","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-04-10T22:06:57.038989Z","times_seen":226,"resource_available":false,"data":null}},"time_used":5984,"timings":{"blocked":5665,"dns":0,"connect":0,"send":0,"wait":319,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/bs.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.445Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/bs.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 492\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1ec\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: A13CC93F-72C0-46E6-A472-E76FB8306B75\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":492,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f130b72f5004e96f104511c32e65e00d","sha1":"05e8bdeb65abfad56cc6edcbaa884459480e394e","sha256":"805e7ef0ac66c66a897c1ffdabfd79a00c848acc0c5a36dda22d2cf880669f7d","sha512":"48e0a87c216a380dbbce9f699cfc2902ac973fc54d07f8b2383fd4b4e7aaabdf7865f959ea41484c206359ec1f520696192ad74786c8401eca2dc65bd091489e","ssdeep":"","tlshash":"24f059052278a55a4d994ab0c7acf9d500ee748a4c4c059d74c40355a03876b21c7e76","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.873293Z","times_seen":229,"resource_available":false,"data":null}},"time_used":1258,"timings":{"blocked":922,"dns":0,"connect":0,"send":0,"wait":336,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/be.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.474Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/be.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 264\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-108\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 9A3D5935-AF10-4F0A-B3AF-AA9ED1D522AD\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":264,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7eeeb5cfad8502fc9a7f0e9a4436a4fd","sha1":"a60eea4e65bcb2a110174610eebffd9e604153d7","sha256":"d79986fcb07f9aa463f4eaa87b5525673f985457a678ce475f9ccc051898b0dc","sha512":"4edbb85da1a4798fbee94192c92498ae422370fe0e62ae52a47a0c3b94f98a1ca0bf466a5ed50c32961e149d689507c767d9b8339ccda8c3e46f3d51a848ae1e","ssdeep":"","tlshash":"e1d02b99873d640801058338576d34b558f630a4504804cdf8941650324c36b68d35f8","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-04-10T22:06:57.108399Z","times_seen":231,"resource_available":false,"data":null}},"time_used":1638,"timings":{"blocked":1207,"dns":0,"connect":0,"send":0,"wait":431,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/jp.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.741Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/jp.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:23 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 424\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1a8\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726443=I4674F6+qGthWbm4v3Tt0iNbk3z6+po3UlqQ2MaISR5nR2xgr5MqYkIFQwdSOmaKQbq1BcSDP/84sx/DiinN0x7TrBe7BNmVVDYIU5FRdHsNlW74GjU/fuv8I2g3NyT+ijVjk+QCSxrC2nJRjJe6Um3OQ2z4lS0yfuytGceq6oqL+9hqJ65LMguuPQhCaKAr\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: EE1AF143-4BB6-444A-BA46-85BC53682732\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":424,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4bfc2a10db08cba0059c8a1007704945","sha1":"dec1935a0ead7149684addb98ef249a8a2fe1be1","sha256":"94f6c0ccedc30fc7c860e0130868b05f85addc8058749fe319bc70cb6dfe9bfc","sha512":"47b22d7403a52f8253b3a1693df7c7cfc64d3bb2655ed927f239914f98a6faec507fc77f6b8d5d57002c9567fb8865337f1cb5c68bd641bb3adaaceebc71b0a0","ssdeep":"","tlshash":"3de0ab95e6f8d80c4f090a7ec7ec3ac0413f708987ca048df1d0191aba2833b21da2b0","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-08-10T18:48:37.64596Z","times_seen":234,"resource_available":false,"data":null}},"time_used":5575,"timings":{"blocked":5151,"dns":0,"connect":0,"send":0,"wait":424,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ml.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.782Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ml.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 250\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-fa\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: B8F5909C-4F10-4E51-B5EC-06F024F34C44\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":250,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5fccc59e9b975fc43a720792f1c76eb6","sha1":"3a478e7d65bf99cff50ede11f50c6aaab0a172b0","sha256":"d782550a5bf7730a0b6ea44cdcfeb3abdbf706b9e086799ff61ff662bc7d273f","sha512":"f23c5d1ccd6817f4aee591bf3372ec2dd25f5edd68fb441de68723b310c03b9e4c46511607ccf2933abc9a4884c9d3f7dc5b42a9416f809b829579c4889af2d2","ssdeep":"","tlshash":"d4d0a756cb3d68406e894ff85f5c35c645fa34bd609805dcfdd052a031485afbcc99e9","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.787418Z","times_seen":222,"resource_available":false,"data":null}},"time_used":6860,"timings":{"blocked":6408,"dns":0,"connect":0,"send":0,"wait":451,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/sa.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.846Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/sa.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:26 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-27ba\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726446=ptucVn3RIg6hfG1GeWyp0AOoGEPAGvUxzyHSXVviuYCOqdey2OA73hpJTOX54tL2yISiTotdyN9pyxfwsajn2g0X54hFpCzrKsSaHVr5h70Mejg6ceFPn+LFJGC2CRvHpMAwSOEi8xEAaElkrPte2SNNVvoHXHWjyZywau+M/ET7sJheupgJLbbmcQTs3DWc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 7E1505AE-952B-4E2D-96D6-D375D8E66321\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10170,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"595d53a0bc3e13d650eca5fb2b6328b7","sha1":"6a262909baa2de77e0bb259aee58892c765de39f","sha256":"b21e6ec22ccd8d14075db7a6e6eb9741d5b976d96fb2c79eacb3383e190780e4","sha512":"f05234b8ffcd4ccc687d6a8adca917affbf80ffa28a43bb85b0edb6aba992f152171012ebeb1e828bce5b1d4303fba1e9f565d3df8f9128d6ea42caabf332968","ssdeep":"192:I4t/yjaol9ghfA1cNLb8MKIKbltttRfuzhUO9fw9vRU:I4t/3/NLbLKbljGN/96ZU","tlshash":"6122df3dc364d3bceea6d7bc9f2660b4d08ea1aea1e5c355536cc47072921c8e24f499","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-08-10T18:48:37.648703Z","times_seen":244,"resource_available":false,"data":null}},"time_used":9298,"timings":{"blocked":8982,"dns":0,"connect":0,"send":0,"wait":315,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/si.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.852Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/si.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-7b7\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 07B5AA03-0EEF-4370-89E6-96DA78633A24\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1975,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f4effdd1aa63392c1b84781a5f9355bc","sha1":"5af72f9a69e3e61feceaecd4141fa4e0a0c584ea","sha256":"1939cad7667084c0c7d789493cf5a1079468191f8a546829e45ec17d0cd92800","sha512":"382e17de7562b0632d4201ac79b1aa33fd1cb5dd2e97f255174593dd1ab0cb67bdef1497ef94218e5f074c33313ec0b72d848977201577b117967e5d183a4213","ssdeep":"","tlshash":"004121b9a774e0bade93877dcb7930fd808fb44d02d04b196658983433952cea2c9894","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.789786Z","times_seen":108,"resource_available":false,"data":null}},"time_used":9822,"timings":{"blocked":9371,"dns":0,"connect":0,"send":0,"wait":451,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/tg.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.872Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/tg.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:28 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 663\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-297\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726448=scd548NbFsDlriR0p8lcpUSKGtPYT/fhUWpMVJoPGmWaQsF6U2I4BLnmRc69+bG+K/nZb5Nxfo6gYAUxm5/nVRo3rZ9J/GkSGOnre0pGmz3P/71ZNnUJKWEajfGx+N9q7mMdvR0KEp7aCj0WGUT104FuneAtUScTjVMzQbAizsq6TW7mypX6QZoLYJ3c+43j\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: FF508EF2-C9F8-411F-96E3-6D06F22BA854\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":663,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0a93e1cdc72c5f2dc4b0d03881a81c3e","sha1":"6a9ef90edf762838fa31721f59da9e00c48e2769","sha256":"55aad1f0832fb058d094dfc55a6286a9085aae46000e2c76db3278efbda0e08a","sha512":"06f927978e2371591697660e5887fff5588a48d9999b71f7145b5ed25bf1e8c066182f32f55a92fb0e8baeb8feb8d8cf0b5068281c08e37c947fe19c38ff7168","ssdeep":"","tlshash":"ba01d3e0637512c85d068bb456bc74c7d1d531dd80c80cccf864062d37ae62fb9d4953","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.851049Z","times_seen":228,"resource_available":false,"data":null}},"time_used":10981,"timings":{"blocked":10546,"dns":0,"connect":0,"send":0,"wait":435,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ug.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.881Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ug.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:29 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-ee3\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726449=vpeLL07hSueq0AZCW6GeZzDzGXWNqgbHdB/f9gPaWa5wNt3jaQKShVLZJ3pCKPgDVau5/AM3hUP0wq5SjFAkOc6CuqQCVF38P64YVQmqr4RgNwtd4wSSZrqQ+faVlTTccpGqvwWY0z09ahWFehlg/sZF4asfYvoTSYjCKHs880Ypey29i+bTJXY1/7lnEDNX\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 4F14B780-A55E-49EE-ACC6-981F8B338158\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3811,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"053fee266697442908bac3518e6efa60","sha1":"68462e5b946283dc72042b12b48d234c60e595b1","sha256":"fd13140af88cc6963bf1cbf81cab261660aa11a8f228c70588eabc5ea0af9e1f","sha512":"c0a63d044a19eb3af1e71ec36c825baf84caf95dd7c1cb0d64b8a2dd27b08d71d5c8263abc72c4407893677cfc28ce39cfb15c781988b261e6d5917bcefe6509","ssdeep":"","tlshash":"4c71dda99228adbcee1707b8c76871f6506fb1e8918953883271603076042eff1af9d1","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.751185Z","times_seen":108,"resource_available":false,"data":null}},"time_used":11294,"timings":{"blocked":10986,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/dz.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.391Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/dz.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:17 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 283\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-11b\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726437=LQku4o/SnmHfqPhRUlKy429dZqXOiNSeVmzGEaAhs5aJ8K5DOwu4623no8Znj4Sno8cFlmRH1nXTof7eCehL2VDWrvRACwFRuXYqkgJ55Z3zlc4foh+4eqPcc++qP7/VQrMo3q+QQaV/6764kvf3+8hwMcM7iqdZT8vPF7GaiI0CeKj5TyMcj8xwf9/ixwMY\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 40D533B8-C867-470C-8AC7-CDD3FDF9265B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":283,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"96a213b640cd7f415d9252c17dc97b35","sha1":"810f566cbd1ecc27c2d3946ebca86f0141a0fdb8","sha256":"0a31026215eb4813d3c95ace61707f5e0fef8bb63848125746a8ec3684211ede","sha512":"e758495f8f966c8f7fced259466572d8885e99d6c07dd839a9b0d74835889fde36e356d07f02a70d01f3674fab7cbd80b6d3fc0cdad2b33b9c82df8443fc85d7","ssdeep":"","tlshash":"9ad02bb5263ef859121ac6541b9f34c242bdf0d8b08901febd594536120b397fdc3910","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.783164Z","times_seen":234,"resource_available":false,"data":null}},"time_used":706,"timings":{"blocked":292,"dns":0,"connect":0,"send":0,"wait":414,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/bg.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.517Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/bg.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:19 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 260\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-104\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726439=QLHfXzQcHU+/W9e8VZSSf0g70ZVVR3gGzGwwje9rBHVHza7Yt8wgF7B4H3StKTb5UUbJpmoUOvvq5sygHT45oSjYCEFP9Bv58IrLsh63Oc4/vMSbLNGWDi1m7j9FyJDIR37k9WK9e0JgHkfFZBg1+ZSbskFnMoTPZdqOPihUCE8ZxgQ772H2IN8bRUfDkHPj\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 92F0F21A-5E81-4104-9062-6342C85959CE\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":260,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"93640f37787dc329f463f488ba0fa4e0","sha1":"d922672daaf916e2e6d2139ede98b0942fbe0920","sha256":"84c4dde8ef28aecb0c1be153dbd5f011f6855126b96be4c6f52bc6185fed5111","sha512":"0a2a41b628295cb03e630cc9e1b2a7ab1da5a17211e0ea7d3e8688993cd53e18a48f1b379d4277cc077e017426e1ac04bb2c48967906d309ae5557eed0b25c8c","ssdeep":"","tlshash":"20d05baa912479041904c2749f6c35e3c0fa3089704c00def4602578210e79bacdd655","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-07-30T13:05:43.699971Z","times_seen":237,"resource_available":false,"data":null}},"time_used":2179,"timings":{"blocked":1845,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/iq.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.727Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/iq.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-5a1\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: CFD39DAE-BB4D-43B7-A23D-6A210A36B8CD\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1441,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2d033630c44ae6df01f71d61a2c18c26","sha1":"1de34d7a408e2cd9664e8acd447660f5feeecff3","sha256":"89b3631bd9238cc287e2ffc77cbe8a89363057443fdee7d93274044747098efd","sha512":"f256899966a0857165669f62ba68c0bf8945acece4af567f63e27854335b411b6e27a2e7f3c20b154ddd98a9546a61057e0b7994ab5c24252e7e2cb965a47291","ssdeep":"","tlshash":"2b211db98a68d3bccc928a7c8f7220f1c05fa1daa1ebc309947d853015da0d8d4cfca4","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.843418Z","times_seen":109,"resource_available":false,"data":null}},"time_used":5164,"timings":{"blocked":4856,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/mv.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.781Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/mv.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 272\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-110\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: F405C931-B755-4447-BC64-2D805EC4CA3B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":272,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"23f3f5fc0b7c3110d60044e2c19fbf14","sha1":"4ba145fa11bce67bb4501d8d965e6657536f727e","sha256":"325b00a246cb36a84f25d8d70c48828a0f3696b4849da7a4905d5a4729c61a3f","sha512":"642d1b5a651b20c5b41059943699c48e1d2a93e9c635341ef5dfff7b61f291c75f466e49b804cb68b725c5ca9df7b09e82000ba46d9d5f3cf6ce047055e72c05","ssdeep":"","tlshash":"c5d05ea6a1bea8855b55c6646b5b32c2839b60dc634803edb59008e621483eb7c859a6","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.939485Z","times_seen":219,"resource_available":false,"data":null}},"time_used":6799,"timings":{"blocked":6385,"dns":0,"connect":0,"send":0,"wait":414,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/pw.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.813Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/pw.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:26 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 420\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1a4\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726446=ptucVn3RIg6hfG1GeWyp0AOoGEPAGvUxzyHSXVviuYCOqdey2OA73hpJTOX54tL2yISiTotdyN9pyxfwsajn2g0X54hFpCzrKsSaHVr5h70Mejg6ceFPn+LFJGC2CRvHpMAwSOEi8xEAaElkrPte2SNNVvoHXHWjyZywau+M/ET7sJheupgJLbbmcQTs3DWc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 23F6E6D0-7974-4128-BDDD-2C31357C4D1B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":420,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"139fe08a9258d69c4197131e35866b06","sha1":"4db8cfb4edbf9abe0688558b09ce1e6ac1aef3cc","sha256":"e39bd99fdd2c0c0698b19b38d956ad9d324ebe84f2fa3742a41bbb4ebca0e97c","sha512":"7ce6d68e34945530407b15cea52261908013cb8ac6469ff870f92aff1ec40b27be1b7e309b93d66c4becd9181684f6981775fda2a24eb505a8843f46ed5adca0","ssdeep":"","tlshash":"44e0ab6842bcaa58060d83a4cae938d402bff09e864907fcb89819293428a6b19862d0","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.779196Z","times_seen":223,"resource_available":false,"data":null}},"time_used":8389,"timings":{"blocked":7960,"dns":0,"connect":0,"send":0,"wait":429,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/st.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.846Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/st.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 849\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-351\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 528ECF6D-CBBD-40A9-B5C9-9E098CC48E3D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":849,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"17b8d752703f3386e98bce49c90aef45","sha1":"d6fe3f5a0854cca52ba006bd934f6f470fffb2c1","sha256":"43dc8ee48a139e1ea113cef5546190c22832713e364025dd67d97cc1f81daf9e","sha512":"ff4c3e6dbdc7e81d1a4a8d4202083422f3433e90887e26a88e596f977eae19d44b94d3eecd8a99534059ee40a0d31061f8a9df923a98bd6966da8a6a225119ea","ssdeep":"","tlshash":"a5018884e559501c82385369cbf9e6cc820fb443928b08aff7603a9f41785fba8d830c","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.900892Z","times_seen":225,"resource_available":false,"data":null}},"time_used":9377,"timings":{"blocked":8939,"dns":0,"connect":0,"send":0,"wait":438,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/sz.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.862Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/sz.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:28 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-1217\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726448=scd548NbFsDlriR0p8lcpUSKGtPYT/fhUWpMVJoPGmWaQsF6U2I4BLnmRc69+bG+K/nZb5Nxfo6gYAUxm5/nVRo3rZ9J/GkSGOnre0pGmz3P/71ZNnUJKWEajfGx+N9q7mMdvR0KEp7aCj0WGUT104FuneAtUScTjVMzQbAizsq6TW7mypX6QZoLYJ3c+43j\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 38A10BA3-C60B-4E0E-B650-91390A8FF7B6\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4631,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"90fe859705cbb892e52fc7eb83f653f6","sha1":"02a0b282bda45f2d9cf6ba3ebb781f3d9f51d85f","sha256":"5f6b34960fd3a1d949a946386d5c24b4bf837c809625bc8750517ecb026fb468","sha512":"20218697d6d53ff0a60caa3aac70fb71b0bb02c1930f4aa58c0c67e9f395090ef6e4cac1d02bef781288d8744ffe460b10b463c2ebbba16262f161bc5a3d7d49","ssdeep":"96:+X8hjFthkscG0cnImnx0uDYLbh93GqHyIsQrjsFY1kA9Xj:l+sJ0vmnxnY33lS7QriYOA9z","tlshash":"b2a1789cd758f1bcee228bbcdf39e0f8a08f6495a1e5835997acc43031501d9e55ec89","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.742352Z","times_seen":111,"resource_available":false,"data":null}},"time_used":10457,"timings":{"blocked":10027,"dns":0,"connect":0,"send":0,"wait":430,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/dk.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.599Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/dk.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 225\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-e1\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 31F5396F-4E03-469F-8EB3-2A42FB0999D5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":225,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7a5619d2f1000b6e369e73e0236d1d06","sha1":"cde235d20280471c4c2b0c201704410917eb4c5d","sha256":"96ee0d08a9beae18b540175f86d77bc7f8fb60a23cf4083aa24a5350e3f25c3b","sha512":"b3e810aba27bb4d9bb636a99ef4975c06274d508846d545546649dde8db12b897dcafa4c15924bec7bb12e709ab720c69ff129096ddad691ca9dabdda9ef4ba1","ssdeep":"","tlshash":"a2d0a7a5527938440b0143e54f9c75c2c1e9748d901501eeb8d0053562896ab7c41917","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-08-10T18:48:37.650529Z","times_seen":231,"resource_available":false,"data":null}},"time_used":3277,"timings":{"blocked":2969,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ke.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.750Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ke.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:23 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-510\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726443=I4674F6+qGthWbm4v3Tt0iNbk3z6+po3UlqQ2MaISR5nR2xgr5MqYkIFQwdSOmaKQbq1BcSDP/84sx/DiinN0x7TrBe7BNmVVDYIU5FRdHsNlW74GjU/fuv8I2g3NyT+ijVjk+QCSxrC2nJRjJe6Um3OQ2z4lS0yfuytGceq6oqL+9hqJ65LMguuPQhCaKAr\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: EABE2697-D0E6-42E5-BC59-C2C29A7B9D0D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1296,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7ad9647d196c070c48dea6d286b46ae8","sha1":"27c32c08f395d8e90d9806934993225d14d7e8ce","sha256":"01e36279498f79267ab841cf55ccfd18c42a8bbf1bd5b98275f7208a4c9a6303","sha512":"2044e9120b144912275aac0a6601a69d2f70c36885c87f262a1699c48c462754682130f1d49ff5dec2d897ffe3529a8d524cccacf387e4dd4b53714edc6c194b","ssdeep":"","tlshash":"f6218a25e05c602c85284368c7fce0acd31ba017a257069ff524356b42bd6eba8b1319","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.954055Z","times_seen":109,"resource_available":false,"data":null}},"time_used":5751,"timings":{"blocked":5327,"dns":0,"connect":0,"send":0,"wait":424,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ng.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.807Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ng.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 239\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-ef\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: F80D67EF-3957-4C5C-ADF0-6D38BA2AE76A\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":239,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"47e046296490f73fc2ac5e457b0651d4","sha1":"40b3d0db0591f0581cdcb52ddc6611d889879629","sha256":"2ede63ffd918ede8a9a5210b711a64c8fe810c68d192aa75e9bdc17d548a68b1","sha512":"f9162601dd5cefd605391ec6f999af51d008aef4e35acbb955a0bcdfc74db1d5c132912ad0d7ba83eb0445ba3ee958cde464281ee49bf27701f22dcc52777f4d","ssdeep":"","tlshash":"60d0a765872da8541718463897687ae285bf3058b0cd14d9f8e05511310d7ab2cd69a9","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.925806Z","times_seen":228,"resource_available":false,"data":null}},"time_used":8111,"timings":{"blocked":7796,"dns":0,"connect":0,"send":0,"wait":315,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/pl.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.827Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/pl.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:26 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 201\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-c9\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726446=ptucVn3RIg6hfG1GeWyp0AOoGEPAGvUxzyHSXVviuYCOqdey2OA73hpJTOX54tL2yISiTotdyN9pyxfwsajn2g0X54hFpCzrKsSaHVr5h70Mejg6ceFPn+LFJGC2CRvHpMAwSOEi8xEAaElkrPte2SNNVvoHXHWjyZywau+M/ET7sJheupgJLbbmcQTs3DWc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 99FDF2C4-69AE-49C9-A16A-20DC460B2E28\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":201,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"324079808e39ff36ea397fcc25c90dd2","sha1":"5eabae50c31a2dedd191e692ebd6735b67396ad3","sha256":"b8a083ec0fd555cd0356229634db5dc7913ad9049c3b1bcb64f85e0a888c99ec","sha512":"d11f5f8d2b63f2e67668fbdb10132f094df82629c554c433080b2bf27f3ac7add20f1f07b2b2f8d94879e2cfecdd04552326bc1fd5cee5ba90c5b99a5004ed6f","ssdeep":"","tlshash":"96d022aa263a78183d1d8370cb6832c150ba340ce00005ddfdf00221301c2abacc39a1","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-08-10T18:48:37.616218Z","times_seen":235,"resource_available":false,"data":null}},"time_used":8607,"timings":{"blocked":8300,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ye.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.893Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ye.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:29 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 249\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-f9\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726449=vpeLL07hSueq0AZCW6GeZzDzGXWNqgbHdB/f9gPaWa5wNt3jaQKShVLZJ3pCKPgDVau5/AM3hUP0wq5SjFAkOc6CuqQCVF38P64YVQmqr4RgNwtd4wSSZrqQ+faVlTTccpGqvwWY0z09ahWFehlg/sZF4asfYvoTSYjCKHs880Ypey29i+bTJXY1/7lnEDNX\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: C964F7F5-4E5C-4D1A-B00E-88A7F87AC080\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":249,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ba6d11aa6be0a3edc7f435dad90786b2","sha1":"78102315c5c1b6de72ffad19d4d68ed0d43dcfdb","sha256":"288a6c807a98315435342e0d7ec2e0649a1550ca6a2f255eab360ab385349d52","sha512":"912278cfb9ebe29c7bbd5e7ade9da85f38da7d431612d760d1910c9406f541657175cab75cc8eb89065cba234200a6bdfae5b1b9dff7b246795fe1a06e660765","ssdeep":"","tlshash":"26d097e58028386c160892b48fdc37e380fba049204840cdfcf01210308ebbf6cd5e64","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.7417Z","times_seen":226,"resource_available":false,"data":null}},"time_used":11905,"timings":{"blocked":11592,"dns":0,"connect":0,"send":0,"wait":313,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/assets/index-DtgRzBWv.js","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:14.406Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /assets/index-DtgRzBWv.js HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:14 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Thu, 06 Nov 2025 05:25:21 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"690c3141-3b6fd\"\r\nExpires: Wed, 03 Dec 2025 13:47:14 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726434=a/mX0GdBoO3Ev6o+WUwBcVDqU+Txknbyvm8uOstduM3eEskYJpgJR2bTF2V0hjHHrgq46S0Qg0z/It43BdY+lOH5Dw3tqhzxscxxVdwJkIl0kdNupvaIHL1XrGjGIZ7GuiS/6wwjCE8hwO0M8cg0Ay84EpKwLqva1ii4cGXXjq8FJi/LtEOyoqFLA7sVgmF2\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 463C20E1-66D7-40D3-A376-B1B9E232FC80\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":243453,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (35990)","md5":"c8faa46b51d4237b4f93507979a256eb","sha1":"0c92bc6c20a550d1fa126d22244b05cd49a59290","sha256":"281c1806e3b390a22fce97e9d6d2591119b6ed2152ee02f2c7275bea5e0a4301","sha512":"4e09d300a7a5f61d185fd186e85e3b86c98b68c67753d2da955074229f466a004c9877d8f84ccd9cea194311c9aa83b836d017df1f44ea945c01b5ddbd72061e","ssdeep":"3072:K+dUJel4DWp4wKxpSUGMRw0VnH87cSJ9JaQHsj+LaHrVRrqlumlIv5xK7Ary:K3wl4Da4bLzVnHtM0rqlBIvW7p","tlshash":"b9344be63185b43243aa19e2507f3505b3391e54780ad4ccf06ca9db3d7aa8a52f7f6c","first_seen":"2025-11-08T03:51:02.050587Z","last_seen":"2025-12-07T03:25:24.511551Z","times_seen":4,"resource_available":true,"data":null}},"time_used":1404,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":791,"receive":613,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/mn.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.794Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/mn.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-573\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 25BEF310-7D0A-43C1-B647-10520FA09444\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1395,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d56bed44c1b66c5f8506e0e4cc1d198c","sha1":"4ef2b3e7168ef7f7b0c3cd5313addb6e7fd66960","sha256":"4126458fcc35a3de0be786e6af1ccb4c9a2a06eb4e788d363cc86d0480a9e7f8","sha512":"183aad1e56616e6638dacdd626d5d46ebda534f36fb5fac6b8344767b5152f6c61eff7ccda0e7c0e00bc3e3dc7a671893f88bd6047dbce3370289b6da5c5f41c","ssdeep":"","tlshash":"b821af6dd16cd66cd88785ec8f773072939fa0adb2c2d3146a0cc56226010eae54f990","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.842475Z","times_seen":109,"resource_available":false,"data":null}},"time_used":7492,"timings":{"blocked":7060,"dns":0,"connect":0,"send":0,"wait":432,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/es.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.857Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/es.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-1604b\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 531A3CA9-541D-4470-BC4F-E1E8565EC01B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":90187,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a08a3a5610ac85d5bf4cfd6fd321cc94","sha1":"52aa60c01af7c4cae236809af85107832535e8fc","sha256":"3a20b9783f422be53b2171e2d77db7af39a27551eb59f7eb52c52ad903485d0e","sha512":"e4c09b7082a74d3ce1aa021098fd7659df35b6598b4c726a31f812574c3273144881e151868b019c934c6b49cd2e2fb021071e835aee2cf0bad39432681fbd36","ssdeep":"1536:7n4EVMK0cWoEGWCzj4wyIV4l1JP2v1uWJHqyWUw9GeHpn6wADS1LEm0raCuHiQip:kEVMK0cWoYRcV4nJP2v1T","tlshash":"0f93ac7c472cd7bc9a13cbb89f2da0f5430db0a9b23e9258641c817062d36dfe56b985","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-08-10T18:48:37.625233Z","times_seen":244,"resource_available":false,"data":null}},"time_used":10051,"timings":{"blocked":9738,"dns":0,"connect":0,"send":0,"wait":312,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/af.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.380Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/af.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:17 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-5104\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726437=LQku4o/SnmHfqPhRUlKy429dZqXOiNSeVmzGEaAhs5aJ8K5DOwu4623no8Znj4Sno8cFlmRH1nXTof7eCehL2VDWrvRACwFRuXYqkgJ55Z3zlc4foh+4eqPcc++qP7/VQrMo3q+QQaV/6764kvf3+8hwMcM7iqdZT8vPF7GaiI0CeKj5TyMcj8xwf9/ixwMY\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 67892653-0F5A-4909-9416-9EF91C017821\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":20740,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"47741e1651a52723a8537c95cc99f2ea","sha1":"345dba143d7f1108273ad1a3e5722e2ae5d1d900","sha256":"6b0046ef1180dfb4fc06db1e1b10f918b1bd10dbe53a50c2692dcdbe9e75f4fe","sha512":"dd16b9c2126010730bd9fee8293549c6b4cf300800729c6cebda3d94e459a0b7e3471e3115299155e0a229c7c024d4b3a6f04327479d0697068b13384c341053","ssdeep":"384:vIatUOhdoup1MCUafj80YhWFdqy05wUOGDO1SWx9dNNOu8f:sfQxUafjki/u2Uxf","tlshash":"ea92cf3c8368d3bcad53d7bc9f669070924de1a9e0f6c351866dc27022e35d9e25f884","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-04-14T05:55:00.952729Z","times_seen":251,"resource_available":false,"data":null}},"time_used":436,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":435,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/bb.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/bb.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 593\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-251\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: C2E0826A-D3E2-48E4-91A0-EF34A5D3F7CE\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":593,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4ec109e9808ba1153aae91be3f94c96d","sha1":"952f5d6567e2403c128039f400736b0447d11241","sha256":"db66b4b37f9f5a6ed3363cf05f06d9d30b5b189ee7162f946abd16417684d573","sha512":"ae04f360579d21d068a955462666355af2ddb5db14ceda59fcef791de53e84f67212c36ef78caa39926adc395fb5d12721ad413bd94c0662cab7f355dedc4121","ssdeep":"","tlshash":"d3f00218c2add80c9f05c7f077fc20e0c019789ea6d002aae66450f461360da68c91e8","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.849028Z","times_seen":230,"resource_available":false,"data":null}},"time_used":1562,"timings":{"blocked":1134,"dns":0,"connect":0,"send":0,"wait":428,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/sv.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/sv.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:21 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-134bc\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726441=JHGeMlqLy0gB5ak0wqadFpXGs3jM0Lo0M6zpM+XNz231JxpbP0A40EIy6YAGOKWCUUKvhgxieDl2ZDNrB4enQOS9H/6MwGnh5UiaeNYNMLt++1i3qhK7sfzsnGPa7MewtPpo89eienZJybDLK4IakcYHNlxcLcw8BoCYNUG75GMW74KuNPfLYIP7Dw0B494o\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 64164EE0-2BDE-4616-B95D-7F33DB6F312E\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":79036,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6c2d38b3c4319df2a437631ba02c31dc","sha1":"573da310d3ddc070c803298bf8be680c1c2be1b6","sha256":"43354e7757c3a7a6dc08a595706b75ac90eb2879f5cc5b60151770b4aa58ba3d","sha512":"55032b001d6875de39ca97b9117d6c5629c8e5132c9bfa0a2911f17d5ee17bc3bbe8c896b34bf6a1de756c04a1871a1354dc3229957e31b7cc6f76dcaed5f3d0","ssdeep":"1536:U4VzbUDbsIgZx1t8XhPuX4g1OeTElnRLbRf+ArIKIgmM:U4V3UDbsIgZxrGF04g1tTEd/+sIhgmM","tlshash":"2073a03c4b58e3bcca838bfcef65a0b4524f90e990aa9395951cc27032a21cdf55f9d5","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.862753Z","times_seen":245,"resource_available":false,"data":null}},"time_used":3646,"timings":{"blocked":3325,"dns":0,"connect":0,"send":0,"wait":319,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/fi.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.636Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/fi.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:21 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 223\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-df\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726441=JHGeMlqLy0gB5ak0wqadFpXGs3jM0Lo0M6zpM+XNz231JxpbP0A40EIy6YAGOKWCUUKvhgxieDl2ZDNrB4enQOS9H/6MwGnh5UiaeNYNMLt++1i3qhK7sfzsnGPa7MewtPpo89eienZJybDLK4IakcYHNlxcLcw8BoCYNUG75GMW74KuNPfLYIP7Dw0B494o\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 014AB7AA-64AF-40F9-8EBB-76531254C824\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":223,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c4fb83b52406e22f78116e567aab9ea2","sha1":"55b86ea50c63bbd1a562de182f97dfd3ab111d8a","sha256":"04543c9d82c8e5158f753aa547b7eebfd683ebfec0a31e4c4700c3a633650bb2","sha512":"3c64ba1ef7e8f50f66fdce28c5925332bfba3051092e10aa8b551cc23b6d991094e2ab1898b2ad09ceb93cc28e43b84aa6aae4334f6f1570dc01c8c7d33084bc","ssdeep":"","tlshash":"d0d0a795923ab514470447601e9c39c282ab2489654902ceb891067432896bfbcc9620","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-08-10T18:48:37.63435Z","times_seen":229,"resource_available":false,"data":null}},"time_used":3974,"timings":{"blocked":3666,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ki.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.751Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ki.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:23 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-1607\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726443=I4674F6+qGthWbm4v3Tt0iNbk3z6+po3UlqQ2MaISR5nR2xgr5MqYkIFQwdSOmaKQbq1BcSDP/84sx/DiinN0x7TrBe7BNmVVDYIU5FRdHsNlW74GjU/fuv8I2g3NyT+ijVjk+QCSxrC2nJRjJe6Um3OQ2z4lS0yfuytGceq6oqL+9hqJ65LMguuPQhCaKAr\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 16F9C380-2291-48D7-9F52-FA3431E84BD3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5639,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2661ac158a7eff6e3e84af25ff3c55a0","sha1":"2e0eded2ae7a872b5fe7a300665d158d9a189c00","sha256":"c11598df1dce1e46725a23989df4914fb77bd9532b2b81cc08ab9ec65961a0d5","sha512":"a17d4aa2ce31947b9718e8872a7e707070717cbc438d91b5ad3f8a04ddf6f0c4cf92a61f88310ef32a7ebdeaaa0e48738c71112b50ba2cc950b20542fb6a79ac","ssdeep":"48:AN4NyUzB0FI2P1OvRQ9qWsztFA5osTJFAJjW5TFF2BWcileHLfDm6LEnXk+Ri1vJ:cUWOpQ90RFA5os3AAFaK+jfEXkHqiv","tlshash":"c0c1d06c92745ab8aca703f8df6d34f5245718cc6544a24cb1a67c3032983efa5bf9c6","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.760969Z","times_seen":110,"resource_available":false,"data":null}},"time_used":5678,"timings":{"blocked":5356,"dns":0,"connect":0,"send":0,"wait":322,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/me.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.796Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/me.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-f43e\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 8134C35F-9F7B-4F34-A4A8-C8D85B034E58\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":62526,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2ee10400cbc692224f23a7ba904ef948","sha1":"369f48a627edcc9c55ca42a57467f744c967b856","sha256":"e73a839278f8470ee4f3f51c47430523b2df1f4445a745470cb3d5163f718144","sha512":"4afe96a051306fcc263d44240c1dcac95118363537c049f8ea813f4846d2c4358c8100d899a99ba4cc20fdf61f8939987c1e157887a3540855833104029f0e6d","ssdeep":"1536:2Ztl5BiWgPLMVbe4ShdsKS65NtefU97axH+AUlG55d:2flOjPLMVbe4Shd9S65+M97axH+AUlG5","tlshash":"f153df7d8268d3fc9d92da7c9f2690b0964ee1dae0f6c301966dc57026d30c9f24f899","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.775409Z","times_seen":245,"resource_available":false,"data":null}},"time_used":7545,"timings":{"blocked":7065,"dns":0,"connect":0,"send":0,"wait":472,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/om.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.811Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/om.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-5511\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 4763B03A-2675-4AD4-86C7-021AE379CD96\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21777,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"bd748870c10aa5fbef978e354c56b7aa","sha1":"8707c686f444699d50d2bcd496179033526162a1","sha256":"45a9de80eed55c6b6ca131b8bb5886729c2a8d8f27e8686eebd18e3c50d04793","sha512":"7ef869801b8b4909fe79a5e68e28d1f7827a595fb65d77a5e9867fd25297da45048e999991c1716bcc922aaafcd18560873e5ebfe3787be50ac4bad1afc5b866","ssdeep":"384:STK0oTK02xSkSXz3sUuRUj0SKLXzXsUuRUvgVTWx+MJK86e/6em:YW2DjRUApwRUYeVK86o6/","tlshash":"88a2031ce648507ccc1f0baccba7a8f8761e90fdd29543a5802d40b47aa95dde4b7e87","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.839659Z","times_seen":245,"resource_available":false,"data":null}},"time_used":8173,"timings":{"blocked":7838,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/qa.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.834Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/qa.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:26 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 348\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-15c\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726446=ptucVn3RIg6hfG1GeWyp0AOoGEPAGvUxzyHSXVviuYCOqdey2OA73hpJTOX54tL2yISiTotdyN9pyxfwsajn2g0X54hFpCzrKsSaHVr5h70Mejg6ceFPn+LFJGC2CRvHpMAwSOEi8xEAaElkrPte2SNNVvoHXHWjyZywau+M/ET7sJheupgJLbbmcQTs3DWc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: E3B95368-F4A1-4EFC-AE22-8E6C9B126600\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":348,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f92cbd110a828769afabd1db5c49b24a","sha1":"fd872ac3aa2dff1b67ab728014a9d588cc463fc7","sha256":"b2d643b882bbd5b555119867d7372b0f5d57f293086ac221cc8f21e69aef3ed8","sha512":"09f7339fd715849bc42a726fab5d9efbeca1a70eda0b582344795d16cc931a82446eac3265cee710d30b8e3e052738c33e9f2d5f27d903df3ef9a384880284ce","ssdeep":"","tlshash":"fde046a0c72c7a850f72c7a027763981e45b1ecd09dac08cf45280dc313b55eab736a0","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-04-10T22:06:56.772185Z","times_seen":228,"resource_available":false,"data":null}},"time_used":8950,"timings":{"blocked":8515,"dns":0,"connect":0,"send":0,"wait":435,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/bo.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.494Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/bo.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:19 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-1b33c\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726439=QLHfXzQcHU+/W9e8VZSSf0g70ZVVR3gGzGwwje9rBHVHza7Yt8wgF7B4H3StKTb5UUbJpmoUOvvq5sygHT45oSjYCEFP9Bv58IrLsh63Oc4/vMSbLNGWDi1m7j9FyJDIR37k9WK9e0JgHkfFZBg1+ZSbskFnMoTPZdqOPihUCE8ZxgQ772H2IN8bRUfDkHPj\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 22312E0F-545B-4296-AFE9-260FC6591E31\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":111420,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"081ca7ca47f400da8c8a888f6b290614","sha1":"37c10f707d91f17474355bf8fa8f5e84c75b34a0","sha256":"48340e330da5f6624ffc0ca4f61f4549488991b0a0c2dd5d8fe6377a3f094a46","sha512":"0e1cd36d8190cc7a6945e7328e1231927573eaa84419e10da4c749c0c228d5e08ff67ea4f33e173e36beede8555477077faf6e96b08f093de5866561d4cb400b","ssdeep":"3072:WPZV2TCfXKqERbpCgTR+4bq4DqyODHKHwiaOOla:FxRbppww","tlshash":"f8b3c07c0628e3bdae56c7bcdf68b1f4014e70d8a27ae2486558913022923dff56f4d9","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.772103Z","times_seen":247,"resource_available":false,"data":null}},"time_used":1819,"timings":{"blocked":1491,"dns":0,"connect":0,"send":0,"wait":325,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/cl.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.546Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/cl.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 503\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1f7\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 1041AFE3-5272-49AD-B004-B790F937A4BF\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":503,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d17f6e02baa800a68b86ab7d54c98732","sha1":"24215555f7259b9b178b5632e6522201fb01a9cc","sha256":"ffd5673cccffb5083ed269c0a308abe986d5e3378f5f2e0ceb55ecd7df3b6087","sha512":"e2c953f1ee0ce1c25ed518db512cd6b2c77b862571c295c1ce85c7b64c5324f1a2c9009b47b8b2bcec750ec3ba8b7f0a98912a06a2b42d2d2c52624922390c87","ssdeep":"","tlshash":"4cf09e99a275a0880e0907f0d7fc31c740be71dd719901dcf0a5117c652e71f2cc0b52","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.901817Z","times_seen":230,"resource_available":false,"data":null}},"time_used":2748,"timings":{"blocked":2318,"dns":0,"connect":0,"send":0,"wait":430,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/do.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.612Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/do.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-1a429\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 093BE082-CD1C-441F-B5B8-31D65D0B03A9\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":107561,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c8e590d845f19c20b9ae25c26bc8d956","sha1":"4f5100cc9b2b6b9821461a59b674252f58a64976","sha256":"dc45853e9d1b0b83cbd77b025dce680a39caed5eb224e93a32b5bdbf06808a56","sha512":"9d6d549819739aeac78f68eae05d213b9e7538c4affe3f18dfbbbeec02682b040fa4b4a6b4ba003439ff01d77936e75f77911ac9899cd34876e5bb3c339ca64a","ssdeep":"1536:div8cKMcb1y+k4xecedcvYRh23Tq22FFaaap9FoWCUtp:dirgk+k4vedcgRh2e22Wbx","tlshash":"10b38a555144e66c2882f68ecbbfc5e1134f505af1efa6d82efbd7a8a00e690fd41834","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.738279Z","times_seen":243,"resource_available":false,"data":null}},"time_used":3480,"timings":{"blocked":3158,"dns":0,"connect":0,"send":0,"wait":319,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/fj.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.633Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/fj.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:21 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-622f\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726441=JHGeMlqLy0gB5ak0wqadFpXGs3jM0Lo0M6zpM+XNz231JxpbP0A40EIy6YAGOKWCUUKvhgxieDl2ZDNrB4enQOS9H/6MwGnh5UiaeNYNMLt++1i3qhK7sfzsnGPa7MewtPpo89eienZJybDLK4IakcYHNlxcLcw8BoCYNUG75GMW74KuNPfLYIP7Dw0B494o\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 7CE72D32-A58F-4A41-AD40-5EDC5F518684\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25135,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d6a55075adda3327cc46c0596a8a8d3e","sha1":"d8520ba2b5bc0b2a590148063a27c0e639ab8186","sha256":"8740c51e0f339b02c572294fee9ada3ae6b83d1b9e680d7cc5d3062fe4ba0f93","sha512":"6ed0912363cee63501636f687e304da8036c5401cd94d543b314461a6344f44afef3d5d9c6c0d6d68b77ae83bfa2a6acc9db174b15e714eb15fcc43fbfbf9e03","ssdeep":"384:hkPNtjfVJqM9X4E52iBEUM8FuSldDdJ/qcW1xTTIEh5r9ZhREmoA:OaM2EQsE58FrdDdJycWPTIE0A","tlshash":"3ab21d3c8258d3fc9d96cafcdf2690b4914da099a1fac385929cc67012d31def25f899","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.749699Z","times_seen":247,"resource_available":false,"data":null}},"time_used":4076,"timings":{"blocked":3633,"dns":0,"connect":0,"send":0,"wait":442,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/gd.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.669Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/gd.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-61f\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 370B4672-C197-4D2D-94FD-34BF1D6B5D18\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1567,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"972dcf4f4873eb7ed93423d2330eca19","sha1":"d76d326bdc0e725668b222883a04280c178b87f0","sha256":"10410c3090723c32b292967696c45fa8ebb69e7fcd1fcb73aba23057457609d9","sha512":"053a05eb4174f35aabd1196311c71e4937876fc7c9371e493b3825ef445ce1d072b6800806945d1a977acbbde2b1d04edd7564014db8bfeb387a2d8c5f570008","ssdeep":"","tlshash":"de31cf18f45c101c95292769c7eae4dd820fa55b91470aaff320398f4179bebd5fc309","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.934984Z","times_seen":109,"resource_available":false,"data":null}},"time_used":4493,"timings":{"blocked":4172,"dns":0,"connect":0,"send":0,"wait":321,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/jo.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.745Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/jo.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:23 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 635\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-27b\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726443=I4674F6+qGthWbm4v3Tt0iNbk3z6+po3UlqQ2MaISR5nR2xgr5MqYkIFQwdSOmaKQbq1BcSDP/84sx/DiinN0x7TrBe7BNmVVDYIU5FRdHsNlW74GjU/fuv8I2g3NyT+ijVjk+QCSxrC2nJRjJe6Um3OQ2z4lS0yfuytGceq6oqL+9hqJ65LMguuPQhCaKAr\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 10088F22-520D-44EC-908D-8B2EEACB9230\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":635,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4b103df969d7f64248961345736eb0a3","sha1":"9b772531fe450e6745b44c3b8279e5faadb60058","sha256":"69ee8dcf9ead2348f3995a534c4ae398d0aa8e537047553a13d4cc6e7d00c834","sha512":"96029678a05afc7bac7c7ab88bd0fc8082aa1fb8b944f2d8f8178ecd3565e799cfbf37c097bc108bb7d2e7ba3ef50a3bf3817491fd9fb8dc88ed891e6c96a4b1","ssdeep":"","tlshash":"31f07d6481b651788e8707acabfc74d51177717d0247129c7098365631bcabf72e1a94","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.769217Z","times_seen":222,"resource_available":false,"data":null}},"time_used":5601,"timings":{"blocked":5169,"dns":0,"connect":0,"send":0,"wait":432,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/md.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.791Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/md.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-2aee\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: FC2476A7-1DEF-4BC9-AE26-D04FF2FC4967\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10990,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"add61dbd7a40ff1214a90e2b8a68ca35","sha1":"b0136dcbd64c4a64c53a17ef89a605ac2f03c62d","sha256":"2698bf285973232e934b50a5a7b94a234e7532168bcd7605b4e6e20f5508755b","sha512":"d7e11ff47c4efc8dd35385f99b4ddd346e2d93829d02375684298366408d98a50c27af8a8d47d52aa799d747a2ed84d388c1dae225b9b46676f546ab470a7849","ssdeep":"96:Lr7w215Yboy701lo8LZKT1lo8LopVdhgR2ZdLbK0jdmy4py1kYKNSFxG1xgxOmxs:7V5Ysy7SFcmdh02bKxB7UfHV1nfw5","tlshash":"7a321054d70c553cae0b07f8cbf9b9f41a0e608d61552298a27841b472652ffe8ffac6","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.744205Z","times_seen":243,"resource_available":false,"data":null}},"time_used":7098,"timings":{"blocked":6790,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/mm.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.799Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/mm.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 654\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-28e\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 83E33A54-456B-4307-9E8B-5430B8C8B302\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":654,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7a7639f1d1831a557929c60b1b966b00","sha1":"280516fb1404a78f8a52b8a73c6dcebefc728b93","sha256":"a092963e17a1d99b9941fbfec5b1c6cba788007164798f6d3a71e43be7b9307e","sha512":"d4890336758c4991be3a81942fa42925d910d05aa81a8f8d6925333dcd304d2b4d2cca5b0957dcd3e2b59d27051923fbb0c63b52067938fa83b74e0bee03a426","ssdeep":"","tlshash":"82f07365e569241dc6388365c3fce5ddc10b7087914b05dff6603a9f00786eb69c830c","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.778237Z","times_seen":223,"resource_available":false,"data":null}},"time_used":7596,"timings":{"blocked":7171,"dns":0,"connect":0,"send":0,"wait":425,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/assets/photo-C8YZOnQX.png","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.362Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /assets/photo-C8YZOnQX.png HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:17 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Thu, 06 Nov 2025 05:25:21 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"690c3141-b487\"\r\nExpires: Fri, 02 Jan 2026 01:47:17 GMT\r\nCache-Control: max-age=2592000\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726437=LQku4o/SnmHfqPhRUlKy429dZqXOiNSeVmzGEaAhs5aJ8K5DOwu4623no8Znj4Sno8cFlmRH1nXTof7eCehL2VDWrvRACwFRuXYqkgJ55Z3zlc4foh+4eqPcc++qP7/VQrMo3q+QQaV/6764kvf3+8hwMcM7iqdZT8vPF7GaiI0CeKj5TyMcj8xwf9/ixwMY\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 97E80E7A-EED7-4423-BE81-875CEB9DAFEE\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":46215,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 958 x 964, 8-bit/color RGBA, non-interlaced","md5":"4dfdf8d93d8ff3f709ee3c5eafd4d5a4","sha1":"c16711f19d22f4c7fc8e91087375b350f088eb77","sha256":"76b774369681c9d05d8036dc9abb2b5836da2854d523ee5079eb6c6ceb08cae3","sha512":"88e3b66dc20e7958222e6d07af4ff7316f2d394b60f2538ad29db26fafc9d600217e69a94efbe77c3c6cb1c5137e7bf57f84b5d540848b52999737ba0f59ab8d","ssdeep":"768:QWob2IgDMxpd3olI2dTShWEl0a0utSDE7EliG1LoA8rZHY5IfYxjSmC6xlCTpde4:Q5bFg0KImSx2aNtcE7mEAuLyjd5xlCe4","tlshash":"ed23f16dc314fdb2558b7f8044362b7bd7c0193c77423384ed8fae6eaa441ad89191c9","first_seen":"2025-10-15T09:28:31.520679Z","last_seen":"2025-12-07T03:25:24.497623Z","times_seen":10,"resource_available":false,"data":null}},"time_used":502,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":476,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ar.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.423Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ar.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-d48\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 6C721C86-C58F-47F2-BC8E-C0984A7736BA\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3400,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2105cf53955ef7f44611dd94aad37bc5","sha1":"1042c173bbbf1c498ef0cbc5a44ee7bbf4753940","sha256":"8e3da092b4a0b77c3513b0544694d26e36c2e0dcb6347b10c3e5656ca50c636e","sha512":"d3af202f6ccbc24dee07862683a9b65a058911809dcbbb0d86a45d432f67541d64e6898d46c324ac8312ee0e2ec7d65dedc2bb1d749a69bfa7accef8943b60aa","ssdeep":"","tlshash":"8b61d038e658941c8979476ccfe9e09cd10f90978297435ff624b0ba12787efe5aa24c","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.804955Z","times_seen":107,"resource_available":false,"data":null}},"time_used":759,"timings":{"blocked":440,"dns":0,"connect":0,"send":0,"wait":319,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/am.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.425Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/am.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 217\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-d9\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 5FB4FA6F-A924-45A9-A0C1-213A058CFBD3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":217,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0e550b179e6690b8288f1c82ca85fa0b","sha1":"a778e3dade1a77e5a3747a7485153ce65db9fcac","sha256":"7668f3e2f8500fe9be15ab42b57a367b75c69139c4a547549e081c1c6355502b","sha512":"7d73ffced112fe4cd0322719e519053604590317b020ef15254ba088463d547f516e25e2df2d7e826b6c41ff82d07080543448c8e37592a71494d2f3c66c1c98","ssdeep":"","tlshash":"bad0a99aa23c7a054504c6700ea872d2c2daa0c6241c00cef8b0296a210aa9facca9a0","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.814434Z","times_seen":227,"resource_available":false,"data":null}},"time_used":1065,"timings":{"blocked":757,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/kz.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.748Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/kz.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:23 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-1b48\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726443=I4674F6+qGthWbm4v3Tt0iNbk3z6+po3UlqQ2MaISR5nR2xgr5MqYkIFQwdSOmaKQbq1BcSDP/84sx/DiinN0x7TrBe7BNmVVDYIU5FRdHsNlW74GjU/fuv8I2g3NyT+ijVjk+QCSxrC2nJRjJe6Um3OQ2z4lS0yfuytGceq6oqL+9hqJ65LMguuPQhCaKAr\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 89A21C1C-F433-43E5-A35A-A88DC2BE2049\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6984,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"16ebf53733ea3234983a309a33fe8603","sha1":"4bd3cce368ecc17cdb04fbeeae28e57e78127bf5","sha256":"c842d9b495c7bddf464f70d8e68c8a40e23d7ef44a5a5c2c0fcbc6708939888f","sha512":"584edb49c55dd95e3e70797053ce1fb3a09e2599cedcac16cfc5013ba01f994f73249b81d75cbef4e947edf7baff7ab2069b1088721d411b20d5edbccaff0591","ssdeep":"192:FK7q68xD/yAPfGFYyvGVpXowG5sX4B4XJnk6UWSmDzNk:gG2WyvCYt5U4BavSz","tlshash":"d9e14438d384d2bcee6697b8c732f0b8a14f607da1e1c32a977cd5b062550e8d29d8c4","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.93621Z","times_seen":110,"resource_available":false,"data":null}},"time_used":5626,"timings":{"blocked":5313,"dns":0,"connect":0,"send":0,"wait":313,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/us.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.885Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/us.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:29 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-111e\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726449=vpeLL07hSueq0AZCW6GeZzDzGXWNqgbHdB/f9gPaWa5wNt3jaQKShVLZJ3pCKPgDVau5/AM3hUP0wq5SjFAkOc6CuqQCVF38P64YVQmqr4RgNwtd4wSSZrqQ+faVlTTccpGqvwWY0z09ahWFehlg/sZF4asfYvoTSYjCKHs880Ypey29i+bTJXY1/7lnEDNX\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: BC478699-D59F-47E3-8EBE-A654305D82FF\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4382,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6ba630fb967bad07a4172ee6ff2976a3","sha1":"1ec459129afbfb27dee688630b04188b5cafe863","sha256":"7981ae8073dd09a609bfd06ea836b74e19f21991fd46b7afb190ed0a02ce233c","sha512":"9086238bee2a83a65ed134da96fbce139eb37a613eadefb8be38b8159489fc4713beab42c9413aa44349935c3f7d0a5b3e7d973ddd211bcca54f3d97ad6b2787","ssdeep":"96:sehyjPh+m1Ih1Kh0gHhG0g0hMldGq+hiBqrBch02hp:sQyj5+8W1kTBG0gq2dGxiB8BCTp","tlshash":"e691f975238441f9d8875e7ca30f36f1016e722646ec8653f1fcb59020609e2eb9be7a","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-08-10T18:48:37.655412Z","times_seen":115,"resource_available":false,"data":null}},"time_used":11488,"timings":{"blocked":11181,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/vn.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.892Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/vn.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:29 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 444\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1bc\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726449=vpeLL07hSueq0AZCW6GeZzDzGXWNqgbHdB/f9gPaWa5wNt3jaQKShVLZJ3pCKPgDVau5/AM3hUP0wq5SjFAkOc6CuqQCVF38P64YVQmqr4RgNwtd4wSSZrqQ+faVlTTccpGqvwWY0z09ahWFehlg/sZF4asfYvoTSYjCKHs880Ypey29i+bTJXY1/7lnEDNX\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 1732F129-090D-4F80-A301-7B10BA7C5264\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":444,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"026529c37a70526cf135fb4942ebd3db","sha1":"f6b0f347e5ebd584e46a9bfde5d2492efbfe4e47","sha256":"4dd32e886df61611c644d0f8af6924b6236dfbaf136e0d17f1b2669f255668e6","sha512":"c86a68b1f23ddde4639072eb90e0c2df325c369de30b8f725c5e0c97cbf39ce3f73c84e3dc197466c85c6e1105a9514f881352154d4c90143df848506746e625","ssdeep":"","tlshash":"fff0a365f179d1bd1e0e4ab08bfc7ac582ef31cd419508ddb1d02a2e10a962e61e5351","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-08-10T18:48:37.631168Z","times_seen":226,"resource_available":false,"data":null}},"time_used":12017,"timings":{"blocked":11591,"dns":0,"connect":0,"send":0,"wait":426,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-03T01:47:13.129Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:14 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Thu, 06 Nov 2025 06:17:40 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"690c3d84-62d\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726434=a/mX0GdBoO3Ev6o+WUwBcVDqU+Txknbyvm8uOstduM3eEskYJpgJR2bTF2V0hjHHrgq46S0Qg0z/It43BdY+lOH5Dw3tqhzxscxxVdwJkIl0kdNupvaIHL1XrGjGIZ7GuiS/6wwjCE8hwO0M8cg0Ay84EpKwLqva1ii4cGXXjq8FJi/LtEOyoqFLA7sVgmF2\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 9F01FAF3-D5A4-4B94-8E11-FBD8FCFB7786\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1581,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7d3396ad261e118eba7d44f1669e5753","sha1":"817f0bb06950841e0813e8fb5eee8d6eddd9484b","sha256":"22a3f3adb7708a35d8399a4f5a1e3f2fa6fb06d39afc7ab559c75355b1c6ee2b","sha512":"34d884d3d6e747761ec3f0ac0d43ee089d3feafe8f7fdca2a7cf73d21f63a38d596218c9187bae6c99b8f6eaa49f0839b6fd068a72487cd9fe7a26ac4fc773f1","ssdeep":"","tlshash":"f731115304446f4f1338d3296146e08c8aa39c35d559acf1b49b61eface4fc9c5af936","first_seen":"2025-11-08T03:51:01.931356Z","last_seen":"2025-12-07T03:25:24.125297Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1988,"timings":{"blocked":838,"dns":237,"connect":294,"send":0,"wait":308,"receive":0,"ssl":309},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/td.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.536Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/td.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 241\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-f1\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 9FE5290D-CB17-4A84-A545-4FBA3E747747\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":241,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b8b5114007087e67b07ecbf93c0fa3ae","sha1":"bd861e3f3c703a53290550cd50804aaac51ec60b","sha256":"95de54178e146d756158aaedddaf5984012a5f90df89e3bba145adc3b4539850","sha512":"9aee413f24808ce1d763035b1d744ed5be43a6f5987d004c6131583a2de4a0dcbdd794b56f1faa7c33c69d3d33468fa51b40358be438f5cd7a16c79d3b4c4c64","ssdeep":"","tlshash":"08d0976a83bc6c0466091b705b4c30c281f6302aa0dc00ecb8c041e4204ceabfcc9c74","first_seen":"2023-10-28T02:46:19Z","last_seen":"2026-03-09T22:27:09.790653Z","times_seen":230,"resource_available":false,"data":null}},"time_used":2726,"timings":{"blocked":2304,"dns":0,"connect":0,"send":0,"wait":422,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/lr.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.771Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/lr.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:23 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 661\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-295\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726443=I4674F6+qGthWbm4v3Tt0iNbk3z6+po3UlqQ2MaISR5nR2xgr5MqYkIFQwdSOmaKQbq1BcSDP/84sx/DiinN0x7TrBe7BNmVVDYIU5FRdHsNlW74GjU/fuv8I2g3NyT+ijVjk+QCSxrC2nJRjJe6Um3OQ2z4lS0yfuytGceq6oqL+9hqJ65LMguuPQhCaKAr\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: ACC71328-A5A5-46F4-A622-25AB908E75FD\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":661,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d979880577d783c9df87a77fe612fdc5","sha1":"d3aaeb61ed46b010e63a6461548645183583357f","sha256":"d04dcf3fe1bf2b578fe1a7929c88933a969f80cd61203a57a8aed9b07405e01d","sha512":"6d1d64e575c0aeb70d5b5366201f0ec8b065e977cbb235ec351e79e5e80322107765b99e78f1f7b552fb544a3fc5864cfab521458059fb98cf37fdae029bc31f","ssdeep":"","tlshash":"2a0149c15139a3a18c8d07788aac34c75097744eb89557dcf458166de06c29eb8e8f6b","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.83055Z","times_seen":226,"resource_available":false,"data":null}},"time_used":6345,"timings":{"blocked":5917,"dns":0,"connect":0,"send":0,"wait":428,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/fm.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.790Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/fm.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 725\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-2d5\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 3B8BFDD5-949F-4F39-8333-C66ABB20B432\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":725,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"16c55b67fe0f967105bd2bb5e406e2ab","sha1":"d6592485f59d482e79167357bdbbda83c1ae01eb","sha256":"af1b4df6839192e3a6aa93a4ce5edea867191b49e12e436b013cdb60d14d010e","sha512":"7c5490451d7b90cef56e4e8880bb9b238eb1582b6d97724352f8c064b13a2f406de287a7e2aa2b4b8146ef427f0268a25bd80595993fd65bb05f70a41a210c1d","ssdeep":"","tlshash":"7f01dc4fd270f638dc2a473dcfb870c8154afd8f3c42095930a13931722988e028ca9b","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.959755Z","times_seen":228,"resource_available":false,"data":null}},"time_used":7178,"timings":{"blocked":6755,"dns":0,"connect":0,"send":0,"wait":423,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/lc.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.839Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/lc.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:26 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 339\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-153\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726446=ptucVn3RIg6hfG1GeWyp0AOoGEPAGvUxzyHSXVviuYCOqdey2OA73hpJTOX54tL2yISiTotdyN9pyxfwsajn2g0X54hFpCzrKsSaHVr5h70Mejg6ceFPn+LFJGC2CRvHpMAwSOEi8xEAaElkrPte2SNNVvoHXHWjyZywau+M/ET7sJheupgJLbbmcQTs3DWc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 63973D01-4266-412B-B02E-102494A69173\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":339,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f2f56704790f8a9c234322a61f252e24","sha1":"ff28bb9bcd3538e120c5cf01912fcc45b79fbb42","sha256":"cf91e03942862a04ca2033821c420fa50b30fccbe7d52aa2433ceb45ba197186","sha512":"6667cbfdcd7fa24ad3fb127066d0d94eb815ef7170c65238d2d8cc08692de26f57d3a868c4c334261f50a84810710a74c041bbb224cd33d7e27347be53d51398","ssdeep":"","tlshash":"44e026b99165fabb4a4a9bf69fb87bc100e27049844804ddf9b41132104caabb8d995d","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.781507Z","times_seen":225,"resource_available":false,"data":null}},"time_used":8988,"timings":{"blocked":8677,"dns":0,"connect":0,"send":0,"wait":311,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/sc.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.849Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/sc.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 300\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-12c\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 6A22E7C6-284D-4FFE-B2B9-8020FDBBE93C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":300,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"39e4cdd4a6c98f4a5e09ad04d18fccdc","sha1":"03c8040e5495afab0d05ba06b06d02fa570349f2","sha256":"4c7f566b3b1f5ebacd2c077629d8c9ee8316b4eedeefd3c2461c2b45e0638bd0","sha512":"4b197930ab915cee1a997ea5e62ec1ae072ddd96684a1e4ffa3df4ade56e2a9e438ada30a412a8a85ed3a6dcc82a2dcf419dea09e6148cd0f2aa70165e63d458","ssdeep":"","tlshash":"65e0c2d4933db428094387b10bbdb1c280f634ca604d01ddb96065a1236e7fbfcc1a20","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.941291Z","times_seen":228,"resource_available":false,"data":null}},"time_used":9609,"timings":{"blocked":9296,"dns":0,"connect":0,"send":0,"wait":313,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/sk.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.852Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/sk.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-499\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 3325E99A-2F51-4F69-8B40-5882C846318E\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1177,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3378a8c0b1a0ba7f3b00ca635d5d01de","sha1":"c8e43ab87cbcf20c2ade0780916c1728eed90e62","sha256":"7e3e9b9bb6be56c62bce8f4961074b050e0357fb98eda9a1cf83f6e4c1f8021b","sha512":"aeec54d0865dc2487c8babda7f0d63d255b6ea426484bfa4ae55aec963e8cfd09b6b0af995d6968281e70460fda60e7353399e10209def8a74f5192368b18b90","ssdeep":"","tlshash":"7921fe6cc2e0237c8808cbb4578c24a1d24731fdb055939da13581a4b38b9fdf4cd889","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-04-10T22:06:56.993666Z","times_seen":109,"resource_available":false,"data":null}},"time_used":9691,"timings":{"blocked":9371,"dns":0,"connect":0,"send":0,"wait":320,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/tn.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.875Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/tn.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:28 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 695\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-2b7\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726448=scd548NbFsDlriR0p8lcpUSKGtPYT/fhUWpMVJoPGmWaQsF6U2I4BLnmRc69+bG+K/nZb5Nxfo6gYAUxm5/nVRo3rZ9J/GkSGOnre0pGmz3P/71ZNnUJKWEajfGx+N9q7mMdvR0KEp7aCj0WGUT104FuneAtUScTjVMzQbAizsq6TW7mypX6QZoLYJ3c+43j\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 1E58E5EB-18A6-435A-8D2D-49BF22FE878E\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":695,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d989dff7151089b09c3b37e8fca487ea","sha1":"bb93b419e4d737f21f4ff7017ff612bafc658874","sha256":"251c43094daac8273256d941b27c14b9a75a1d5467c8edc2efd217d0369fa38d","sha512":"9621389d9b61a855da9a37f551ec3cfdb5ac79b1da3c6554f470bcdee57784dad4e210acd44827a771d386dd53e62583d38e54d0292b6ad5b00137ca658c253d","ssdeep":"","tlshash":"ba01f48ae0b9e37c8a5a47f44bbce8e101ad30dd609141eca1992076b1257af50d6453","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.89107Z","times_seen":226,"resource_available":false,"data":null}},"time_used":11150,"timings":{"blocked":10700,"dns":0,"connect":0,"send":0,"wait":450,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/bj.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.489Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/bj.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 431\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1af\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 40CA7AD7-F088-4CE5-BF7A-7A7265708982\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":431,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"21c76716871414b304009bd056330098","sha1":"6eb75569def6fdd0fc7165b81398f509ef8329fe","sha256":"8fa20634181360dbcd4f3835f66261f1be1195addc8dc43334631e4941359e52","sha512":"286632635562cc9781d56efea09cbfe02c7e9179cb3198de5e7b84ffc32a8f75317917f7aedb2a98ab99ca1fd93b0274a6af4f0c3ca6025f93a18563cb8eaf57","ssdeep":"","tlshash":"f1e0a353a774e04d1505837457e83cc95239700d11084cdc70b41769641eb5fbcd2665","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.800117Z","times_seen":233,"resource_available":false,"data":null}},"time_used":1618,"timings":{"blocked":1310,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/la.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.761Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/la.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:23 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 405\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-195\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726443=I4674F6+qGthWbm4v3Tt0iNbk3z6+po3UlqQ2MaISR5nR2xgr5MqYkIFQwdSOmaKQbq1BcSDP/84sx/DiinN0x7TrBe7BNmVVDYIU5FRdHsNlW74GjU/fuv8I2g3NyT+ijVjk+QCSxrC2nJRjJe6Um3OQ2z4lS0yfuytGceq6oqL+9hqJ65LMguuPQhCaKAr\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 299968F8-DAF7-4663-963D-776EA5385301\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":405,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5c02f689dba21c5de010a3b1de447554","sha1":"e3b88fbdf03b1e4a2e0f403861e26c6f7cb3a5e4","sha256":"8a507abc24df63e953fe6bbd46cdbfa942da81e74bc44fd68a023da939f70bca","sha512":"0cbd02001c5ec8dcac47b08005014b459909154d1910464d40795d678dd4242248279dceee411ca34e0a0b09093d20a057157945b95b321d525ea0a4f638dd22","ssdeep":"","tlshash":"55e02bbe5478e4582f1603f08d6c34c385ab3088548801e9f4ddd23d525e777a9835a0","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.793864Z","times_seen":224,"resource_available":false,"data":null}},"time_used":5926,"timings":{"blocked":5614,"dns":0,"connect":0,"send":0,"wait":312,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/lb.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.766Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/lb.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:23 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-abb\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726443=I4674F6+qGthWbm4v3Tt0iNbk3z6+po3UlqQ2MaISR5nR2xgr5MqYkIFQwdSOmaKQbq1BcSDP/84sx/DiinN0x7TrBe7BNmVVDYIU5FRdHsNlW74GjU/fuv8I2g3NyT+ijVjk+QCSxrC2nJRjJe6Um3OQ2z4lS0yfuytGceq6oqL+9hqJ65LMguuPQhCaKAr\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: FE8C55FF-E50C-45CE-B38A-8463109BF655\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2747,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"913596a465ba98f9f7481a1920e807fa","sha1":"fcd180a816e527a61bbbc8b93e249e42f1ee24a5","sha256":"7a7191c08d7478adb7513ce81518c78135abc4950ef423a5f1b00abc4743ccdb","sha512":"c8f32bbe4d48454f6f88173d5f76818ba18028366b8ace52d2a2842cb0dedc92e0302a01622d64864f58220968de186ad835c466aa0e55a2ab68cfd7c7f9063b","ssdeep":"","tlshash":"19511f24d32062fced978fb9c73830f1b0af62be60e5d368627888b471a85dd519c8d5","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.766329Z","times_seen":109,"resource_available":false,"data":null}},"time_used":6163,"timings":{"blocked":5735,"dns":0,"connect":0,"send":0,"wait":428,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/mr.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.787Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/mr.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 429\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1ad\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: F67EC5D2-2A8F-4DFB-9DBC-E09005B9E12D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":429,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"61eff7fcf44ae752bfe025f0c78a401b","sha1":"4720e86cc27a4020306161d8ed5a2ef3963b6a6b","sha256":"0b33c98b8137b36495698d205a1fb646a64d67221e8964c51128959cddbcb6bc","sha512":"bed5feff487f0d17fb5d9731e2861f49fb8a23ae0655bd3f5958c5262167e8f6df7d66c27d3c7f2efcfc1e60a451ca561d80c659868cd15fd4a34bb9244100e5","ssdeep":"","tlshash":"c1e0ec9587bd3d7c49168661057a34de428fa06eb00402dd5dae0530358b7efe986c52","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.857837Z","times_seen":223,"resource_available":false,"data":null}},"time_used":7074,"timings":{"blocked":6645,"dns":0,"connect":0,"send":0,"wait":429,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/sm.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.845Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/sm.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:26 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-3d19\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726446=ptucVn3RIg6hfG1GeWyp0AOoGEPAGvUxzyHSXVviuYCOqdey2OA73hpJTOX54tL2yISiTotdyN9pyxfwsajn2g0X54hFpCzrKsSaHVr5h70Mejg6ceFPn+LFJGC2CRvHpMAwSOEi8xEAaElkrPte2SNNVvoHXHWjyZywau+M/ET7sJheupgJLbbmcQTs3DWc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: AFD3C778-E69A-40A0-BCEE-0167861290B5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15641,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7943b753b653e99bc8fc28f093d3e5e4","sha1":"da3c33acf9a8a2ceb8c74d5862d0ea42ed959694","sha256":"73fc22d11795af7eb12e35c74b5cf214fc80efbb21fe1f54eeda95232f0b5755","sha512":"aab2ed736e98b92ca5d949cd076a971b817108f4da23f706888c2cceaaf631c575275f73cbb5d0b5a79a3c0a86197542551f4a4a60ea0cdca2a2b021c833885d","ssdeep":"384:sy+mWvFWSQ8elTJbkXobwtpYMFfefjSpdPvZh6/O7MC8tt:niV5ULC8tt","tlshash":"796220bc4718957ced5347bccb3b70f0a15e64daa1e89365522cd53021a16eee2afcc4","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.852332Z","times_seen":241,"resource_available":false,"data":null}},"time_used":9254,"timings":{"blocked":8939,"dns":0,"connect":0,"send":0,"wait":315,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/sb.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.854Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/sb.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 893\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-37d\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 48D82CF1-45EB-4165-91C7-C01A75832623\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":893,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"15d317e4d4b274269e98479eee2e8b12","sha1":"946bc5097d566835a4b80a13a16640d5144b4f55","sha256":"a17a8233911f5f8a48114b8d00335f6035a9113279ba3afcc0bed7de74004611","sha512":"699bc9d88b81e8960038790ec2c52bbddacd93f9eb9d7bfc51b3c32ebcc194674a3fc1a63efef552162c79953feef006308d271500c2cb4d901393a5dfc9adad","ssdeep":"","tlshash":"921129414138db68de0757b0ce69e6e2409e616ff1517388b2d0222b311867e85f96ee","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.837613Z","times_seen":225,"resource_available":false,"data":null}},"time_used":10036,"timings":{"blocked":9604,"dns":0,"connect":0,"send":0,"wait":431,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/uz.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.887Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/uz.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:29 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-4f2\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726449=vpeLL07hSueq0AZCW6GeZzDzGXWNqgbHdB/f9gPaWa5wNt3jaQKShVLZJ3pCKPgDVau5/AM3hUP0wq5SjFAkOc6CuqQCVF38P64YVQmqr4RgNwtd4wSSZrqQ+faVlTTccpGqvwWY0z09ahWFehlg/sZF4asfYvoTSYjCKHs880Ypey29i+bTJXY1/7lnEDNX\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: B841B15B-F28C-4968-8360-D662C5E8868F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1266,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"eab035dac533204803ac61c6379157e2","sha1":"609ad67ac5fb15875994fc600987a8dd31024c6f","sha256":"3971bacb3195a83432c14bb1fbc79673542c8deab03bf5775f245793eeeeed35","sha512":"efd5c797a551de3c787480d568a9bf68e0bfca92210ebc69884f79516e36ee19fc1a2bbfff59838a9af7a4031c5f63cc9f3bd70c2b0671fba62ef1d8ebb4b0a1","ssdeep":"","tlshash":"f2210815e18d200c8639639cc7fae0add2177047a34b0a5ffa60365f517d9f7a9a420d","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.796635Z","times_seen":108,"resource_available":false,"data":null}},"time_used":11628,"timings":{"blocked":11314,"dns":0,"connect":0,"send":0,"wait":314,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/zw.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.895Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/zw.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:30 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-1a1e\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726450=17XxujQSpFNiinCflP8FJFK8Fu4yT9djqYIX4M5CplysWNflcTkibKH1XuXeqWUi6XJOrrQXfewN5CYuj9ooWQ+8o9pnggdhsR/5sKPmY+3+kywhOVVGAhR4BnuONiz00JY+3DFzEauIIuMLz49mzECZ+JOctgycoxJaNVs2ouZSOUfCmD/kOTSOBLxmV6Xf\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 2508881D-954C-4D61-BC20-413819075D7C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6686,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b908b3ed37c02788bd41e8e951ead232","sha1":"7a49e3f19e5e60fbbfe95e39d40443403a1cb314","sha256":"be07bff595e260737a4a8f7823afe3ade6b095df794e8db0e9c49251dd8c58fa","sha512":"0999191614fa14e483120db68310d8ce134e4d9d8f5d25849dae64751016db53174349bd017a1f86f713df21a6514f4e1e2e3d72a8970e052c1c828b3e3da7c4","ssdeep":"96:+7+40bwsexsenTIngsBZ6UTL+T30JqT+g6MvhI5BggNOOzzuUNT5PQVf6tn6O:UV0bwsemeTCs0pS9SzuUNhQVfoj","tlshash":"8dd1693c839cd2fc9d47d6a89e75a271934ee0abb1eac370966e817012930cde29f455","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.797474Z","times_seen":109,"resource_available":false,"data":null}},"time_used":12269,"timings":{"blocked":11832,"dns":0,"connect":0,"send":0,"wait":437,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ad.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.396Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ad.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-80bb\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: E6EAA1F6-8B70-4EBD-B511-A96AF41003F5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32955,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e5b5ca3fab8e8137384623f8e2e4a6a5","sha1":"21c7293ae2792e737bcad4fbe47dd572476a5bdb","sha256":"83474ad796f10a809419d707afc48ee217be04b9617e0b17f006bcaade527a1e","sha512":"db01212bb922f59ca781eadbc2a8bd00d7b43249d5f0af382a7e21507a4eabdc501f45f77f226f0b45f00166f1073af62be31b71a54e084fa4ae7ba1f08da31f","ssdeep":"768:SM08QAgXiNIPFhA8ZQ8GoarhZ50SzBOXhF:SLdDXiNIdhvZPMVZ50SzAhF","tlshash":"78e2ef7c4758d3bcad639bbc9f2650b0920ea0e9a1e6c355866dc23022d31ddf29f895","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.764762Z","times_seen":241,"resource_available":false,"data":null}},"time_used":1810,"timings":{"blocked":600,"dns":1,"connect":299,"send":0,"wait":597,"receive":1,"ssl":309},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/fr.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.645Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/fr.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:21 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 266\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-10a\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726441=JHGeMlqLy0gB5ak0wqadFpXGs3jM0Lo0M6zpM+XNz231JxpbP0A40EIy6YAGOKWCUUKvhgxieDl2ZDNrB4enQOS9H/6MwGnh5UiaeNYNMLt++1i3qhK7sfzsnGPa7MewtPpo89eienZJybDLK4IakcYHNlxcLcw8BoCYNUG75GMW74KuNPfLYIP7Dw0B494o\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 698CD58F-40FE-4088-9FD0-4CE79940AAA7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":266,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c68812ec575ea9a9e195d0f4e0887400","sha1":"997afc5884a03a9dcdb030be92268685fb4bedaa","sha256":"87e8645832821ad414dd0fc6cd135a1d5af8752371ca99c8c0ae648742dd8a9d","sha512":"dc15cf123dc0798d71774afb63ca03c41d505edea3badf214db1b85557296532ee2d3c52252276c5b7ea93131e93ba5ac254d174c9d20c0bbbbb196427366bb9","ssdeep":"","tlshash":"92d02ea9823db814060947388b683ae288fb3089608800ccf8e01164620d3bb2ccbaa9","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-08-10T18:48:37.658204Z","times_seen":254,"resource_available":false,"data":null}},"time_used":4182,"timings":{"blocked":3729,"dns":0,"connect":0,"send":0,"wait":452,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/gm.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.653Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/gm.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:21 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 481\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1e1\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726441=JHGeMlqLy0gB5ak0wqadFpXGs3jM0Lo0M6zpM+XNz231JxpbP0A40EIy6YAGOKWCUUKvhgxieDl2ZDNrB4enQOS9H/6MwGnh5UiaeNYNMLt++1i3qhK7sfzsnGPa7MewtPpo89eienZJybDLK4IakcYHNlxcLcw8BoCYNUG75GMW74KuNPfLYIP7Dw0B494o\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 2F7D9621-F030-4F3D-83D4-C34763D3888C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":481,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"55937eac5d469dcaa523de05dbb33124","sha1":"cd1eef1f5e7c09464e78ce317fd62e0ead5f2f92","sha256":"7491f82f7e5f42ef9689978ffe03c832996c929048a87cbd169b9541ef6c2c99","sha512":"f0997abb3fb75311575d924a2e1b2ea62d5aac02b81b2d9eb7f51275c0a0d11bac57feb94892308a554b7e63a8c04dc5e74485b5ee92935ce97c36ad747f52a0","ssdeep":"","tlshash":"7bf055929578b55c1e0a87b08fec79e781ba3089905902cef4d0122e321ebaf6dc5696","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.889003Z","times_seen":227,"resource_available":false,"data":null}},"time_used":4189,"timings":{"blocked":3884,"dns":0,"connect":0,"send":0,"wait":305,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/kr.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.754Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/kr.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:23 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 901\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-385\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726443=I4674F6+qGthWbm4v3Tt0iNbk3z6+po3UlqQ2MaISR5nR2xgr5MqYkIFQwdSOmaKQbq1BcSDP/84sx/DiinN0x7TrBe7BNmVVDYIU5FRdHsNlW74GjU/fuv8I2g3NyT+ijVjk+QCSxrC2nJRjJe6Um3OQ2z4lS0yfuytGceq6oqL+9hqJ65LMguuPQhCaKAr\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 47019A0E-E0FF-4BDE-83A1-59FC3DCF4C68\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":901,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7678e777baae73226532dd40caf3942d","sha1":"ffc7aaea7b834d8a03fd816dfdbb1e56526d6253","sha256":"faf6bf3541abe47b02f51885e122cc1fa73df8c164ed137e5bd55f0fe784c55f","sha512":"88a7b7fc9051baeaf8aef3b510043383dca2f9b2620a8074e24cdc1ef32b20250459a5ee97ce5444c43494c66763427f5c42476e278918ac10182417e134fc5f","ssdeep":"","tlshash":"59116392a078e02c862d4326d7fc64c8832f309a17830addb9983035627016bbac2645","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-08-10T18:48:37.624195Z","times_seen":229,"resource_available":false,"data":null}},"time_used":5763,"timings":{"blocked":5429,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/kg.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.759Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/kg.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:23 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-ceb\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726443=I4674F6+qGthWbm4v3Tt0iNbk3z6+po3UlqQ2MaISR5nR2xgr5MqYkIFQwdSOmaKQbq1BcSDP/84sx/DiinN0x7TrBe7BNmVVDYIU5FRdHsNlW74GjU/fuv8I2g3NyT+ijVjk+QCSxrC2nJRjJe6Um3OQ2z4lS0yfuytGceq6oqL+9hqJ65LMguuPQhCaKAr\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 89050820-2770-4A4F-98EC-35F97CCDE1E9\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3307,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e29859f096c8589f77b0005862f2f515","sha1":"ba5b7c0b5eff0cd3d1212ba367ec3dca3d9985d2","sha256":"b39adc0d9afef797e42fa52777132c8c3811f8495f98de5050c6a28a26749b7b","sha512":"1dd56b1905162e3e7704a449b8d435b6f1761be4cc35d68bdfeafc95c648436ba95b826ae9cc709ddd0408a6681854acb7838ea7d9aaf4394c72d4facd11a616","ssdeep":"","tlshash":"83611f14e3a993f8ed628374833678b4294d498ea490d77c53e88cb0b67a5dea3dc4c1","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.820037Z","times_seen":109,"resource_available":false,"data":null}},"time_used":6023,"timings":{"blocked":5588,"dns":0,"connect":0,"send":0,"wait":435,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ly.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.772Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ly.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 477\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1dd\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 5D6EAC94-0E59-4D17-991D-1FF97B07595E\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":477,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"686fdea558b8f0500ba867a8b853e5a5","sha1":"e0c021203ff00a46217c1db34a840da5afcc4133","sha256":"523bc5efe1a20c95368cf7df211f588267014d90e763bcaf3d7b9768cf1ec6e9","sha512":"c06d660308d9d7f00a6c2e3f6cf3cfaf6afa84369954e64f43570a0ef64dce0d6c73f7bdebc31f9722d4003b556c7dc6d6b8b5477929ebd0b912a3797fd301a9","ssdeep":"","tlshash":"82f05455e0bc510cde0907204ebab4c210fd30d840c800ecb4940f74515dd87ae51514","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.883436Z","times_seen":226,"resource_available":false,"data":null}},"time_used":6394,"timings":{"blocked":5970,"dns":0,"connect":0,"send":0,"wait":424,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ni.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.805Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ni.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-4555\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 1815391B-D246-4593-976D-566A4899EFA7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17749,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2b99a1514f205d0660b4d81637d0b64a","sha1":"8e052117fb223ea81b0301ef5254a26da4afb910","sha256":"67ee6d7bce6ad51944e466e344d7a94bb9e66f200e84ae2af3c6cf0af99caeb7","sha512":"ee768a9d06823cc1b6d09cd1678532987ca7ac685a8b890d24aef942b43d19e63e848e544a624352a12d168ca73d98c91c71cb2968950f4c3f1956933831a5e0","ssdeep":"192:sBfpnsBzS2VU3qpSGzSxU2EUJ0F+SF8I/sKbetskHHFwhS6xjA/1e/UtlsuAXouj:8f6G2VUa8o2rS88S6JQ0UtOA6M47/","tlshash":"0982203cc76ce27dec6697bccf2590f8520ea0aef1d68356971ce13015a61cae24f859","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.745201Z","times_seen":245,"resource_available":false,"data":null}},"time_used":7968,"timings":{"blocked":7536,"dns":0,"connect":0,"send":0,"wait":432,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/py.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.819Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/py.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:26 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-4066\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726446=ptucVn3RIg6hfG1GeWyp0AOoGEPAGvUxzyHSXVviuYCOqdey2OA73hpJTOX54tL2yISiTotdyN9pyxfwsajn2g0X54hFpCzrKsSaHVr5h70Mejg6ceFPn+LFJGC2CRvHpMAwSOEi8xEAaElkrPte2SNNVvoHXHWjyZywau+M/ET7sJheupgJLbbmcQTs3DWc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 0DFB8B2E-4D50-4502-9A64-EB3737156C4C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16486,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"268f36b502ed9dc192475a3d58828d6a","sha1":"749472ca802b007b265a7c41a1478ae8f237821d","sha256":"14705fe32203658ddcd629d98e1de7304e22637eac9219d973518dcd2215c0a0","sha512":"d3f298e01050283cf42d674de87316c3cf979d4878f475cb3f6a3b56c250f4d80edaaa9b667878a0fdb9ac1d019cb97513c20fa78da669b1da312a2a6e4a9757","ssdeep":"384:aNLYTbdlqR1gz/0IJssdT+cqFO8BLq8y9osU8:aNLUv81c/0IJsyswW808","tlshash":"b1729b2c461cf2bd9d5387fc9fba40b0901da0e9d1e983599a2dc33013925edf5af988","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.816216Z","times_seen":245,"resource_available":false,"data":null}},"time_used":8617,"timings":{"blocked":8166,"dns":0,"connect":0,"send":0,"wait":451,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/hr.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.588Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/hr.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-a157\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 950B2152-8982-4F8F-B724-3EE99BD9612E\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":41303,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4811a1285a8da7869858cf039e0484e3","sha1":"6db889a2a181eb0e4799bbcae84c0b1b56d35e06","sha256":"ad165ab5042b5bf3c2f053db19f9e1415582dfaefc69c8ce4e4f18eac78efb1e","sha512":"ecc31f0162fd193713af835744640264e1cec7f49e15242bf40a1675eb61aea0d92d9999fd3b9160ed9fd5f864f66fa7f0ba72af3c22dcae4a5d2701172364eb","ssdeep":"768:nEwRw1DFY5LNkB1iaRWyh+XckVZPCrJ/O8/t6AkWkxt:npwghE1iaRWyhUcqZKN/T/t6AJkX","tlshash":"cc03ef7c8a6c93ec596be3ac9736d564530de1b6707bc3158eadc3b001c38dae667881","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.82623Z","times_seen":247,"resource_available":false,"data":null}},"time_used":3183,"timings":{"blocked":2708,"dns":0,"connect":0,"send":0,"wait":474,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ec.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.614Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ec.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:21 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-7047\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726441=JHGeMlqLy0gB5ak0wqadFpXGs3jM0Lo0M6zpM+XNz231JxpbP0A40EIy6YAGOKWCUUKvhgxieDl2ZDNrB4enQOS9H/6MwGnh5UiaeNYNMLt++1i3qhK7sfzsnGPa7MewtPpo89eienZJybDLK4IakcYHNlxcLcw8BoCYNUG75GMW74KuNPfLYIP7Dw0B494o\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 35FBB52F-1987-4B18-A374-132FED2A56FD\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28743,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1f6689e43bda84d65d0783dd0dc4f5d4","sha1":"67925b5d117d4e9ee1d875f70fce197eb665f8a6","sha256":"c21f40e8ef3a4bd3253b5dd9b706f53bc8fc45314121998e6b749c843a9d3c6d","sha512":"7d31975f86f990ffafe4e67a4324c8bec8aef11eb4920051363ab7708504006421aac37748121325b1ff3e91e1b35b32a21a4d2c5f250c4c45deabc7b8649adb","ssdeep":"768:n1edp0o9zo9O1gPp0o9No9+DSAYINXGEW7IId79LZo:n1erpUO1gRpu+DSAY6XGHf9Li","tlshash":"bbd27658eb04c278dd4747f8cbb565f8540fa09c91da5398e27980b0b2246dee1fe6cb","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.74917Z","times_seen":248,"resource_available":false,"data":null}},"time_used":3651,"timings":{"blocked":3215,"dns":0,"connect":0,"send":0,"wait":436,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/lt.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.775Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/lt.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 416\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1a0\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 401303FE-2016-4BB7-A20D-238E96F4FC26\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":416,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"db7aadcf6e4c358e832b3f5d7302cdde","sha1":"da450f4f6830242c397d1e3176cd9f0021447757","sha256":"ac484a7317d879210b290f159e1eead68e27cf7bd9c283c7c982fb81676f8789","sha512":"65f3a5164819c45536fef44e4b21cc569e5f910e3c01169acc3fd17f115532da8684081331f3ddf639137914c02217f32532165aab1ab7d72d2b362328221ad6","ssdeep":"","tlshash":"4be0ab90e22ea458c5140839a3fd2df6025fb00746250898e86030de226c6ef7cf873f","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-04-10T22:06:57.060371Z","times_seen":226,"resource_available":false,"data":null}},"time_used":6437,"timings":{"blocked":6007,"dns":0,"connect":0,"send":0,"wait":430,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/no.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.809Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/no.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 301\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-12d\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 5C4090C2-5D22-43B8-8EA0-55F77CFBD7A0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":301,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"49cde69042b28c3cf4e544e27bae3a64","sha1":"a455b2bc0de29835d7328d310219a5cf9c5a314e","sha256":"8f1a6d877708c2ee2892d978fcc2f7a1b438793fccb260fb314075c1831e532a","sha512":"68df5c38783bef007be95562c500e7cf07e4585c9f08ac73cdd18118e58294a213ea73a7d09c8f851cacdf7faeb8435f050f7d3f2fa0ef9fa5ef0a169b8fb3ca","ssdeep":"","tlshash":"01e01ded913db4444a1593711f9d35e380e970cde08d02eefc500129628e79badc1d51","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-08-10T18:48:37.60345Z","times_seen":249,"resource_available":false,"data":null}},"time_used":8239,"timings":{"blocked":7816,"dns":0,"connect":0,"send":0,"wait":423,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ph.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.825Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ph.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:26 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-5cf\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726446=ptucVn3RIg6hfG1GeWyp0AOoGEPAGvUxzyHSXVviuYCOqdey2OA73hpJTOX54tL2yISiTotdyN9pyxfwsajn2g0X54hFpCzrKsSaHVr5h70Mejg6ceFPn+LFJGC2CRvHpMAwSOEi8xEAaElkrPte2SNNVvoHXHWjyZywau+M/ET7sJheupgJLbbmcQTs3DWc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 70CA8FE6-AC53-4997-8F79-68FAD69A5ED1\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1487,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"91047c3f21f702577afc3ef5b89f6c16","sha1":"5b08472c0d031bf8207ee51b4b8849e4d5f6c93c","sha256":"bb48428a3609c20efee16e0ec5330b0e3bfd0be0200cd84572a6a27528209cdf","sha512":"32211d5d7f617bd8074cb372478425b227379cd8203c54ffb9059fc090e5c6ae3005ee7f6fecd15472a0c485f5f18d9e899712782d286d4698618da6ee17d403","ssdeep":"","tlshash":"0331d09dc364837cd482cba80f7ae0a147ed65ff30b4c0c5a47ec1b224509e992eb59b","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-08-10T18:48:37.633336Z","times_seen":111,"resource_available":false,"data":null}},"time_used":8646,"timings":{"blocked":8223,"dns":0,"connect":0,"send":0,"wait":423,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/vc.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.841Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/vc.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 417\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1a1\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 688829AA-530A-4BFF-BE65-560F1555F870\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":417,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"675def5d5a381c5406d8c5b9b136c47d","sha1":"b7ce3a87fee3e16b5cb5bada1b733e2f16d43d21","sha256":"8fc50924b406edfca2b934ecee6f04b1255858c766ac55a254e38bec5ff06e74","sha512":"ae5322042b8fb3bac78aa070a442ba6634104a077f369ec35564c9e07c69fde8e288384ac3c4e27fdbd8d377dc9043343d7f9459dcaa258f62bfc27e79619e2e","ssdeep":"","tlshash":"0ce02b952774d850891d4bf8090c22f60959b085307f27fdf8904b38712d9afbcc05f2","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.878439Z","times_seen":221,"resource_available":false,"data":null}},"time_used":9329,"timings":{"blocked":8903,"dns":0,"connect":0,"send":0,"wait":426,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/tt.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.874Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/tt.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:28 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 301\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-12d\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726448=scd548NbFsDlriR0p8lcpUSKGtPYT/fhUWpMVJoPGmWaQsF6U2I4BLnmRc69+bG+K/nZb5Nxfo6gYAUxm5/nVRo3rZ9J/GkSGOnre0pGmz3P/71ZNnUJKWEajfGx+N9q7mMdvR0KEp7aCj0WGUT104FuneAtUScTjVMzQbAizsq6TW7mypX6QZoLYJ3c+43j\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 088774DA-08D8-4DA0-8659-46B5A0224582\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":301,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b0e6ddcda0cf83f303ce0b1b919d0f3c","sha1":"16861667bef3c1881423548a2fc07dae2f3ef011","sha256":"55d5b5f173a58039d74f1dc00b7375994cb8285cf0e41a985b2f5f0e920dffb9","sha512":"9ff3a8ed970d73508e03060b5b4f60e230f595654ec8c4ca364a25bf39cf3855df52c0f7ed8f3230f82f1b7fe430263cf82ee0228245c659537e2a99d0453168","ssdeep":"","tlshash":"77e0eb600074f8898a4507b48aac37c151bbb0d4bc4844c8b0e20138110e377acc1ac0","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.93258Z","times_seen":223,"resource_available":false,"data":null}},"time_used":11010,"timings":{"blocked":10694,"dns":0,"connect":0,"send":0,"wait":316,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/kw.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.757Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/kw.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:23 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 449\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1c1\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726443=I4674F6+qGthWbm4v3Tt0iNbk3z6+po3UlqQ2MaISR5nR2xgr5MqYkIFQwdSOmaKQbq1BcSDP/84sx/DiinN0x7TrBe7BNmVVDYIU5FRdHsNlW74GjU/fuv8I2g3NyT+ijVjk+QCSxrC2nJRjJe6Um3OQ2z4lS0yfuytGceq6oqL+9hqJ65LMguuPQhCaKAr\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: D65C9D6C-8775-42D2-AA1F-860F5ED51C05\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":449,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"77f245e1599844316454ef6315e0fc6c","sha1":"5b1b7653b2f95e3555a7a7592e700f250ae45457","sha256":"7a28670cf033ec001417b4b10ff4c39f2c13b8e02cbb4d5f1e61c5d9fe9d50f4","sha512":"03a90b85eda5f22404642d261024991cbdf9d1a5c26a1466e129d75c8d81acc3b0e6794389ecd9d4f11c10e5e631f28434f8649d1d052ac62b8aeb884b0e90d9","ssdeep":"","tlshash":"43f05cd6517eb09c1d4a43b45eec34c781ae218b114901ecf454262c650f22f2dd17a9","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.965275Z","times_seen":228,"resource_available":false,"data":null}},"time_used":5984,"timings":{"blocked":5559,"dns":0,"connect":0,"send":0,"wait":425,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ao.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.405Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ao.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-615\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: AF551D44-23E5-4E59-A895-F506E1FFE81F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1557,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d574feccc8195f908587945adcc029a4","sha1":"58d31b5e0381ab3a351a3725f06ca922be601736","sha256":"3490cb70ac5b6e5d768e2e77e4092f07057ce756c716d05fa6e3850ce2719357","sha512":"6d88210604927f105320eae2eca81cbc981ba99fa5448211d4dc0f216d265bb3f4a9133dd66b8aa2d4baa4a6c8d6ddc7777ac9b138f24efe22adb9ddbc99fbf3","ssdeep":"","tlshash":"c4318dbcc228e9bccd970bb4cb2c62f162eb619c2584597465ec813031266efd4de9e5","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.770185Z","times_seen":107,"resource_available":false,"data":null}},"time_used":1292,"timings":{"blocked":628,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":330},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/au.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.428Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/au.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-529\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 4476CBA3-1B73-4EB0-9581-0E080AD3D187\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1321,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"283926124f1c818e2fb747fa8c20614d","sha1":"483d0ffa32a55245e5287c4d25e6cec4fb4830b7","sha256":"160cdf83317cab4558a4a5a672ab40d86102d090ed133d074fb57ba3d313594c","sha512":"8af6427b98a886c07436d3036466ffe3c68db9f82b4590870ff943be73a8a7fb245edb934e3364ef1e7f16612d38200a074b88451e72dc70c41861f02b1af7ba","ssdeep":"","tlshash":"d721be64d2f5a334dd8683b41b283de0b85e117d9194e2ac51b480f0b3a54e9d4cc49a","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.961438Z","times_seen":112,"resource_available":false,"data":null}},"time_used":1235,"timings":{"blocked":799,"dns":0,"connect":0,"send":0,"wait":436,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/assets/uni.fbf350ab.css","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:14.404Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /assets/uni.fbf350ab.css HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:14 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Thu, 06 Nov 2025 05:25:21 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"690c3141-2d19\"\r\nExpires: Wed, 03 Dec 2025 13:47:14 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726434=a/mX0GdBoO3Ev6o+WUwBcVDqU+Txknbyvm8uOstduM3eEskYJpgJR2bTF2V0hjHHrgq46S0Qg0z/It43BdY+lOH5Dw3tqhzxscxxVdwJkIl0kdNupvaIHL1XrGjGIZ7GuiS/6wwjCE8hwO0M8cg0Ay84EpKwLqva1ii4cGXXjq8FJi/LtEOyoqFLA7sVgmF2\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 4DA14D49-4990-4450-8760-4C6C6C35480A\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11545,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (11544)","md5":"9e01389e52eac6106c7d625bef6776e4","sha1":"90cb2e46589c052c66ee57e417cbb5d16456101a","sha256":"fbf350ab5b9665f5eb509a7369b68c53243867ae369ffa31eb3b54b1921422c6","sha512":"f98ac48428e2492ff73124d68a241c9659b3976671c1403cb69e7c70985c31ff89d31a9317634f2869d4532d24c327c24d53d2644f0843ec68fc1fdf789d6ddb","ssdeep":"192:Ujj8LGJ0CQLnWL93XVA8e+l+tEDyPhcvNc/Dm4wk:UXpmLWL08VwV/CXk","tlshash":"853274319d02252ff57bcb2a15e1db8e2223c572c9122b3ebb3970684f9d1cd297a745","first_seen":"2025-10-08T20:57:15.900245Z","last_seen":"2025-12-07T03:25:24.762585Z","times_seen":11,"resource_available":false,"data":null}},"time_used":424,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":424,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/assets/index-DEEE4rsy.css","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:14.407Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /assets/index-DEEE4rsy.css HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:15 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Thu, 06 Nov 2025 05:25:21 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"690c3141-5b25b\"\r\nExpires: Wed, 03 Dec 2025 13:47:15 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726435=bl/HagB3nt0KeNnT/S5GeCr22BSiKPlKm0KP26bYKB5gXIXikRJuFQ+XxKhAHNChZpaL69ipZUDmiB+2ev1/+0yn7Watq+pXVVDGgK9WYNx439vwpQIRvNjLaO3ZCiz6jNnDh7S5PP6ccaRpuTeCPZEihIJr/8Hi9Z/7WrAjwBT/tqoegiBX8URLxroEIyaZ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 0CE9FB86-F4DA-42C4-9C70-00E017608B4C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":373339,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"b1a1361d566bc27d7bd305896dc6fad5","sha1":"03ddb9e11a86d7dc5081b9f919f7ec44e7a36b5e","sha256":"c25f74429b1744ddec3c73392bc1d20e5dfa6b4feec7e1acbe1efb3c71eba84f","sha512":"78f0e5d4299d81f3394f274fbdc361890fc192b367571669964287ecb43915b1002c4f5f46069f481f6cd3c5843c0590e69a5a4e2f1168fc84cabc03f3f3cbee","ssdeep":"3072:mi79zAy7+X6RkROAlN72ysxyEPn1PUuU6SCJvOlnpzlcS7n:/vI6RqoPn1cuUaJvOlnp5Jn","tlshash":"6a840af56246623d7f23d23780d1af7cb25c1d84f51aae67f8d1b0b8a985bdc1432624","first_seen":"2025-10-15T09:28:30.576459Z","last_seen":"2025-12-07T03:25:24.152829Z","times_seen":10,"resource_available":false,"data":null}},"time_used":2373,"timings":{"blocked":595,"dns":1,"connect":294,"send":0,"wait":587,"receive":591,"ssl":303},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/hn.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/hn.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-40f\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 2ABCCFC9-96E7-4D91-AB39-7F7209DEA60F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1039,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"75824a8600c964274576b25367ac953f","sha1":"90128c44fcfeda6742b563fd957b7ba38af9be65","sha256":"524685d77cc22ea192466170520a124a9783e0a3bd06849cb03e0b6ee16819e6","sha512":"43c2398ac066f4ad1139302b75803bc73dcee9232221cfb6297d619b8cec1a21e4c0686060fae61b766750178fc9bb97e18572b393f9cd0c18c50f05dce1e8cd","ssdeep":"","tlshash":"aa11d355e599100dc2385769c7f8e69c820fb5079287096ff7a0368f4179afb99e830d","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.973147Z","times_seen":109,"resource_available":false,"data":null}},"time_used":4878,"timings":{"blocked":4570,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/nl.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.803Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/nl.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 210\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-d2\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 52E362A3-B1DD-46E1-AD38-DFDFEB7C1F93\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":210,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"bb9765843658993bb38007f77e89e950","sha1":"e316d98ab836c06faf19c3cda914855f4be30ac0","sha256":"c7706cd5a627a03e1ec58cc49288ff3e367079b4fdcb567410a1679ad7810725","sha512":"e2e628b2bae0d7fae9a3723320812dac1139432b78acfd2510c2ee10a4909575131165590ce95187508cadb42ea87cd01e07b1c24ead74cde7a92c32d1e5b8b8","ssdeep":"","tlshash":"f5d0a9a89139b8480a54c2320ea832c2c1e9708ba04c00cef8a10168220e2abac8a922","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-08-10T18:48:37.659083Z","times_seen":233,"resource_available":false,"data":null}},"time_used":7800,"timings":{"blocked":7484,"dns":0,"connect":0,"send":0,"wait":316,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/gb.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.884Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/gb.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:29 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 518\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-206\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726449=vpeLL07hSueq0AZCW6GeZzDzGXWNqgbHdB/f9gPaWa5wNt3jaQKShVLZJ3pCKPgDVau5/AM3hUP0wq5SjFAkOc6CuqQCVF38P64YVQmqr4RgNwtd4wSSZrqQ+faVlTTccpGqvwWY0z09ahWFehlg/sZF4asfYvoTSYjCKHs880Ypey29i+bTJXY1/7lnEDNX\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: B6063CFD-2975-43BC-BA1B-F1C8A18B871D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":518,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fdd90d2765f9db07476d9110fa28b9fc","sha1":"830e06baf7fd22ef4e1aab182aa341ca7dc07e65","sha256":"6c8fe10bf8b5a32fad231cfdfa795ea82ef3b5b492db7d6bd94023e57bd95cb5","sha512":"eea53127c421677bf8863ce826bd7af5b4b69fbd431e174d7a73fc3bd5fd1c54b0f7b38f856fa62b67856cf43e242c93cb564bb148e935f0e017960300bf1f98","ssdeep":"","tlshash":"acf059d8833c7445c70b97b05cecb8e3c4dd218a589804ecb4e052a5619ebabfcd9d51","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-04-15T10:32:55.494028Z","times_seen":235,"resource_available":false,"data":null}},"time_used":11600,"timings":{"blocked":11168,"dns":0,"connect":0,"send":0,"wait":432,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/assets/index-BianD-g8.css","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:16.279Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /assets/index-BianD-g8.css HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:16 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Thu, 06 Nov 2025 05:25:21 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"690c3141-961f3\"\r\nExpires: Wed, 03 Dec 2025 13:47:16 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726436=dWxekXApCOqnLmgC3rJO2Y4/2/juyi7Qa3S8JKotnF7LCHBePs3hj0nW6lImPnG/T0LAwOQiexmqKAIrYqkfTX8GcfdKtifLsnX2m3GOMPST4pUIScvNBQAZ6z/xjY0hh0q4qgY1I9NezFFTgRc0wfhZZpBd0CTRsfEycitA4hBflcP1dVWQsXYPf0HVK0Hc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 23E9426A-795D-4E7B-BD67-9121A470F0C2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":614899,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65520), with no line terminators","md5":"640f02eebecdc308c2ff312ec8a04c22","sha1":"6efa4b386caf3d95f75e51a93811382df558d385","sha256":"385fc2f4928ab399d5c2a8052510a8cf7fff23deb8419bf3e3a8639cead2ad29","sha512":"abd0744795856fb96a99231a2fe659b411a527d2405efa020ce2dd467aac971b9c3d72eca7a4983b83075310782d80bdb1b45338e74071f6697beafd6996e1d9","ssdeep":"12288:imZ/5Iu0FbwovAHX8SfC77irjQNGfbIkcc4DxzIORvnNZgT6BziHcZb0IPqAroKG:Sv01hOIIi","tlshash":"24d40018b31e60bb1b2ff3adf68495edea1ca752cf054671f640900c5ecbaa1319395b","first_seen":"2025-11-08T03:51:01.956385Z","last_seen":"2025-12-07T03:25:24.695618Z","times_seen":4,"resource_available":false,"data":null}},"time_used":551,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":465,"receive":86,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ag.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.411Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ag.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 713\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-2c9\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 162B1713-992C-4B19-8F19-2C17E5866AE1\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":713,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"22dc54674dec7f6e889782cbd857d948","sha1":"9bc328fa46605e6ccd954203817e99f854a46de9","sha256":"f1c5a404ca21499e20d7dd5be7a1f848a589bdab751c7fed2421dcca5e77029b","sha512":"b906e795f31d607a88e34e18d4e62febd8768e0ae4ae8ff44f79668e903cc47c918bdaef12ddd65b2489e4784ed6c3e852849c4c48cd5d73a6ab068b4aa08a09","ssdeep":"","tlshash":"4a0144e1a078e1dc4d150bf147ed3491142f30cdd45907bcb0d8132a60d5aaf36d06c4","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.934317Z","times_seen":229,"resource_available":false,"data":null}},"time_used":835,"timings":{"blocked":401,"dns":0,"connect":0,"send":0,"wait":434,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/bh.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.451Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/bh.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 244\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-f4\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 400B423B-7C26-4AFA-874C-B0A701C51E27\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":244,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"69783cdb40688d855b4fbf5a41839621","sha1":"ec36aee0898887ededa1d43bd804f45345773889","sha256":"4a69b0914c46a006f2f0e3b192a47bd5602a0b59e1748cfb60df57264dbf94d3","sha512":"4881ca39e968c776500541c52daae54658222f6d8b1e3249923071b8f347415f14017096f9a8e8d98d18d6cae149a98f6f08ea3d00b9f49e79dfeefc36b1c59d","ssdeep":"","tlshash":"25d0a7add36c574c171c56300fd437cc097760f7d04820b8e6d8051592401da67c6931","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.971134Z","times_seen":231,"resource_available":false,"data":null}},"time_used":1348,"timings":{"blocked":1040,"dns":0,"connect":0,"send":0,"wait":307,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/eg.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/eg.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:21 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-260c\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726441=JHGeMlqLy0gB5ak0wqadFpXGs3jM0Lo0M6zpM+XNz231JxpbP0A40EIy6YAGOKWCUUKvhgxieDl2ZDNrB4enQOS9H/6MwGnh5UiaeNYNMLt++1i3qhK7sfzsnGPa7MewtPpo89eienZJybDLK4IakcYHNlxcLcw8BoCYNUG75GMW74KuNPfLYIP7Dw0B494o\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: CB4FBC0C-2ECC-4213-8ED6-042F5B883C1D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9740,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"bd013da37c87b4554ccccda1372c62b9","sha1":"f78bdc9347a70a3fc3bd12236c7648b2d98f1195","sha256":"ca5c8ee46dae43cee2f60faa6c28acfdba96b1a066ba831acada6797fff5df07","sha512":"917047230bdc826a7a7f0405585c53a644ddddc127b55953208c77983897ce46000853ed0426ee4da29f9204ba0c8b41f332f1f332e1427f9925c026a5387805","ssdeep":"192:F+cGcprFRvWKmokZhT+p2PZs4HZ60gGbNYWHEzjnTzXlTHmQg+RA/h:J4okZR+p2P/HLggqzjfXhHmQOp","tlshash":"ce12ef3c8754d3bc5e62eaac9f25a0b4910ea0cab1f7c345865dc67012e35dde25f8c9","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.903618Z","times_seen":110,"resource_available":false,"data":null}},"time_used":3684,"timings":{"blocked":3259,"dns":0,"connect":0,"send":0,"wait":425,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/gy.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.696Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/gy.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 452\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1c4\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: F272CE31-C6CD-4DEC-A852-3C15CDF07916\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":452,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8e782c756ecbeed8e10feecb7d264943","sha1":"2e8d7e500aebcda0fe922c4b22e1b48a94ec0054","sha256":"d5f256e71d353c7ec3cbe294413e5b68c6b68257b43c212eaba6ceb844471b0b","sha512":"ca1eb8fb6bfefe318652fa0da4123237d368ffab5a0352fe656e076c35cdc7b8074b728b46103a2cd7d253bfd66a5c294b112730c9812a4cfdbe61c61a1dd612","ssdeep":"","tlshash":"2ff05cb6c278fca9190987fc9f9871d6206a3108901545ccb4d52431514c2dfbccefd1","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.913774Z","times_seen":226,"resource_available":false,"data":null}},"time_used":4770,"timings":{"blocked":4333,"dns":0,"connect":0,"send":0,"wait":437,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/kn.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.837Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/kn.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:26 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 749\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-2ed\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726446=ptucVn3RIg6hfG1GeWyp0AOoGEPAGvUxzyHSXVviuYCOqdey2OA73hpJTOX54tL2yISiTotdyN9pyxfwsajn2g0X54hFpCzrKsSaHVr5h70Mejg6ceFPn+LFJGC2CRvHpMAwSOEi8xEAaElkrPte2SNNVvoHXHWjyZywau+M/ET7sJheupgJLbbmcQTs3DWc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 43F675D1-E1E4-4490-99CA-BBCDCD1D8FD7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":749,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4378a64ef874884305a8efc110e43cc0","sha1":"afd265b8d24254007f02979b022ac98c9718f838","sha256":"b1c09f7df66c62c43462b980a07b1162ed6762fc059132cbabbefc6af1f7f7c8","sha512":"f6078a63c722ae74f0f83d4a57e690f2212cb10046b1341cc7f52ff11b582da47bfa4a60853277d6f67900eea922ea10095825679ef0e486218799f830fa61a5","ssdeep":"","tlshash":"0601d066f2bc9779d50a0a74ceac61f202aff18d8048048cb450266d41b5befb14d5a2","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.788796Z","times_seen":225,"resource_available":false,"data":null}},"time_used":9061,"timings":{"blocked":8635,"dns":0,"connect":0,"send":0,"wait":426,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/tw.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.866Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/tw.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:28 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-8f9\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726448=scd548NbFsDlriR0p8lcpUSKGtPYT/fhUWpMVJoPGmWaQsF6U2I4BLnmRc69+bG+K/nZb5Nxfo6gYAUxm5/nVRo3rZ9J/GkSGOnre0pGmz3P/71ZNnUJKWEajfGx+N9q7mMdvR0KEp7aCj0WGUT104FuneAtUScTjVMzQbAizsq6TW7mypX6QZoLYJ3c+43j\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 19060FC1-536B-41B5-B664-25FD9C3946DD\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2297,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"35e88822381dc7230be2b47b0b92e9ac","sha1":"37b5260a0f8b9102a7f82772f51ce04cddaf5ee2","sha256":"e1ba7ee7cd54acd2c4c33cd33c68760797b927abd1ad5a684b6a92c14a22d1f9","sha512":"d01298a7187b85234fccbc819a5defc6a1a6910213a31ca00cfe092b599f935a359efa3069fbda7462131d6f3fd5a857132c65309bfba5429eca5ff727c929e1","ssdeep":"","tlshash":"0a415ebbd264f17349e397789bb8613560df11ba81de1398a6c4da145108eeeb0dcec0","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.89579Z","times_seen":111,"resource_available":false,"data":null}},"time_used":10709,"timings":{"blocked":10259,"dns":0,"connect":0,"send":0,"wait":450,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/tl.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.871Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/tl.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:28 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 543\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-21f\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726448=scd548NbFsDlriR0p8lcpUSKGtPYT/fhUWpMVJoPGmWaQsF6U2I4BLnmRc69+bG+K/nZb5Nxfo6gYAUxm5/nVRo3rZ9J/GkSGOnre0pGmz3P/71ZNnUJKWEajfGx+N9q7mMdvR0KEp7aCj0WGUT104FuneAtUScTjVMzQbAizsq6TW7mypX6QZoLYJ3c+43j\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 80962641-A074-40CE-9BC3-1AA04B99BAFC\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":543,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"bdb315c73a8ce209b3ce9b40b52c8398","sha1":"5bf855a83d5af147f527707537d8dd5a59b2dcdd","sha256":"d90440b3f478eb7447c9d59a0929d32a15e49d286e27cae5e4df0057ce0a7466","sha512":"211cebfb7ae6f6082882000ad1a495cb0688163a5c86527565959b894bf2ac9b640db56e4c419b5ccde52b5b544d48634893349a2c4e8afe4b7351bdf915542b","ssdeep":"","tlshash":"1bf0c0e4e374a1ec5d1e0b385abc70d6649ab18d488400dcf84427ac210e3af7894e56","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.803352Z","times_seen":226,"resource_available":false,"data":null}},"time_used":10885,"timings":{"blocked":10462,"dns":0,"connect":0,"send":0,"wait":423,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/gt.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.678Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/gt.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-86d7\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: F9CF9F3D-F6DC-43DE-80D5-7C61024D855A\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34519,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4e11dd41b1d24d5c5a824bf99e9720a1","sha1":"b2b441b91a9f1992bd04fe7c342b5a0916de161d","sha256":"f7b5885f8ad8657b8bd2506d04faacef30e48a015a1c470560d1909e43e226e7","sha512":"24fcc0074eaf2d0a16fca3485e97cc23b8b31d6c131567d3276c571a5a513a0fadddbb105c8f2dfc87dfb78185815d3ca3b26f2d7ab71efbc003cf779499f864","ssdeep":"768:inD5SsMNTnHlcP1kNuu+GbWKo8OZDOXLvdSSLsAeJeUyoUClFTUCRycXv1:in9Km1kNuu+dF8OZDO7U3AesUyoUClFz","tlshash":"e5f2333c876893bc9d96d7fc8b3560b4624e609da0b7c309969dc7b022d31cee15e8d9","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.915524Z","times_seen":245,"resource_available":false,"data":null}},"time_used":4597,"timings":{"blocked":4164,"dns":0,"connect":0,"send":0,"wait":432,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/in.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/in.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 911\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-38f\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: F1571777-C632-4218-B3A0-8C42179E12D6\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":911,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"313aed763b3cbe6ac91fb899be3a30be","sha1":"291ec8b389121eae0fa44652a486cb161a271b72","sha256":"5e6439747c2f03da10fa9db781f5fa973aa26e009b482f4172414516239edbec","sha512":"baddeb4069d2d45584c95db9af9383fedf2de542878c79b95dd0af4f1d4d25e45ee8290a603be85760d081321e48cf811919a21fffcca7d77a696d488886b615","ssdeep":"","tlshash":"39112755b058e92c5624d7a4c7fcf59cc15bb08b5207059ff6603a8e507d6fba8a8309","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-08-10T18:48:37.630104Z","times_seen":226,"resource_available":false,"data":null}},"time_used":4938,"timings":{"blocked":4628,"dns":0,"connect":0,"send":0,"wait":310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/mx.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.789Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/mx.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-17026\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 9202AEFE-CF9A-455F-9341-4947470D44E4\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":94246,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2875522fe79239abad6c70448c6ef276","sha1":"243bfbf4264bdf7b6a46e8f2fdd888af7222c19c","sha256":"582d601dcb729590867be724a0c194c2402dba9d34328a7720b140700226a9aa","sha512":"7a6aa8cf521354d8c5eeb56931c7fb3e6bc1acfc6078aace8d8311bb48d7e697963408dafeb1ada42bcf563a41176be12f1bdc6e6cb7f5980b07a4080bf4eb41","ssdeep":"1536:ziTJnjzHUSDJsmQDvgDPpu8xcYIXH2YmPGHvsZtkq00pLmOZa9xD:ziTJnHHJSmQEDPpuhYI3tCGP4kqXVmOw","tlshash":"f793ee7c4228e3bd9d92c6bc9f69a0f5914db0dad0f6c345a269d13012e35cef24f895","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.820906Z","times_seen":246,"resource_available":false,"data":null}},"time_used":7065,"timings":{"blocked":6741,"dns":0,"connect":0,"send":0,"wait":321,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/mc.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.793Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/mc.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 216\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-d8\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 1B2702D6-A423-4A95-8493-CADF2407F3B4\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":216,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"881735135cab147fd9060ed23eeed87b","sha1":"fe7d3641d09237eeadd92f8fb13c0946d40224cc","sha256":"b6f592286caaee7f3e968453b54f01403043da8860c29c396c5743e7e322d8b7","sha512":"c1ba65395f28b3f017f1afbabea33bcc204e54f42d16d1fd4e27783f00468cfb8766779af26c89cc682cdd2a0b2882148133eae56b8c3a371fc2f6ba60de0938","ssdeep":"","tlshash":"49d023d981286c0815088278875875d241fe300e508805caf4f41510604d7bb7cd1d99","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-04-10T22:06:57.131341Z","times_seen":227,"resource_available":false,"data":null}},"time_used":7185,"timings":{"blocked":6849,"dns":0,"connect":0,"send":0,"wait":336,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/pg.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.814Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/pg.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:26 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-65e\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726446=ptucVn3RIg6hfG1GeWyp0AOoGEPAGvUxzyHSXVviuYCOqdey2OA73hpJTOX54tL2yISiTotdyN9pyxfwsajn2g0X54hFpCzrKsSaHVr5h70Mejg6ceFPn+LFJGC2CRvHpMAwSOEi8xEAaElkrPte2SNNVvoHXHWjyZywau+M/ET7sJheupgJLbbmcQTs3DWc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: C2263236-D378-4118-A3B5-7A6576EBD3DA\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1630,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"08b0debb3d55ddb14b7093374cca8a99","sha1":"9153b9aea9cab5ccdca1163670ae9ce3261caaed","sha256":"cf6951825e440ac49fe13f844f7eb6eed1a08e27aecdeeb11e94859158c8c5c1","sha512":"5c19af149f0f7fc9ee6221dbc643149c9d39e82770a84cd3547996ab78335a37a4149ce987c96ba7838d2b3fb7fa8371ca78288c4194bf631033c9fad9df19dc","ssdeep":"","tlshash":"663120689214d0b89ec64bf8df7e76f1992fa079528007a8113c80f422998dbe68fcc4","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.795695Z","times_seen":109,"resource_available":false,"data":null}},"time_used":8537,"timings":{"blocked":8104,"dns":0,"connect":0,"send":0,"wait":433,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/pt.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.832Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/pt.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:26 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-1f66\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726446=ptucVn3RIg6hfG1GeWyp0AOoGEPAGvUxzyHSXVviuYCOqdey2OA73hpJTOX54tL2yISiTotdyN9pyxfwsajn2g0X54hFpCzrKsSaHVr5h70Mejg6ceFPn+LFJGC2CRvHpMAwSOEi8xEAaElkrPte2SNNVvoHXHWjyZywau+M/ET7sJheupgJLbbmcQTs3DWc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: FB54C0D1-CD87-4FEA-82B0-90C555DD6E99\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8038,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"455c0b2a896b4dc0ab36b26f97c572b1","sha1":"ccd34de356fdcc5d117bf9d45df7813ca0e27524","sha256":"7daba1448e014ed0adaed5d6701e15b8d3b71eea006c9614d603c7ffe6766ccd","sha512":"d911f720ae5744f7820823eec6bc6bd9b22defceb548e609ceef413ec4961a2661f958a63d6b55b9a5027ce630da1521ab29141922d730e0b9b0c00aa790c040","ssdeep":"192:PhJeuCVby+fqW0RDP8Z4Kyu7Zw2KD2wY4Bk/PZUuNsk:PhwV/CWeD+4nCZw2KDaH","tlshash":"3bf1532893a821bcc92743f8c735d0b8575f20aab1974368d91ce73021365ede5bbdc9","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-08-10T18:48:37.615066Z","times_seen":113,"resource_available":false,"data":null}},"time_used":8684,"timings":{"blocked":8371,"dns":0,"connect":0,"send":0,"wait":313,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/sy.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.865Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/sy.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:28 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 292\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-124\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726448=scd548NbFsDlriR0p8lcpUSKGtPYT/fhUWpMVJoPGmWaQsF6U2I4BLnmRc69+bG+K/nZb5Nxfo6gYAUxm5/nVRo3rZ9J/GkSGOnre0pGmz3P/71ZNnUJKWEajfGx+N9q7mMdvR0KEp7aCj0WGUT104FuneAtUScTjVMzQbAizsq6TW7mypX6QZoLYJ3c+43j\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 2899EE34-4F95-43CC-9527-E70477AF8511\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":292,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e4221278e77ca2fede282d17d2137e8e","sha1":"8304348432a9a88055768ce748e607bcd215c1e6","sha256":"77a32617aa31e893b3b41bf2facd78cb623ceadbb358b1c7ab8496443cffea59","sha512":"d25c734bab42a7010383fd568eb11d65602d0716c3fc171f23e3d95f9279c0a402f3bd3a76cda379a6727499070be85ad33d5b3fb6a7fef2a3f70ae9efedc21b","ssdeep":"","tlshash":"ece02bd9d16cb8800614c3750b9c35c7c1ab30ce602c01fe74e006687209be7fcc7aa4","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.869361Z","times_seen":226,"resource_available":false,"data":null}},"time_used":10552,"timings":{"blocked":10116,"dns":0,"connect":0,"send":0,"wait":436,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/th.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.869Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/th.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:28 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 261\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-105\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726448=scd548NbFsDlriR0p8lcpUSKGtPYT/fhUWpMVJoPGmWaQsF6U2I4BLnmRc69+bG+K/nZb5Nxfo6gYAUxm5/nVRo3rZ9J/GkSGOnre0pGmz3P/71ZNnUJKWEajfGx+N9q7mMdvR0KEp7aCj0WGUT104FuneAtUScTjVMzQbAizsq6TW7mypX6QZoLYJ3c+43j\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: A994A862-5F08-4C7B-BCB2-2BCDE381E6B2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":261,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"55a7b43430c069d9e9a78279073d5908","sha1":"aca34dd6bfb2c2e515a16196f79d3fc1b3a80c8b","sha256":"35a46ba7a451b53ad20760e3653a9bfde931bc50d2d62876d782efbb38bb7355","sha512":"bebb693dd4b3d6ee6a897dc12043e7f7695c1d5ba677a82890398ddedc9e5d24d77fd5d3ee600b7ce4db3b4c0cee87a8b93f6f43c3abf78c57b5693e52b80fd3","ssdeep":"","tlshash":"57d05bd6c1387454594983745ed876d281e67045105c04ceb8a12666715d6f7acc6952","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-08-10T18:48:37.659899Z","times_seen":227,"resource_available":false,"data":null}},"time_used":10762,"timings":{"blocked":10450,"dns":0,"connect":0,"send":0,"wait":312,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/cf.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.534Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/cf.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:19 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 620\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-26c\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726439=QLHfXzQcHU+/W9e8VZSSf0g70ZVVR3gGzGwwje9rBHVHza7Yt8wgF7B4H3StKTb5UUbJpmoUOvvq5sygHT45oSjYCEFP9Bv58IrLsh63Oc4/vMSbLNGWDi1m7j9FyJDIR37k9WK9e0JgHkfFZBg1+ZSbskFnMoTPZdqOPihUCE8ZxgQ772H2IN8bRUfDkHPj\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 105DA7F1-CDD4-44A5-82CB-969BEE22B73D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":620,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8f22f7dbb7aeba0e1228bd755df91b7d","sha1":"a0cd72d165cc188baa8649feb723757bdd777a5e","sha256":"88477800e3ab3cee48323b7adcc4f87afb1350cdd7014b789cf5313130d75ef7","sha512":"488f7243b7aafc01f77a6c46706feb33d0f46497ff9ca3437e655a02c27bc9bb75e0e3ed015dc491401e7c32fb7a538d270f431f58b8f19ed2e159af55c1fd91","ssdeep":"","tlshash":"b2f0a20169f871255e1303b48fbcf5cb116ff54c619a01dcb0d11129394d75fa5d8ee5","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.767692Z","times_seen":230,"resource_available":false,"data":null}},"time_used":2537,"timings":{"blocked":2218,"dns":0,"connect":0,"send":0,"wait":319,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/dj.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.604Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/dj.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 531\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-213\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 2507B134-4E8F-460B-A4B5-6B19FDDF70A5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":531,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"784d503aac9dc4dad2f4ededd3b2a938","sha1":"c9690109002de7da3cdc368350ccdcc16fb2bd8e","sha256":"8fa4e2f1adbdf2c09536ab0e941babecc10e5404312ba59c27cc8e1c8f8945f0","sha512":"2c2faee4780800ea5f1d05a1e46fd9c744d0ea95abe4ac2b472c2dcb212a1491b09c8c2d8d40fa5ecd0d240b2c416f2ff233820cbe1fdb408705574e90c52429","ssdeep":"","tlshash":"43f050556175606c7d5947f0dfbc38c5519f318c359403ecb0d0153b211c3af65c95a2","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.896826Z","times_seen":230,"resource_available":false,"data":null}},"time_used":3508,"timings":{"blocked":3084,"dns":0,"connect":0,"send":0,"wait":424,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/il.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.733Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/il.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:23 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 841\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-349\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726443=I4674F6+qGthWbm4v3Tt0iNbk3z6+po3UlqQ2MaISR5nR2xgr5MqYkIFQwdSOmaKQbq1BcSDP/84sx/DiinN0x7TrBe7BNmVVDYIU5FRdHsNlW74GjU/fuv8I2g3NyT+ijVjk+QCSxrC2nJRjJe6Um3OQ2z4lS0yfuytGceq6oqL+9hqJ65LMguuPQhCaKAr\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 54B71D51-3832-47D1-B340-52518FF84BED\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":841,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d64a14bee733caddbd15f53ff2041a97","sha1":"6e90445c714ae30a4f9a4ca66b76c0f64f688118","sha256":"3111c8956cc8f72c19be7023ec209341f23ee1098740320f1cc48305bedaf31d","sha512":"3bbd97edfff777250486c2a1d27052e0e2a11d8cabafdb00dd92f563d5cdde01082485adbb61d542eeb08ec4abe75aae7f14301bb1dc4c1e994f2b1f85b8f96f","ssdeep":"","tlshash":"2a01c250e1f4b67c595747f6837c2dc150ed318ed54452cce0852521f0b41dfa6cd9a3","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-08-10T18:48:37.639744Z","times_seen":224,"resource_available":false,"data":null}},"time_used":5450,"timings":{"blocked":4999,"dns":0,"connect":0,"send":0,"wait":451,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/vu.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.888Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/vu.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:29 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-7f5\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726449=vpeLL07hSueq0AZCW6GeZzDzGXWNqgbHdB/f9gPaWa5wNt3jaQKShVLZJ3pCKPgDVau5/AM3hUP0wq5SjFAkOc6CuqQCVF38P64YVQmqr4RgNwtd4wSSZrqQ+faVlTTccpGqvwWY0z09ahWFehlg/sZF4asfYvoTSYjCKHs880Ypey29i+bTJXY1/7lnEDNX\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: E7EBA346-CD1E-4834-8DFE-384E63B1FAD5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2037,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"44f28ff05d793e90a90dcf583fd7559e","sha1":"e6c82ba352fa130b25e1d0315fb59f27878494ae","sha256":"103df4747ddc59086c891e548776f140e851f6a0ede15167419c08f5a3d15309","sha512":"1c043fed6617bc6e2f48f0fe8fe610da5e1763f82244b370345a3b6976c1392ed8a71a9b3c8fd724f302beb0d3df46e62aa0f74633fa15e764a1e020ae102a2a","ssdeep":"","tlshash":"ec417321e211d23cfc6b86acff6571f4c05e60c944ca439ab46cd17051306ee6eae9e6","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.832653Z","times_seen":108,"resource_available":false,"data":null}},"time_used":11839,"timings":{"blocked":11404,"dns":0,"connect":0,"send":0,"wait":435,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ve.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.890Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ve.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:29 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 1022\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-3fe\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726449=vpeLL07hSueq0AZCW6GeZzDzGXWNqgbHdB/f9gPaWa5wNt3jaQKShVLZJ3pCKPgDVau5/AM3hUP0wq5SjFAkOc6CuqQCVF38P64YVQmqr4RgNwtd4wSSZrqQ+faVlTTccpGqvwWY0z09ahWFehlg/sZF4asfYvoTSYjCKHs880Ypey29i+bTJXY1/7lnEDNX\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 8A27FE90-B55C-4F6A-99F3-EA9F7FD5E31D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1022,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"af560876226a851673a0e834dc73ad28","sha1":"a4cf6c0ed87ecf698d0782373994d5b8f31be61d","sha256":"3cfb7b3d15f3a214707e5754565863e53d2ff45fd453b82883c8666305a5c85c","sha512":"1eb9e9a5f45af11699d5dbd59d1710f75dc066485cf4b42522ebcbc6b7d614f4741c8680b47a763d034e51e8855aba3cd12c829a31e079bdd4ff1be21c97946e","ssdeep":"","tlshash":"be11aa26eb1a541c8624e694c3e8a58cc207b4069a4b08affb207dcf407c9ab59bc70c","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.838095Z","times_seen":222,"resource_available":false,"data":null}},"time_used":11926,"timings":{"blocked":11587,"dns":0,"connect":0,"send":0,"wait":339,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/cn.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.556Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/cn.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 764\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-2fc\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 1BAB92CE-7828-4B4A-98FF-39464FD4003D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":764,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8ea3d114813c7fddaf96f5631c1b492f","sha1":"3f718bcd6177943fd3c81b7c0570dd1e9f072467","sha256":"a9ea37ec2aec84f831546a5c6c4bc29badb48bc8ba702a418eacc152d55b4ffc","sha512":"86fc00b290bded5208601ddae9b6ff428ae1e8b466c97c4cd716f9f1117f7676345f61959f535f64d3aef4ac5547c5cfb25b5ff900d40a77cda2dc24f95fc4cd","ssdeep":"","tlshash":"18014911e506901cc2095794c2fcfa888786f16292b6409ffe74625a8179e2f69e8749","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-08-10T18:48:37.622262Z","times_seen":239,"resource_available":false,"data":null}},"time_used":2644,"timings":{"blocked":2332,"dns":0,"connect":0,"send":0,"wait":312,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/my.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.780Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/my.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-4fd\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 16BCC46E-FB0F-4FF8-B31A-3EA4C7DE118B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1277,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a8b74720d4896b16d78fc65264303dd9","sha1":"b6f0bef93a52a54d973e07211a15e62b1eb60f4f","sha256":"f613817dcfe9e7452a64826435f86800c5ff077b46ab46007dc46887d22cf63c","sha512":"d57ddce4950ca7a08a2ae721307d1364def6ae693ae8bec59064ea52a8a79d78100ffa5aa4452b5df4fda409f841c6eca904c4cc8b6ab273dc1a4cecb8f7e384","ssdeep":"","tlshash":"3821b4d4a8383b588f1787e80fec60e7469934ce304d43cdf45c0138a15eb9fada1a62","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-08-10T18:48:37.638852Z","times_seen":114,"resource_available":false,"data":null}},"time_used":6651,"timings":{"blocked":6337,"dns":0,"connect":0,"send":0,"wait":314,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/rw.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.837Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/rw.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:26 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 693\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-2b5\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726446=ptucVn3RIg6hfG1GeWyp0AOoGEPAGvUxzyHSXVviuYCOqdey2OA73hpJTOX54tL2yISiTotdyN9pyxfwsajn2g0X54hFpCzrKsSaHVr5h70Mejg6ceFPn+LFJGC2CRvHpMAwSOEi8xEAaElkrPte2SNNVvoHXHWjyZywau+M/ET7sJheupgJLbbmcQTs3DWc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 2891A177-09EF-494F-ABBA-F31BC672EB79\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":693,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"91b45cf9027c595f189a6301e137da4a","sha1":"7469201d63ae2f5acf09c39f3a4e1bfa80ea7f69","sha256":"377d57216c45e769b441397f0bbed7cb1a522a29f6ffe161bcdf0a03ae6d037f","sha512":"9e5617a61ee0fffd6a7c1e0877c89f4402b499408afa52dd21dbbfdf0e6008daff3d67980294e3fcfd1d8c899bd3636dcad8d4b42d1bd51c7149c1a91fbcb566","ssdeep":"","tlshash":"2e01c0a8d168301cc52847b5dbf8f85dd0dfb48a6247089ff950303a113d2ef6c91216","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.894918Z","times_seen":224,"resource_available":false,"data":null}},"time_used":8935,"timings":{"blocked":8600,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/sl.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.850Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/sl.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 249\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-f9\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: BBF65F15-32F6-41EE-ADFF-FA4FC286918E\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":249,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"36dee38b0ea46ea705ed313179f6a419","sha1":"8b498a0f9bfefa405f033dd735a727b1904a856a","sha256":"b2f2e3a955a61970f2af868ff6d46606f5ac296ea0fe0b32e2ddd84866e7b74e","sha512":"8de27dd4a701d29dd96f87a318c276739edbebba97407cc33398275b6685038b0bb4fee50fbe26bcd67561c6d21ffd44daaa4e660730c0d86698e0b0365d0563","ssdeep":"","tlshash":"edd0a7e6417cb9949e48d3745facb2c3c1b6308e704845edfce10126310dabbbcc9955","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.968534Z","times_seen":225,"resource_available":false,"data":null}},"time_used":9744,"timings":{"blocked":9321,"dns":0,"connect":0,"send":0,"wait":423,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/tj.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.867Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/tj.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:28 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-6da\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726448=scd548NbFsDlriR0p8lcpUSKGtPYT/fhUWpMVJoPGmWaQsF6U2I4BLnmRc69+bG+K/nZb5Nxfo6gYAUxm5/nVRo3rZ9J/GkSGOnre0pGmz3P/71ZNnUJKWEajfGx+N9q7mMdvR0KEp7aCj0WGUT104FuneAtUScTjVMzQbAizsq6TW7mypX6QZoLYJ3c+43j\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: C75C13C1-EE06-45AB-B410-501714C5EFDE\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1754,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0bdc6cda6e0d7d58228a2ed6fafe35a9","sha1":"bbd56ee4f046cecf4eebf744822801716ca1e5f7","sha256":"53b5b12fe7c8a26fa6a3de7816e5e4759b84b0e60a1046ba5b8e1bd627299026","sha512":"54e4130489eceee4111256ba137eb747154fe4559c72fc2dcb01e15c00118171f70068aab94c06d135e66359d8fbf90ef049b76cf84102d25837407fb57e8176","ssdeep":"","tlshash":"3331ae94d25d104c892693a6c3eca4dc831fb08b914709eef62c716a217a7efe8d6708","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.969395Z","times_seen":109,"resource_available":false,"data":null}},"time_used":10689,"timings":{"blocked":10265,"dns":0,"connect":0,"send":0,"wait":424,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/tv.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.880Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/tv.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:29 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-57c\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726449=vpeLL07hSueq0AZCW6GeZzDzGXWNqgbHdB/f9gPaWa5wNt3jaQKShVLZJ3pCKPgDVau5/AM3hUP0wq5SjFAkOc6CuqQCVF38P64YVQmqr4RgNwtd4wSSZrqQ+faVlTTccpGqvwWY0z09ahWFehlg/sZF4asfYvoTSYjCKHs880Ypey29i+bTJXY1/7lnEDNX\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 10917CD4-4A04-45C4-8C67-4929BC08E033\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1404,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6df79dfdab398a217ed5de11b82fced5","sha1":"02a418458a9f09f4b6a96d471403084eb9a2f872","sha256":"04584197c5025eb90319f6dc5a4ae75cde457698a2078670267cdcbd8c29e6c8","sha512":"4020943b5ce90366a7c508462e2dc68c7ee819840c375153c845d1b004f7c54f8f71cc4615bcc65e1e53b07e38915eff158f6de1fbdbacb42606e113da3eebbf","ssdeep":"","tlshash":"30212c51d3a6bb29dda603f1972829d001aa01fd3cb9f6696dfb907431961ec98cc5b0","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.77451Z","times_seen":108,"resource_available":false,"data":null}},"time_used":11412,"timings":{"blocked":10974,"dns":0,"connect":0,"send":0,"wait":438,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/bw.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.500Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/bw.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:19 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 226\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-e2\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726439=QLHfXzQcHU+/W9e8VZSSf0g70ZVVR3gGzGwwje9rBHVHza7Yt8wgF7B4H3StKTb5UUbJpmoUOvvq5sygHT45oSjYCEFP9Bv58IrLsh63Oc4/vMSbLNGWDi1m7j9FyJDIR37k9WK9e0JgHkfFZBg1+ZSbskFnMoTPZdqOPihUCE8ZxgQ772H2IN8bRUfDkHPj\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 74BAE70B-C3E0-4DCE-8F20-0781CECB08BD\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":226,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e319eca06b02aa996de59592da62114f","sha1":"3b592dea86f753c9382ee89cf54cc78b8643be88","sha256":"9f7358330a5d122e5d06b42aec7edb0534e8d33de53bea0367da27c4352e24d9","sha512":"427e31457d4777c1293aca11e5c2a5de9743efc25fa400a489f2f841f575675634e03ee87c2366984c6ffba33acc4448a8cd399db92c0a0f1b52ceb4c1cf3c47","ssdeep":"","tlshash":"5ed0a7e581387a14554883705f6822e2c1fa3089604805ddf8e01625210e567acd4961","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.874133Z","times_seen":232,"resource_available":false,"data":null}},"time_used":2031,"timings":{"blocked":1607,"dns":0,"connect":0,"send":0,"wait":424,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/cm.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.527Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/cm.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:19 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 759\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-2f7\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726439=QLHfXzQcHU+/W9e8VZSSf0g70ZVVR3gGzGwwje9rBHVHza7Yt8wgF7B4H3StKTb5UUbJpmoUOvvq5sygHT45oSjYCEFP9Bv58IrLsh63Oc4/vMSbLNGWDi1m7j9FyJDIR37k9WK9e0JgHkfFZBg1+ZSbskFnMoTPZdqOPihUCE8ZxgQ772H2IN8bRUfDkHPj\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 3513F2CE-B295-47CA-A087-4753E585EDA1\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":759,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d00844d4e6bde6c620c5f979f310ca77","sha1":"e717bafa8deaf3a5babdf9d84fe31497c9cb9701","sha256":"22f4ba6481b46800ed2ff15204818bdcd65f1b42eaa8efab3919e3e299facbfd","sha512":"24d8666b26239777e2ba66d248f965cdde99720b8b1208b1d4b286ba258e95e8b5a299dbadf2fd4e4d61dec58cf4beb91ca094581aaf703343a17c1d32525d5f","ssdeep":"","tlshash":"54016855e65d600c82399369c7fce58c811bb043824b08dff760358f01785fb68c834c","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.767258Z","times_seen":234,"resource_available":false,"data":null}},"time_used":2314,"timings":{"blocked":2005,"dns":0,"connect":0,"send":0,"wait":308,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/gw.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.694Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/gw.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 771\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-303\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 1C438C35-6FD3-442D-8B7F-2843F6F071B3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":771,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"dbcd3c45a6dc4ff28e6f4f1f711d7f30","sha1":"36065988155a1bc2a67302f2d71ba7bb7028b535","sha256":"faadd85da3bbc15c18bf22ead66a94d74353b8f1dc25de42436348929ddc7c54","sha512":"9f655cd0980a0f773404b54ac90a4fda6ce912aca485d23a86ce54e291d64c5e57000734999ef5372acb5db4a64639123958e304376abed28b741f221f9efe44","ssdeep":"","tlshash":"b901f914e559a02c813893a4cbe9d5dcc20fa043854a06dffb70369e41bc5e7ad94708","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.946933Z","times_seen":225,"resource_available":false,"data":null}},"time_used":4626,"timings":{"blocked":4312,"dns":0,"connect":0,"send":0,"wait":314,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/tz.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.868Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/tz.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:28 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 489\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1e9\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726448=scd548NbFsDlriR0p8lcpUSKGtPYT/fhUWpMVJoPGmWaQsF6U2I4BLnmRc69+bG+K/nZb5Nxfo6gYAUxm5/nVRo3rZ9J/GkSGOnre0pGmz3P/71ZNnUJKWEajfGx+N9q7mMdvR0KEp7aCj0WGUT104FuneAtUScTjVMzQbAizsq6TW7mypX6QZoLYJ3c+43j\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: D21B636E-7905-4D3B-B870-A20AF9117D1E\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":489,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"53378a8c4c645a4f77dba64ff3db9a5c","sha1":"52968b89cfa072d7710c0510a06ca02c7947113d","sha256":"bff372b726933e60af704df8d94eccf2f73ec17a24353a5d5de003c4c4c2c546","sha512":"869e28977f80809fca9580dc3bb9e2288811d27bc9205bc13f3abbf5d04d3ba87ad1df3a47ae288cd4007b6870f31332c5ed897ffb389f236caebba9dfc4d9d1","ssdeep":"","tlshash":"95f095f7107994042f07c730cba874d541ee30ce615901fc7c51267d251e72fd9d66a0","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.950965Z","times_seen":223,"resource_available":false,"data":null}},"time_used":10699,"timings":{"blocked":10384,"dns":0,"connect":0,"send":0,"wait":315,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"106.54.228.253","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:19.330Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 26 Aug 2025 11:47:17 GMT","end":"Fri, 25 Sep 2026 11:47:16 GMT"},"fingerprint":{"sha1":"47:A7:6C:09:6B:1D:CA:2D:7D:39:2E:C1:7F:15:DE:5D:F2:C4:0F:77","sha256":"EA:73:37:83:D0:38:44:D9:3C:0B:26:F0:DD:D1:22:2F:36:F7:F2:86:A1:B0:58:52:DE:4E:0A:21:D6:89:E7:3E"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 03 Dec 2025 01:47:20 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Wed, 03 Dec 2025 15:47:20 GMT\r\ncache-control: max-age=50400\r\nset-cookie: __uni__uid=rBEQg2kvlqh/a8XkA8xmAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-08-10T18:54:13.738025Z","times_seen":20195,"resource_available":false,"data":null}},"time_used":1649,"timings":{"blocked":708,"dns":115,"connect":235,"send":0,"wait":232,"receive":0,"ssl":357},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/cz.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.595Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/cz.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 214\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-d6\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 257675DA-32E3-4751-904D-3FF52428BE05\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":214,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2094ace5f86f96974635662aed35fd67","sha1":"ede9e692187516b2d137c86d31fac8380311f3f3","sha256":"33f5dff0d1b3802d8aa69ffc259086f582df29d6f74dd34e344d271024e56b3e","sha512":"2dd5f90e80c345687d60fa5f7de61fb11d91df240945ebdb913aa61938102e0678b1501b33f521e3e77379e00941fddbf6b5a94873af7d95f7cc84834501706b","ssdeep":"","tlshash":"90d0a9a9903eb8155a4083604aa8b5c240ee208e60cc02dff8b10035618e6afac82d28","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-08-10T18:48:37.652764Z","times_seen":233,"resource_available":false,"data":null}},"time_used":3349,"timings":{"blocked":2918,"dns":0,"connect":0,"send":0,"wait":431,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ie.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.731Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ie.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 266\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-10a\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: E8B6BD55-EC5E-4050-84CC-7144B9B4E3D8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":266,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"acd1050f31121ce2c6ca7507b2a9f5d7","sha1":"1a3626a8d437d65fc49f8eb39b69cb72ea54657e","sha256":"c0250ad1c800e9eddecfe3d7b4d6b47a2ffb8d6498d920c9d8f58f0cc3b51eb4","sha512":"17025c0bb5894f2a0d681338b386aacbd7234a3612c09530e854bd07c84c23a563d48f4ae69b4504057517403340fc11ebc98151ead2b85d240ed9ff5e53ae33","ssdeep":"","tlshash":"a4d097a5873db814560a83388b6c36e784fb309c708d00ccf8e01121314d7af6cd3aa8","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-04-10T22:06:57.139401Z","times_seen":225,"resource_available":false,"data":null}},"time_used":5345,"timings":{"blocked":4922,"dns":0,"connect":0,"send":0,"wait":423,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/mh.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.786Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/mh.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 715\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-2cb\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 1AB45EDE-18BE-4B66-8571-66C5F25700B2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":715,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5e55ef4f3719b8669a248b05d8d98383","sha1":"714b417424604e6cbefc4770e63166c0d1529b58","sha256":"5b7c4e1ad28e8bb43e67b820eb082fa8cd653123ff57af44545e8a250771be56","sha512":"72fee273bef701888f90b48ff97191f445e0e5a946c6f727aedc35f00812e7e22987845cdcfb39d00647559619be06b5579e628888a47ab371b896c985c78ce9","ssdeep":"","tlshash":"790110f4f33863b94c27c3b6d75471d0296e228d8c8002ace4e1bd7431958afa4c9ce4","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.875885Z","times_seen":221,"resource_available":false,"data":null}},"time_used":6759,"timings":{"blocked":6451,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ch.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.864Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ch.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:28 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 253\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-fd\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726448=scd548NbFsDlriR0p8lcpUSKGtPYT/fhUWpMVJoPGmWaQsF6U2I4BLnmRc69+bG+K/nZb5Nxfo6gYAUxm5/nVRo3rZ9J/GkSGOnre0pGmz3P/71ZNnUJKWEajfGx+N9q7mMdvR0KEp7aCj0WGUT104FuneAtUScTjVMzQbAizsq6TW7mypX6QZoLYJ3c+43j\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 97F4CE70-D0A2-4E15-A3FB-6AAA54453C42\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":253,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"413333fd960c6529af19d746b9a4a53d","sha1":"3ad2d0e44a6d2c385b4e4e939fcc2458bf156bfe","sha256":"b0c28761a2c82713fed641bce573087287f7d08f46ce1dbd6dd7821e07d092e2","sha512":"a68b66e2ec2e3fc4c52b9f24d15534e2c055f9f76c3fdab8a10a3070953b2cc95d58ae92e22a283e1665df2c10fe80c92812d5005a6cea4437495c6ebcd2dfab","ssdeep":"","tlshash":"38d0954a513d591c601c03789f783de140b530c4510c00ccf4902b34a14d7776cd19a4","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.832153Z","times_seen":223,"resource_available":false,"data":null}},"time_used":10388,"timings":{"blocked":10072,"dns":0,"connect":0,"send":0,"wait":316,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/tm.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.879Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/tm.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:28 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-7927\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726448=scd548NbFsDlriR0p8lcpUSKGtPYT/fhUWpMVJoPGmWaQsF6U2I4BLnmRc69+bG+K/nZb5Nxfo6gYAUxm5/nVRo3rZ9J/GkSGOnre0pGmz3P/71ZNnUJKWEajfGx+N9q7mMdvR0KEp7aCj0WGUT104FuneAtUScTjVMzQbAizsq6TW7mypX6QZoLYJ3c+43j\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: C0F49A12-4086-4422-BB73-E83D493F671B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31015,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b4a9137e526f2b7395e88598d0888f62","sha1":"0c5d3f13f64944662542cdbca6890329349fd036","sha256":"4e0f4fcb3126f6f75898f8880aab0b2817f8d623e1883a407322b0040b6d3d1d","sha512":"9b240c26ffe37edb74e155b2d24b1b16cd8e1a0c5cdf5b0c1a50417aa7aa2b0642af6aa279b9fc3597711fefee68b35561b468bd2878520d0195d4ad164d6ec4","ssdeep":"384:0VgVWaMugL9ggLgaH7O15GcHVPNaxLUiOrhwt9yUMgOS4hrE4BBaAEDiAG2/YqHy:06a63viOrhwtwguhQ4BBqi32/Zyn23Rq","tlshash":"27d20588e224d27cde5a4efc9f9fe5e0615eb1a981c44385a12a413012746dff6eff81","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.904624Z","times_seen":239,"resource_available":false,"data":null}},"time_used":11186,"timings":{"blocked":10877,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/va.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.889Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/va.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:29 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-156cb\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726449=vpeLL07hSueq0AZCW6GeZzDzGXWNqgbHdB/f9gPaWa5wNt3jaQKShVLZJ3pCKPgDVau5/AM3hUP0wq5SjFAkOc6CuqQCVF38P64YVQmqr4RgNwtd4wSSZrqQ+faVlTTccpGqvwWY0z09ahWFehlg/sZF4asfYvoTSYjCKHs880Ypey29i+bTJXY1/7lnEDNX\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 74BE0512-6952-4D40-8F8A-52A3BBB4EE36\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":87755,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fb1056e2f071f34537d348c7d198486f","sha1":"a8dde14a5fb4f6d2c15c4ec662453fc365e777d8","sha256":"b1380880a5b27fe136bf93c75be374e8905d59ae776f11e38f198740869fe529","sha512":"b30cc311a49ab2c0f177df87a2053b8a2869dc3f16b9686ddab985fa8e6747a9c87dae2e1248ea8098a2c70da5a9ba123d33a797faeb0a21296a0d51272b7a66","ssdeep":"768:cQCzB78z2gttyFxX8JaDXTCvgMqfl/IpV3H6XfH:MCSxX8ATCvgk3+","tlshash":"3f8390fc87644168f11b3aebce9669f83d1a107e7111138d9268906dc1e0a5ed4beecf","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.841304Z","times_seen":243,"resource_available":false,"data":null}},"time_used":11915,"timings":{"blocked":11485,"dns":0,"connect":0,"send":0,"wait":430,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/mu.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.788Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/mu.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:24 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 288\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-120\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726444=niqpTs3i5pScB5sdhQYbv9UeOXpC/6SkZBGmDec1KWAoguOnEgG6/YQDSGPahrzpTzPBegZG+o87VlqwtMSigoiJxBCOis4srJ/3X17TBeMy4fsOYcjCrSzAlfu6KGFFrgRGeCZvKgzld1PEetAYIwJt/KqkG8czJJIzRM/ltFaza4fyELPi6kRDt4K+u7on\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 85FA0E15-FF2D-43BE-9161-DB63C765D8A6\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":288,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5f938cd52c517e8d58873568b61c2d78","sha1":"73afae5147855807b0a468e028853d34f3030080","sha256":"140c93a2c000aa7d39e1bf9b7c8cc24248fc2d4049710c4420b057252dbad55a","sha512":"b29d3915c36a5bad38131a31388c412ea177ef9c24f97bcf48bd3ecc0f3aeff7f0f3e0885e61db55cc7a963ccd40eba146317bd196d987dd4daba902471abc6d","ssdeep":"","tlshash":"22d0c2fa883839049949c3b44f5eb2d3c1ba30ca600805eebcb009ac210e29bae80910","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.86802Z","times_seen":225,"resource_available":false,"data":null}},"time_used":7154,"timings":{"blocked":6718,"dns":0,"connect":0,"send":0,"wait":436,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ru.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.836Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ru.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:26 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 260\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-104\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726446=ptucVn3RIg6hfG1GeWyp0AOoGEPAGvUxzyHSXVviuYCOqdey2OA73hpJTOX54tL2yISiTotdyN9pyxfwsajn2g0X54hFpCzrKsSaHVr5h70Mejg6ceFPn+LFJGC2CRvHpMAwSOEi8xEAaElkrPte2SNNVvoHXHWjyZywau+M/ET7sJheupgJLbbmcQTs3DWc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 5CA66AED-5FC6-4781-BC23-DAB8965B9109\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":260,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"841e8de68beac527df51e6958ed5fe47","sha1":"f97d38cf7ff7c5ba3fa5f05f92fe263f1e62ee95","sha256":"d453758357d01be63e05a480c962b032edc4023da86bc866b0906a956fd7bab9","sha512":"a6ae79c1de68e5947eb361746f40c6f5579ebf042a7d1f81019a2d1e79191c33434cb478c5abfa3aa0dd3bda00a6d88e4d074b8a2cdbf132290c2eaa5e585520","ssdeep":"","tlshash":"45d0a7fa9238b9581a0d82b48fac76e3c4bf70c9614c00cdf9f11579210e7afacd6956","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-08-10T18:48:37.643934Z","times_seen":251,"resource_available":false,"data":null}},"time_used":8908,"timings":{"blocked":8600,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/sr.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.860Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/sr.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 298\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-12a\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 3046686D-E7F5-4695-93EC-1404904847EC\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":298,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ed37ae2db80f7efc439680a4c217bc01","sha1":"a99e60b95a32044464f61cb421948bb2b65fae52","sha256":"8858821d9f23901d92bfab539ffe28d244253f68f931d897096377c5e808a46a","sha512":"76b3c5d537c2b5000c32c8895960c628e0fab07d631e4d07522c999ad8f688185483d21991631053e6525ae3a2be25d0af9aa49485a6dba09acd72c27aae5b9d","ssdeep":"","tlshash":"f4e0722282b8b2bb998243a04fec34e20195a89d404c01caf8810421a3082cfb8c3a69","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.754845Z","times_seen":227,"resource_available":false,"data":null}},"time_used":10271,"timings":{"blocked":9964,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/bi.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.523Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/bi.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:19 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 1012\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-3f4\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726439=QLHfXzQcHU+/W9e8VZSSf0g70ZVVR3gGzGwwje9rBHVHza7Yt8wgF7B4H3StKTb5UUbJpmoUOvvq5sygHT45oSjYCEFP9Bv58IrLsh63Oc4/vMSbLNGWDi1m7j9FyJDIR37k9WK9e0JgHkfFZBg1+ZSbskFnMoTPZdqOPihUCE8ZxgQ772H2IN8bRUfDkHPj\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 4DBEA46D-6418-411E-A893-1AA8EABAB72C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1012,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b47d5cdaad9414a4aedd1a0e21b2f123","sha1":"89ed6e4f34929b01f8a36462180eafbdf3efc649","sha256":"4ac8b9eef5585df01a44f308e04a3b2270982319c16b2b882449d24c99dd312d","sha512":"2f8732f3819b73841e9d6fa6b1bd79832106d9f7d94e678e358355e8267542fa26f28c03f0b8d4e1203dcaa7e48ab6f1b9d190fdcc06d9b46c184db9be3fc33d","ssdeep":"","tlshash":"e211c2a4d1f0b3bc29815b9097bc38c5305f74d9c19e004c7090557471b9bdf99ee6a1","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.756356Z","times_seen":232,"resource_available":false,"data":null}},"time_used":2342,"timings":{"blocked":1909,"dns":0,"connect":0,"send":0,"wait":432,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/cr.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.586Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/cr.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 267\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-10b\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: E012C095-78FF-4E91-BFB5-B439BA5907CB\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":267,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5a301ef81c680b02c8285d688b819f93","sha1":"cffccf003518a3f62d7bb497c333e05f5b46de57","sha256":"ed3746e79d29107712310b056284d5944ce6c864adce93a0dedce417313fe696","sha512":"9c248069841df6ec55d2f2c5ee3e01dc6ccaa16f2a130ac99832aaabff1fc35372a4dd5515d70240667e2ceff820c6ca025790749660fc34fbfe837c107f3fa3","ssdeep":"","tlshash":"a9d02ba181347d84870453744fa875ea81767049214c00ddf8d01124610efff6cd5919","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-04-10T22:06:57.067342Z","times_seen":234,"resource_available":false,"data":null}},"time_used":3103,"timings":{"blocked":2678,"dns":0,"connect":0,"send":0,"wait":425,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/assets/pages-index-index.78roOzgh.js","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:16.286Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /assets/pages-index-index.78roOzgh.js HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://qu8q.shop/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:17 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Thu, 06 Nov 2025 05:25:21 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"690c3141-b1d4\"\r\nExpires: Wed, 03 Dec 2025 13:47:17 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726437=LQku4o/SnmHfqPhRUlKy429dZqXOiNSeVmzGEaAhs5aJ8K5DOwu4623no8Znj4Sno8cFlmRH1nXTof7eCehL2VDWrvRACwFRuXYqkgJ55Z3zlc4foh+4eqPcc++qP7/VQrMo3q+QQaV/6764kvf3+8hwMcM7iqdZT8vPF7GaiI0CeKj5TyMcj8xwf9/ixwMY\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 7350B9C9-428B-4838-B7CF-728B070A990E\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":45524,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (42085)","md5":"e42def0383336ae35b3c011719ca6584","sha1":"653c93f88540ed592c99682b93b5f836b36443d7","sha256":"02e9feb36546848b060c2118efaa28ab90c19c806cb164f083a0be0c7a56537c","sha512":"7418e46567d82aa0f626e7dbf721817124ab59d5cdadec2049934ad3e99391534283429e40fca6c415214cc437f3234d35f7eef96973b651eef244136c689238","ssdeep":"768:c+eTMvgG6Q7KzhWoeTMvgGmLfSbbpFdle7Fn3dNITK0CuHmxsA:NewvcVewvyL6V0V3sThCuHm","tlshash":"d1130e67d150c99c7bbba2eade6916a0148d0758f1db00283e7c6fa914f87b0713ee35","first_seen":"2025-11-08T03:51:01.935851Z","last_seen":"2025-12-07T03:25:24.526065Z","times_seen":4,"resource_available":true,"data":null}},"time_used":1874,"timings":{"blocked":629,"dns":1,"connect":308,"send":0,"wait":615,"receive":1,"ssl":317},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ba.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.497Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ba.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:19 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-4e6\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726439=QLHfXzQcHU+/W9e8VZSSf0g70ZVVR3gGzGwwje9rBHVHza7Yt8wgF7B4H3StKTb5UUbJpmoUOvvq5sygHT45oSjYCEFP9Bv58IrLsh63Oc4/vMSbLNGWDi1m7j9FyJDIR37k9WK9e0JgHkfFZBg1+ZSbskFnMoTPZdqOPihUCE8ZxgQ772H2IN8bRUfDkHPj\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 29F76E2C-29B2-4F45-BF90-A463000D9209\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1254,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9624e33bf188910c8123aef6f4f7d824","sha1":"ca2cb0e596c911a91bfd88b7347b800a790e9cfa","sha256":"2b59e85fe1049060826be08c8e357686a23283e48926d3fc707fb1f32c6aabe4","sha512":"5cf55a2ee62808e60192a7fdb660fca711aade4d5122eec7885df38176298db3363af15f3af4d1f0637af50459bc3dc25b9f1fbbbc46c810cc097228b628b775","ssdeep":"","tlshash":"b2217d70d27490bedd0f53d1e2487c60a99f03c92050d2ecb2f06e563c592ed10ad4a6","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.822611Z","times_seen":109,"resource_available":false,"data":null}},"time_used":1957,"timings":{"blocked":1525,"dns":0,"connect":0,"send":0,"wait":432,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/so.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.855Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/so.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 447\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1bf\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 1043BB19-C46F-4AB3-BDF5-27FED02F93F7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":447,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d25cf28ee475e66fc2afa7fd6bece5e8","sha1":"e94cada80e94b7648c7711e2567ba170cd9dca03","sha256":"9387769502d6359e1f6bcc496f2f9b37cf5b32c4710ef88b3a16ef7c94b6684d","sha512":"d86691a16010176753f9e8216319fb06659c92436f739a57aa83e25f43a0b3b4dc5134fc8112690500e519b7caf634c8bb5951fad5fbbbcd07f13dbe7133d34a","ssdeep":"","tlshash":"55f0dc28a1b8812d0d490bb08afca8c5013f719c004401ee70d03656206592b10e52a2","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.750216Z","times_seen":224,"resource_available":false,"data":null}},"time_used":9969,"timings":{"blocked":9660,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/assets/pages-index-index.78roOzgh.js","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:16.887Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /assets/pages-index-index.78roOzgh.js HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/assets/index-DtgRzBWv.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:17 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Thu, 06 Nov 2025 05:25:21 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"690c3141-b1d4\"\r\nExpires: Wed, 03 Dec 2025 13:47:17 GMT\r\nCache-Control: max-age=43200\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726437=LQku4o/SnmHfqPhRUlKy429dZqXOiNSeVmzGEaAhs5aJ8K5DOwu4623no8Znj4Sno8cFlmRH1nXTof7eCehL2VDWrvRACwFRuXYqkgJ55Z3zlc4foh+4eqPcc++qP7/VQrMo3q+QQaV/6764kvf3+8hwMcM7iqdZT8vPF7GaiI0CeKj5TyMcj8xwf9/ixwMY\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 04321878-9A4E-4BDF-B95D-D9977D75DCFE\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":45524,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (42085)","md5":"e42def0383336ae35b3c011719ca6584","sha1":"653c93f88540ed592c99682b93b5f836b36443d7","sha256":"02e9feb36546848b060c2118efaa28ab90c19c806cb164f083a0be0c7a56537c","sha512":"7418e46567d82aa0f626e7dbf721817124ab59d5cdadec2049934ad3e99391534283429e40fca6c415214cc437f3234d35f7eef96973b651eef244136c689238","ssdeep":"768:c+eTMvgG6Q7KzhWoeTMvgGmLfSbbpFdle7Fn3dNITK0CuHmxsA:NewvcVewvyL6V0V3sThCuHm","tlshash":"d1130e67d150c99c7bbba2eade6916a0148d0758f1db00283e7c6fa914f87b0713ee35","first_seen":"2025-11-08T03:51:01.935851Z","last_seen":"2025-12-07T03:25:24.526065Z","times_seen":4,"resource_available":true,"data":null}},"time_used":311,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":310,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/az.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.441Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/az.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 489\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-1e9\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 146CE31D-63AA-4AF2-A2DD-6DECA409488A\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":489,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ae2eb65ab2e04b4ef5783e5850977d06","sha1":"fda69eeebc47b73a486e15262afbddfb2094bfe2","sha256":"95a7aa6642b28661320ffd2c79ec15c253064ed6e149e5a76e8086b50e82d68b","sha512":"c3681dcff04a06eed029a374881295449b4a960a422f748cb9b82ea298e4d5e13fc17615869c2989f8fb852cbca7a2e29eb6092d038216edc24792a03abde920","ssdeep":"","tlshash":"09f05954d33d7496ae0882f00bca79e191da20ce4348828eb052006773153efacca910","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.884992Z","times_seen":234,"resource_available":false,"data":null}},"time_used":1241,"timings":{"blocked":806,"dns":0,"connect":0,"send":0,"wait":435,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/bd.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.455Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/bd.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 179\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-b3\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: D98F062F-6D56-400F-BABB-FCF0BA2004DC\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":179,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"24a87d6b16d46b4a517093fa709dd8f3","sha1":"4c30121f752180f0422cfd7b3426750b484a7c07","sha256":"04399963e8f6fe51a0b7549fe9b41f19152bf9ee605608714539570ae20754c8","sha512":"4e23fa2b7578c89f9118ffa92c3dd69638fc400538f588db802bbdcfb8e5958db19cccd10e5254f04074b399c63e9d6047a17981d4913a5cfdb4fd6e33a7e90c","ssdeep":"","tlshash":"d2c0c09b63aff80c1f00c120062932c2536f0088038402bcf4d0087110051e33c81430","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.927698Z","times_seen":233,"resource_available":false,"data":null}},"time_used":1522,"timings":{"blocked":1099,"dns":0,"connect":0,"send":0,"wait":423,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/bz.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.486Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/bz.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:18 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-b403\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726438=zClGRpuB7J6ooMLJDvy+dP1WYhMEHTq/2LJZepwe02v5ccvnxxS5OQp5MU8mULrlRqADcBdjZwHr7DPrSMC30qzRkGpJZHZWdk6mpanmvoqUDol68gVO5F1hIY0Rt700Zz1OSoRwGqVwL6WIWYVXXL9yA2PTqwBVZAiQwW1eUq2Zyn12SlO+/kjvCLdcfMbU\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 93DA7B54-A474-40AA-B214-9EE6C1EACFBB\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":46083,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4aaadd11e9f8a58ccec3755b4c1b57d2","sha1":"1cadb53892034048e33b3ed923aca7bc692ce0ef","sha256":"065f996a41ec5b2fea79c73850efc74359a932e6e0d0f9e3697cbb0bc56f21b2","sha512":"71e592292b0df12113b568c83a1f0b829bfe2b4151dd08400605ee2f51788d24430f2280a36cf7e452e70bc6a182dbe9447bb0a4ca2514ccc1356e543dc6061c","ssdeep":"768:xwopSEl9d+qhpYJ3emuMX3Gpd9UhgyL8ubi0mgH9UUU5oqfstF4r:xwopSEl33k3Gpuxbi0mgH2l/fyyr","tlshash":"2c23de7cc358d3fced96dabc9f3590b4a24ea1a9b1e5c345866dc27021d20cde28f895","first_seen":"2023-10-12T02:52:42Z","last_seen":"2026-03-09T22:27:09.751636Z","times_seen":247,"resource_available":false,"data":null}},"time_used":1876,"timings":{"blocked":1217,"dns":0,"connect":0,"send":0,"wait":658,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/de.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.67","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.661Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/de.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:21 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 199\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-c7\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726441=JHGeMlqLy0gB5ak0wqadFpXGs3jM0Lo0M6zpM+XNz231JxpbP0A40EIy6YAGOKWCUUKvhgxieDl2ZDNrB4enQOS9H/6MwGnh5UiaeNYNMLt++1i3qhK7sfzsnGPa7MewtPpo89eienZJybDLK4IakcYHNlxcLcw8BoCYNUG75GMW74KuNPfLYIP7Dw0B494o\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: F6CD102C-E017-41DD-BEF9-2C881094D89B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":199,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f1ff035efc19e0c43a2f652545b1b0b0","sha1":"037695f450cfb5378a46895cc2c365627b68a6d9","sha256":"52daccdb2da466b867f4ee4b752af6a30465b5dba009a82861c9c6bae4c98090","sha512":"b057dbe6002a92eb69d764a6ac7bec28e52a8cadd46c5762f0b80e1e4aaffa4298ded06ceafa85ba516bb1d260ec6172570187c3d74b92ce180ba289e5891a58","ssdeep":"","tlshash":"24d01299d5397a058544c7701eac32e6c2ee70c6614c00def8b01e6d114e6abfccea64","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-08-10T18:48:37.647553Z","times_seen":233,"resource_available":false,"data":null}},"time_used":4258,"timings":{"blocked":3950,"dns":0,"connect":0,"send":0,"wait":307,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/gh.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.665Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/gh.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:21 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 264\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-108\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726441=JHGeMlqLy0gB5ak0wqadFpXGs3jM0Lo0M6zpM+XNz231JxpbP0A40EIy6YAGOKWCUUKvhgxieDl2ZDNrB4enQOS9H/6MwGnh5UiaeNYNMLt++1i3qhK7sfzsnGPa7MewtPpo89eienZJybDLK4IakcYHNlxcLcw8BoCYNUG75GMW74KuNPfLYIP7Dw0B494o\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 61A7C67B-C2B2-4062-BE47-5BC3C1F19040\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":264,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"53fb1b33d233d587c104d6e2eae1e060","sha1":"ad82be333c5b987499b3fb76ccb2f3cfab3ee433","sha256":"e63cd22951cefe555747a575d322530046b4d603c0956a998b49ba46634a76e6","sha512":"223f48ef511b150b8b04925940cacebcfc1a97e63817389a0035899c8a9efbd30f61df6258a6571bf7eb2af5447fc7220b93ad28ff777406867c89be4dc5b651","ssdeep":"","tlshash":"fdd012b99129b6560605c3714b9836d2c1e760da615c01ddf8e4016d114e77fbcc6954","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.882589Z","times_seen":222,"resource_available":false,"data":null}},"time_used":4364,"timings":{"blocked":4044,"dns":0,"connect":0,"send":0,"wait":320,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/id.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.719Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/id.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:22 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 170\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-aa\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726442=gJUnq7o/nuIFIOClArlD3UlIPuratDq1z3ELc/Bsj4ZVvckePPdCG/AgxAw7iOfBJryeKqVWneAmIKd/t7QURnVkW8mqygtKYT7/nk4dzdqr2KTSp4XPKH+NvpghUtpgyXpIizih7IYorziMXJKVr4cArcJHHSiEv1sWyO7oVKu5F8CBiQoMmjYNo5RzVgWt\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: D33D385A-C314-4FAF-AC69-30A9FC388CD2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":170,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f305de337aee029e4d6de819ec2db018","sha1":"c5962f477b60bf16b2817fdfb92d70aa13f10d93","sha256":"904b6813c5ad2088c85d519ec79d8f67580b5bbf76c77695734d85cceee3255d","sha512":"9cebf53d56e67477def5b8722435fccc35ee21cce2bb029780924e17e3b9455eea06f655703b7430ec0eafe06ca686cbff6749a60696c30b5248196cb94dea6f","ssdeep":"","tlshash":"1cc08cae9029ac04474887711ba8bac241af208fa08801eff8b10522228a6a77cc1d31","first_seen":"2023-10-28T02:46:19Z","last_seen":"2026-08-10T18:48:37.644746Z","times_seen":229,"resource_available":false,"data":null}},"time_used":5067,"timings":{"blocked":4748,"dns":0,"connect":0,"send":0,"wait":319,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/nz.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.804Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/nz.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-7f2\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: A571BD87-3D22-45C0-8BF0-5C80628D2D4D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2034,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c277e7e26ee2a74e65c723d13749c8c9","sha1":"bdae7d9d7bfdaf2ec2f4f2cb9ed9908486f02c21","sha256":"1f0b2203de97ea2cfa623a75067d608fdcd6169b18d42c744f4ef0b5bead2a48","sha512":"b0ef5f2b9dca1adca228235caed2d5f088b8a9e4edd1ca551829052bf2345e15116d91c0949da748c6442a667ddd2acf049e11bb8ea627f3104ff2330e8c728d","ssdeep":"","tlshash":"7c41cf81f446401cc53857a4cbe8eedc815fa59ba04708aff322798f61fd6eb9898306","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.911166Z","times_seen":108,"resource_available":false,"data":null}},"time_used":7844,"timings":{"blocked":7510,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ro.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.835Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ro.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:26 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 279\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-117\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726446=ptucVn3RIg6hfG1GeWyp0AOoGEPAGvUxzyHSXVviuYCOqdey2OA73hpJTOX54tL2yISiTotdyN9pyxfwsajn2g0X54hFpCzrKsSaHVr5h70Mejg6ceFPn+LFJGC2CRvHpMAwSOEi8xEAaElkrPte2SNNVvoHXHWjyZywau+M/ET7sJheupgJLbbmcQTs3DWc\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: A398A38C-BC7A-4D4F-907E-3FBF00FA40E6\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":279,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"414051ff75578cb2662de0beb377e7ae","sha1":"d4426fc8eee05aab07c2567687dc52ebb69002bf","sha256":"00009af481c46b8a34408156d77d9399aa2a4123d9dc7e156c75aaf797176c5c","sha512":"745aeeca7c79063ab0044d58039549f94a3d40b893a1eb26ef9cd333301d185d4a5f9a329f4a694fd7736dcc85f3a07df2b0920ab2de155ef3f0af0696bde447","ssdeep":"","tlshash":"7ed02b95873da4084106877457ac3ce629f630e8a04814cdf4d12561334979f68d35f4","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-08-10T18:48:37.610772Z","times_seen":229,"resource_available":false,"data":null}},"time_used":8948,"timings":{"blocked":8517,"dns":0,"connect":0,"send":0,"wait":431,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/lk.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.858Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/lk.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-2bdb\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 48B0C6E2-0A5B-42B5-ACA1-0EA985A6EA8E\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11227,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b176492edeb4fd466f1d049efb9cc8c0","sha1":"3d7bf7acd4dca8ca344d3eaa6c10791f7f923e55","sha256":"2b72d1153090a875cdb86fcc3c559bd6827ada9744529d0e648fd7d78eb66ff5","sha512":"20b24dd173c80a97508c1b8a1b9df8bca43a1d23497bb85fdb75d8754ae5afab802dc145823f3a5a281f8979404043b89e90bdc39f76e0e57d1c4e23fff87db0","ssdeep":"192:jL20NWGR5eZli03T+GXxfm0FBQSJ2DGe+CLzvuBEYg+2sv0T2Wk4XI:f5JTvg2ievuB52OPP4Y","tlshash":"1732a07c8658d2fcde66dabc9e3290b4d14ee1aee1f4c3159b6cc57022d20c9e24f859","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-03-09T22:27:09.812906Z","times_seen":240,"resource_available":false,"data":null}},"time_used":10078,"timings":{"blocked":9762,"dns":0,"connect":0,"send":0,"wait":316,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/co.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.564Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/co.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 263\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-107\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 030D30AB-C2E4-4C37-B796-95A3743BC97C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":263,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f47349eaf5e6e6fbedf3ac5defcad67d","sha1":"d20d211bc76bdc05892b2079374f1f21e81be889","sha256":"8d56c1761623715abe9300ede1a75f017e7ac21d5fec94fb7056eeda9c5c5cd5","sha512":"37d0756adede3dafdeab18459869ff5b14a0de80e6d38e614b89e32d6932b558ecc75a78a3f558982b808383f7b7de9f17488c3b2cf460c0fbbb3fd5faa29591","ssdeep":"","tlshash":"77d02eaa8138b824150ac2708ba87adac1be304a204800cef8b00226210ebaf6cd2958","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-04-10T22:06:56.958133Z","times_seen":231,"resource_available":false,"data":null}},"time_used":2801,"timings":{"blocked":2467,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/cu.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.590Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/cu.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:20 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 562\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-232\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726440=x5S780hpEyGuoOILI8HeFP1qpmzYf4HF8Pa5fmCYFe73v2dNl1EGqSFoOz9W8J0xzDnYprdgQLzVvRNkyyve23Jn+0UMJZFQvpJITVZXTz/nMu+HynsqB16/XheM7y3hwn3M54LsBaIy/2OSY2euf5oKrd8INxI2v2VxKdcwmdLDBpTmkxU3yAGFP7VjyYqQ\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: B79BC2EB-2441-450A-AA9A-024BA51239E0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":562,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"413a38b9f345b27f33ba42bc3931ba19","sha1":"4189d1c53e36f382dfaf52946d22631e54fc4211","sha256":"6752251bd3b5a081ec98da1659830d371218b5aee8a2b66ae78a4dc6ed5c10d1","sha512":"671981c696d4207e59e1b9c9441943db623bb59d01cb1bbc83fbc09a45ed83111feac10c2075900bbd844525a7f4a52290f03aecc1b8e56a4a5baf6288d9a9e1","ssdeep":"","tlshash":"e0f08ba43abcb2e919660bb1c3bc38ca12aa31cd43e10adc75a80638722d75f35c1533","first_seen":"2023-10-12T02:52:43Z","last_seen":"2026-03-09T22:27:09.835091Z","times_seen":231,"resource_available":false,"data":null}},"time_used":3114,"timings":{"blocked":2776,"dns":0,"connect":0,"send":0,"wait":338,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/mz.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.798Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/mz.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b2c8e4-9d9\"\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: DC88CBC2-96D1-4F9E-916F-BB2DCA162667\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2521,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f001e34f634876f9585e7883550b077e","sha1":"09ec285e6de29a9c30e7568ebb0782a7664d35e2","sha256":"4e004c7f41787ad6d481857021a3537bfe99520979204bb14acd2dced71a4230","sha512":"6edeea2b812628d2b20be6eaf0ea2838de5be064b0a33f594d8b45c6c2ad68b257b4bcdf224d895b20a4b2e21fed1c7bf608f93ba11ded5d904b1b15941794d0","ssdeep":"","tlshash":"db5100a89358dabced67073ccb2932f2611f30cd51d89244a274043472462eeb69fcd5","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.910152Z","times_seen":109,"resource_available":false,"data":null}},"time_used":7464,"timings":{"blocked":7145,"dns":0,"connect":0,"send":0,"wait":319,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/na.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.799Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/na.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:25 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 930\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-3a2\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726445=eYe1KPhHOcphTKfaiKZro1JvSj5AHruP7rTKLJ+zf3BsqMC9RlcUEDv+Nheu65CsLMulr5p5z9xiDaHHwZks5FFwK8hVyRpDy/4lVXpCJNzjtBOw4J70XFvHq0V/rXBKukJySPZ9nqxQGmKJ1SY36H/vI5AqruO5lEU84e4Plk5hemDfyC6NEjIAhbiJBZTN\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: 4543219D-7B24-4016-8871-440ECD7F128F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":930,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"173c00adf804b629ebfbf9a72735a0e9","sha1":"39c2726d14cbb29a7a3cc1730866e35fbd87217b","sha256":"9516318f1e78da5ac2495492835093e245b8fc8e512719074f9abc38a01f2a22","sha512":"249289c4ac10c150f5b7ae0359c2500418803dd4ffed31ad7e5ae30e416d9cb1dd18d7f34cc05d3690dd87db5333d90833773f9783f4181058e7fbf110807eb5","ssdeep":"","tlshash":"bf11d0e6c278b7759f26c3f04a3874dd418b708cb95801ac74d29538335abdf9989b83","first_seen":"2023-10-12T02:52:44Z","last_seen":"2026-03-09T22:27:09.794854Z","times_seen":223,"resource_available":false,"data":null}},"time_used":7514,"timings":{"blocked":7180,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/sg.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.851Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/sg.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:27 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 832\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-340\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726447=qu9bfMbv4CWzSHMqBilxacynHuAT7/z0t7JwJTomZHOCfGHcNW8ibY/XAdIyvHW/FgceMgQeTqLXwG6ieCF0vgveXzUfNfGDPz8f1BQTb2B6acJ03ex5RZiYdRgLtF/IHxF5ZXIknCMMjxuiNbPf243kB4o+9u/UWjTIvfQYY7jxI4ChFSe6Qdo8k/fFqt60\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: FD7C4C85-7827-40ED-AA06-A82EE740E5C4\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":832,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5a056a68ab721a1e5f86683ba80ce9c3","sha1":"ba3eaae6971be95ccf537aea5537ef1dc7b43964","sha256":"b0ca3cf8c307717c286aeabe86343c2fff6c2deedb6f3843991e9075b78f5e51","sha512":"a7b7b3a06e1f3736ca16896437318ce729c2936e629910b514086443a68678d3c3d62712d0f57ca523847ffeda62e463f3874f6ea66df2971aa5bd852800ce93","ssdeep":"","tlshash":"04018eda93b0b57d0e1783b14ee875e190fb3499b5c502a820da56d822d1287acd5d91","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-07-18T19:09:08.547986Z","times_seen":236,"resource_available":false,"data":null}},"time_used":9664,"timings":{"blocked":9357,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qu8q.shop/static/nation/ua.svg","fqdn":"qu8q.shop","domain":"qu8q.shop","tld":"shop"},"ip":{"addr":"154.19.192.75","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qu8q.shop/","date":"2025-12-03T01:47:17.882Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qu8q.shop","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Dec 2025 02:00:57 GMT","end":"Mon, 02 Mar 2026 02:00:56 GMT"},"fingerprint":{"sha1":"E6:83:26:8F:19:23:8A:1F:C4:E5:86:C7:51:08:7C:74:B4:4C:A2:B8","sha256":"0D:E4:F2:0C:7B:35:76:5D:29:53:99:C0:77:AE:9B:3A:7F:1C:3C:28:BD:2E:C5:D3:86:C1:15:AD:A3:65:0F:50"}}},"request":{"raw":"GET /static/nation/ua.svg HTTP/1.1\r\nHost: qu8q.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qu8q.shop/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 03 Dec 2025 01:47:29 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 214\r\nConnection: keep-alive\r\nLast-Modified: Sat, 30 Aug 2025 09:48:20 GMT\r\nETag: \"68b2c8e4-d6\"\r\nStrict-Transport-Security: max-age=31536000\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1764726449=vpeLL07hSueq0AZCW6GeZzDzGXWNqgbHdB/f9gPaWa5wNt3jaQKShVLZJ3pCKPgDVau5/AM3hUP0wq5SjFAkOc6CuqQCVF38P64YVQmqr4RgNwtd4wSSZrqQ+faVlTTccpGqvwWY0z09ahWFehlg/sZF4asfYvoTSYjCKHs880Ypey29i+bTJXY1/7lnEDNX\r\nX-VIA: l1=89FwNPowyEKogcuA\r\nX-VERSION: 1764652599\r\nX-Request-Id: D3477BC0-FA42-430C-AF3D-676A0D5E118F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":214,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3597132196417d27b5c8660edc79b277","sha1":"9ff2fb4a5a9c6ac048633a2ff859633560693372","sha256":"3605e02d30c0c08a9825f1ffe9b4b0e46e6a55c6ca0b3f5d30eaa73c19daef2a","sha512":"8bd32d56f7892779e9774ea0d67a3cb12c92cbcc094c005a2e660b9fc11a03116c34c3098cf5ad3dd8ca21f5660ba9e3b27776c67bfbcc30ff2c0ab2b9a7dc0e","ssdeep":"","tlshash":"bfd0235981286c54150841b496a87bd2c0fb7005614801d9f4f11110210d7f77cd6964","first_seen":"2023-10-12T02:52:45Z","last_seen":"2026-08-10T18:48:37.613576Z","times_seen":231,"resource_available":false,"data":null}},"time_used":11319,"timings":{"blocked":11003,"dns":0,"connect":0,"send":0,"wait":316,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-03","alert":"Phishing Block","trigger":"qu8q.shop","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-03","alert":"Sinkholed","trigger":"qu8q.shop","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}