{"report_id":"48a7c072-f99a-4388-a258-d9d0ce3812ae","version":6,"status":"done","tags":[],"date":"2026-02-24T16:15:56Z","url":{"schema":"http","addr":"vipairesearch.nbmz168.com","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"172.67.131.245","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/onboarding","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"title":"Coincheckusa","dom":{"size":23884,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (2465)","md5":"d93ea9bd3a7f7532860d80fea03f13c1","sha1":"d62dfe37655c7499d9e0f7e605288c63b1c0be3c","sha256":"4ad5cab925d7bd875683e549090aaae2015d266ac1d91f56a03b29427d8efcdf","sha512":"0563bdefbb04feb25d1758f1dfb3839ce8e9bea76c65de85738d7d7a3b99aabcbd7b7ca962e1e620e8da2c7964f91264078af7d041c67eae05473dbd71424fb4","ssdeep":"384:k2tZCxl20cJFJf46FVyGxpOfY9b6LrCr2jfV3yBcNYqoI:ksQxl2/FJf46FVDxAfY16vCr2jfV3ekH","tlshash":"27b23056d6f128d7c10b8358f4d3bb2362a249458f8b8cb4bdadd0784fca9d4427be58","dom_hash":"domhashd74e18114e5bbedd89ca8bfe64f1e961","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"vipairesearch.nbmz168.com","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"172.67.131.245","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-31T16:15:56Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"vipairesearch.nbmz168.com","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":44,"received_data":6142142,"sent_data":18735,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Unpkg","description":"Unpkg is a content delivery network for everything on npm.","website":"https://unpkg.com","common_platform_enumeration":"","icon":"Unpkg.png","categories":["CDN"]},{"name":"dc.js","description":"A multi-dimensional charting library built to work natively with crossfilter and rendered using d3.js","website":"https://dc-js.github.io/dc.js/","common_platform_enumeration":"","icon":"dc.js.png","categories":["JavaScript graphics","JavaScript libraries"]}]},{"fqdn":"webapi.tmgmh.cc","ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":41,"request_count":41,"received_data":234259,"sent_data":21031,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"unpkg.com","ip":{"addr":"104.18.0.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-01-06","domain_rank":1093,"first_seen":"2016-01-07T23:26:01Z","last_seen":"2026-02-22T23:25:47.841062Z","alert_count":0,"request_count":4,"received_data":341931,"sent_data":1604,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"ca2c8a513ba4ddd84c4c4857faf9f8b6","sha1":"29c6e6c68ff201ae5b1df93335a1170398f20b2c","sha256":"4466292d90055a17bde39e5aa47cf9fb23a76ce5d88f990de0cb7983d451a0df","sha512":"e886ba9c1a87b369d2ccd457d266da56dab3237f1446981dca3c9fda74e822dde664b62d3272bbe59b1e04b5ab7c49fd34668ad0e99528ef6850c3def75f668e","ssdeep":"","tlshash":"33c08cc4a0c27e509622641820bf28e89038402674485f529d98e84a3e760b08233eac","size":147,"data":"","first_seen":"2023-12-04T02:29:51Z","last_seen":"2026-05-29T12:32:32.194132Z","times_seen":172,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"7de71cd324bb8833f4a138cbcdafa759","sha1":"d7a8122c1483170fa571ec47c62f91c66d662ede","sha256":"62b9d7d992de0ba11591d4ed7c7ab166d886c09ddb4a6b79693795ce836c6003","sha512":"5d42f665549881c48abeb0ee42138dcd1b0f6140e49c3fc6efdfe3657cba54e63218787f0b0d2f12622873799b4ec3a21b9f4f62194f2cc9bda2758dd699a439","ssdeep":"","tlshash":"73c08cdab0d72d006602642110af78e8a0388027b08c9b439cd4d8883ea30b08233fa8","size":151,"data":"","first_seen":"2024-01-05T03:21:29Z","last_seen":"2026-06-04T04:33:14.48971Z","times_seen":346,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"361e9d9b886c9f2b98f57c626c09b9d8","sha1":"01032a33013459a8de015112421c1a9e467f5d44","sha256":"b96071e372b614f6406f0b01ed200e24be43c5c21eac83934e41d7dd6f70ec38","sha512":"c3dc60f09e32481fa8a331627b2cd7911592847e3e0e82721694d14205de941a15ef18259c871c5957195b1ca8b3b63a8109390863f3f8d48e5e8a7d3f8b02dc","ssdeep":"","tlshash":"8bc08cc4a0c22e102602641010bf38e49024402774881b028cd4d8482e230b08233edc","size":140,"data":"","first_seen":"2023-12-19T15:12:13Z","last_seen":"2026-06-05T10:33:32.165377Z","times_seen":523,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"0f40806f855fc503ec7fe0e2cdc6da5f","sha1":"ad59d99993690064ee6565eea713ee4c5260f572","sha256":"954bc1931a5584c910a5391a0e2c05ba7190f3c672433a85c162ac948a74a44f","sha512":"7ea9c1cffaf640bc7083f2306a134368aa54ae775230a1f1990c43817594d950ecbf94412ea7ab6262bb8add4715ab6fffe7579f85b0a1c07f6acc4f8207cd9e","ssdeep":"","tlshash":"1fc08cc4a0c2ad001a12649010af24e49034402770481b029c94e8492e220b08237e98","size":137,"data":"","first_seen":"2023-04-13T00:16:19Z","last_seen":"2026-06-07T01:31:45.126712Z","times_seen":5592,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"aa5c228aff1739376b9728daa74dd5d7","sha1":"b4eb4c4197b911829b36c56e3dcdbb99861f18fe","sha256":"80d8e93e5124fa764d528a7508db31b0997262223e5ab64cf0e1a991b8974ed3","sha512":"5ae111af049b7278cc635e79992ddd147531b1e922f568bff0476e75907c2a92c8c01d3b561ee66bc6529b6a495d15c7797f163eb38f693a7856a01a16f3118a","ssdeep":"","tlshash":"8811d66e839523d0051eb0522c9ee1485b3780ab1c7c75123d3e2241af1c69dc3a2bb7","size":876,"data":"","first_seen":"2026-02-24T16:16:06.432952Z","last_seen":"2026-03-16T14:26:38.520877Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-d6a1b62a.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d091bcb4fc44700520eccc44e85dca1d","sha1":"110b30ce0189f67728dbf97cbdd956373a3b0621","sha256":"94fe426ef8d3c4bfe2808b11a19a5bb4b2bad88c78a477906eb785954aab72c5","sha512":"9b3041c295d93f3ee7d4c7a26ab609d3860f6bd199a1618cb1b55ffb55dbda2493a1035ee216b89ccccaa31bb4de56c0b7c1cc025e612a13401483203b2e0f6e","ssdeep":"768:ar/46GmPgf/3g9IP2a1WD8HWYWcNhz95o2HohX4DHR/cYuj3QorVFInyRC7I3g5V:mJOJ1bWcNxUyyXj3QorVlRAEzeg5jQr","tlshash":"92a34a8e940b0fff59ad0858ad5b591020a90fd35c8c8c83b3baae5537facd4a75971c","size":100987,"data":"","first_seen":"2026-02-24T16:16:06.378532Z","last_seen":"2026-02-24T16:16:06.378532Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-7de86585.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"084dacc20f5381766c7bc46e75ef3e46","sha1":"59c8a167cd517dbd266c22e4815d19e38deeae36","sha256":"a0a4090dce1d2b802ce516b0db0412516305c45e239f84ef7a3dc5a9e48be0f7","sha512":"797b91bb6c5da3daa5247727401843eda4c6b16dffe50148c67e270cc91d9d84bb339b0e830912e53a4432c6009e86ac6def87edb1664f53d97860a025bb97d4","ssdeep":"","tlshash":"58f00e2fac7b50b21ba388fde1231811660c0f567734c5e8e58b0e00db388e7d21e628","size":515,"data":"","first_seen":"2026-02-24T16:16:06.37063Z","last_seen":"2026-02-24T16:16:06.37063Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-e4f28d41.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"93bdb5c0898df85cbcd347d8cc308b6a","sha1":"2a9686d2c341f04c52b2f0b3c49b53943d4342a1","sha256":"507d598e5652fadce14791eadd6021a69697a5a3209aba584b85c3c7ef4bf7db","sha512":"ff1393530e7fdaddfab36977ba796161ed1c68b7e1f0d5de7ff8eeacbe01e216e6f29047289ce4e08614ba7857c1f7473769ddad2a8f8e4667eb29200d9819d7","ssdeep":"6144:78LAvvvGcX6rwahdOjGhAaqtTigdhrXjXFcFV4Z2+EHLzFYUU+5MBdx1jBfRUiAt:78896V2nZ2+EHLzl5MLBfRfAfOGvh1tn","tlshash":"49d42c46f25638338552129cc87f2607a3756d49598e846cf5bdd8e72ca8e4832bff38","size":656143,"data":"","first_seen":"2026-02-24T16:16:06.381401Z","last_seen":"2026-02-24T16:16:06.381401Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"e030ebe371a1acb01c5d7ebd3098a624","sha1":"f33cb7c303f8f522f8b922992e4373f0a423080b","sha256":"071f7cb610fee964d0bb5413590468d1b9367d8a0c01d8f562c845039c2924e9","sha512":"7ab6389cfc6a8ecd48f1c7cb79a1defdad17712ed35e250df0bfcc24857c86ea8d0f2b7c363753493d454a21b51abbe703bbaef67fe06f6b798c3e1906b3acbf","ssdeep":"","tlshash":"3811abfe191a702e6303404f976b7801a42260a9001a184277ccda9dbb9ab7de0cfb8c","size":1048,"data":"","first_seen":"2026-02-24T16:16:06.435393Z","last_seen":"2026-02-24T16:16:06.435393Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"7746993e8adb9277ba5afa2584910974","sha1":"8e7e6d562fd56f594b40b6657156d483d7426e40","sha256":"833dc15f120cad89d5c0680edae217dbad02010e42af351959607df4170074ee","sha512":"10ee66e22fa45386057f1385e179955ad4fd4d53363c0aebe68aa9ba0547bf409a286e53ab6e678e5d0c3485d6cabcdd359f359c5258160b50a0a5a5496d6e6d","ssdeep":"","tlshash":"39c08cc5a0c22e101646641010bf28e49024402674481b028c98d8482e220b08233e9c","size":140,"data":"","first_seen":"2023-04-13T07:32:13Z","last_seen":"2026-06-07T01:02:03.333091Z","times_seen":3515,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"4caf8a841db7203b84e0edc20e58835a","sha1":"b5b3118afd2dd8ac51b553fe6da85b7ae01f3d28","sha256":"f93458a05da187cfec6494631299c560ea1e8a65fe2b109bffd7c66ed47241b0","sha512":"d85d0c12f2407a7193bda033e1900cfc2d5fbd6c6420f2820c137470da486a09c2e7cd9d58addf73207da45e96a187d4cd5dfeb0173b410dc376d73be316b1eb","ssdeep":"","tlshash":"14c08cc4a0c32d001606651018af24e4a0244026b0481b428ce4d8482e620b09233ea8","size":139,"data":"","first_seen":"2023-05-11T11:46:06Z","last_seen":"2026-06-01T19:00:25.01712Z","times_seen":107,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-50674fb9.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"2c6885cec8e2dd086a33d63593274174","sha1":"82469bdb0206964259b4995cb98c2e8790b8a7ba","sha256":"4ba5dbfe7e535e49f0e6b545fb251784471c3791a9d78496f3a3ca3ecba82813","sha512":"314a87259bf04d587d4c39ec51e93286cc482c1e9b101c80cd46f08b6371900ca5fa10789fa773036581aaa2356738c337ef82ba5de761f91fe52338b9d71cff","ssdeep":"","tlshash":"2801fdf8fc0c8ebb0fa20a4001902600140a1fddfa1819e198867d6a1be4940dbde32d","size":776,"data":"","first_seen":"2026-02-24T16:16:06.334536Z","last_seen":"2026-04-21T18:04:36.040871Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"ced6204993ccd4d4792486f3b3c899b1","sha1":"c16ea5b8c59dcea2b9b03d844467f9db0d358cdc","sha256":"317f80fdd1cb3e7b69648541320cfeb07fd3ea3d1b70d3aab180edce7c3c4ac5","sha512":"dbf99b86ffabe8deeb56f836821b1f3c58fe9b502b89210ec5082f60b4cb4e30f060645fc970bf48f5c3f20073f0e79845925b0dfb4ac89df0319d4c26bdb795","ssdeep":"","tlshash":"b8c08cc4a0c22e509622651410af38e89034402ab08c5b52dc98e94e3f260f49237eac","size":149,"data":"","first_seen":"2024-01-05T03:21:28Z","last_seen":"2026-06-04T04:33:14.48885Z","times_seen":358,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"5948bc3b90afab1829ab7ee61269f24e","sha1":"517e29a82521418181f702543be8ae74a3bf68b3","sha256":"14fc83a84c91770211dc352186f8e87ddc85e87c2dba0c80a159b45897b9ae2d","sha512":"05c079bbf0389ad341941c3e837aca91dc9aff681cee8da0b4560551ba13e6bbb76b01213af6514e6991e3369062870866a41e67e6d67a37038ddba3ddee7d5f","ssdeep":"","tlshash":"a5c08cc4a0c26d002606691010af24e49028802670485b028c94e8592e264b08233ea8","size":139,"data":"","first_seen":"2023-07-01T13:40:07Z","last_seen":"2026-06-06T23:47:44.202455Z","times_seen":1009,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/Onboarding-63593849.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b2ce0111f5e19e9246b761169639061d","sha1":"c40833b87347bfce706349ed26c5ec5aca4107e7","sha256":"bc099045695cf98f77c26fe9752501eb949c08bf9353aa14aec2ee70966437bd","sha512":"b9f0d00913fcecffe0c65fceaceb86411dc4a64d71bf60ec444ee4011579165af4c3d84c4af922ff0e63cbc7df8d6707d0c0d84e27af97d7edd29301ab63d3aa","ssdeep":"","tlshash":"df21614ab96c177a2be664a44457401937b90beb20e1e6d476f90d7673fa820062f781","size":1385,"data":"","first_seen":"2026-02-24T16:16:06.341297Z","last_seen":"2026-02-24T16:16:06.341297Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"c464eee61a30b35747e8e9848e60be3e","sha1":"3b58c9c7de2dd7f0322fd7bb9947ad3a01ac8cce","sha256":"955a99d585122831f4cabbe60b7755379393349c40795ff761e7ce78b3e491d7","sha512":"d548dacba908d5bd228c19df9e45083444741e1151dc914e356f01fd7fcb666a7077df8a57af5bc72e249160aa32ce3e40c77f22dc01fb2af95a6c3d19be3e4f","ssdeep":"","tlshash":"d3e0abeb3139c16456f09f2b6cec4c1bf69b27334d8c050bf8b4a9051ebad64227c894","size":420,"data":"","first_seen":"2024-07-24T17:37:43Z","last_seen":"2026-06-01T14:24:52.351275Z","times_seen":375,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/scrollbar.min-10f87a98.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"93f359d2fb2aac21d8251c643ea3133d","sha1":"36dd3545c76295e2f2505526cc47d3de89b635dc","sha256":"9b2221a326e30f6c7b330535c59e193b8d352287610a1a2937bfc1f401ecefa4","sha512":"4509295fad5754f6466a887334897c936c0bf739eb856279591110b193c883daef6b64844c11aded2c2b436e4099c2efdfaf81c0e68ef67f64d8a18546cd46cc","ssdeep":"1536:Bg3IgYU9olguxrE9fGFhmUQsbHxFOUlwJAY7hxsKUOXc66beI02UwurxNnvc+5h6:9p5EilLxFOF1AKUeczbQ390+5h6","tlshash":"32a31a89b320b1a252fb5a979375820073b50944f408d8e4b1be5db7592ed9c13aeffc","size":101669,"data":"","first_seen":"2026-02-24T16:16:06.359093Z","last_seen":"2026-04-21T18:04:36.021322Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"f19a249a3e546a75d19b9d3f75497cdd","sha1":"4fcf8a4234dc76c37cb9415dd3c2d4820fb45a30","sha256":"8f0b9cbdf1999a03131eed312b7dc7ab85a5ddbf696e4805d240a61cdf5066b2","sha512":"7f999eee3d080218db37b9bd7ae6ca464771276ae0eb378b537d24635f5d700aede00359099b8e2197cc4f36e56162a46110fbdb85f213ed5ada51d9875a7402","ssdeep":"","tlshash":"c5c08cc9a2c22d001646641014bf28f4902480277048ab038dd4dc892e620f0823be9c","size":146,"data":"","first_seen":"2024-01-05T03:21:29Z","last_seen":"2026-06-04T04:33:14.48706Z","times_seen":526,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/charting_library/charting_library.min.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2a5fa40461c4e10123b62c021ab0a4ed","sha1":"527b4a35104eda6479c5ac876f57b5375ab00f51","sha256":"bcee984fd52b4a82bd6b23543bb33f6472e076c125edbdd8756d29ca230628cb","sha512":"51c91bff846f3825a21d6b301b1e4615d05bb27defef6c39c622e647f5d0262fdb0382924c9245c4a18a11cd32b60e4c913ed451b6f4b2fec1c87ce871eb874b","ssdeep":"192:9fdWSo7ktFUnoBelr6lw2LfnzuIQPlaJ1i10K+Ei/ISJhvHIheu5Ph3Ffa5:vWS2ktFUnoIlD2LfnqIJimK+5/ISJhvB","tlshash":"58224f58ed2478720acb54f0427f180f8239e278d84944ed3c84e6ec59fd44a6a6fbb8","size":10859,"data":"","first_seen":"2024-07-11T15:08:28Z","last_seen":"2026-06-06T23:47:44.161826Z","times_seen":997,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/swiper/swiper-bundle.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.0.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"224a3fa93e9d34580cba66055e98e28b","sha1":"e5bbc5bd8a0ab313ff92cdbe26173fc413de4adb","sha256":"73203b5c5f70f45b31428e9c82d30645ef407717ed84e732b32f96ab848f0a7f","sha512":"98ca98cb0a742c81920c57e3424ed0f0c0dc06d9e9c477ea5a41a48ad918cce3278c812d5fd83114e535b4adf7cc3d09044c4284a642f2a20b4c12c9533c49e6","ssdeep":"3072:SQc7nYNuja+847k2GX4G5PqTlc1C2mjj+Anq:SQEnnja+8gk2A4G5P8yPmjj+Anq","tlshash":"c9e309896120b57645e716cb93a8c65172b54804b40ec5f870fd4caf99bec9803bfef9","size":155178,"data":"","first_seen":"2026-02-18T19:33:54.476246Z","last_seen":"2026-06-06T22:38:00.058038Z","times_seen":570,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"9d379fc52463f2b630c6894900da5180","sha1":"b33fecceae6c1ef97518c6ad7159534d78e7b2f7","sha256":"6c3288c6af4396096b1a8a927fbfaf05ac8cc29658fc97d13cf036ba6bb38ab3","sha512":"49b43b0c253e26c135bd5009d73c537cf2e78342ef6b116ce6efbd3627152ac804449ec5cbe637a544b5557b52a50213a19dfcf33158a4f6b0a8ff91d79372d5","ssdeep":"","tlshash":"61c012c5a0da29102951595424bf28e8a024c026b55c6b169de4dda829e64fcc627d98","size":190,"data":"","first_seen":"2024-07-11T15:08:28Z","last_seen":"2026-06-04T15:28:13.4706Z","times_seen":664,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"926ad28c98be26c2ab7d8f231631853c","sha1":"c1c7788df347ea5ab2369ae95456a8a1f7d9f150","sha256":"ec5e8816f60cbbf34b660d2d1455234d92295ab1a210868d6bbfeab7359e438a","sha512":"6f8eb48bc8638821747a26fc6370ee240e58d47699acbe5a1fb2bff1b25d62c6918f6df77dd78da3bc1b3e3d14eb849ccd4e0d1e01593294187bfd509be2ebdb","ssdeep":"","tlshash":"a5c08cc4a0c22d001a02641410af24e49024402ab44c1b029dd4d8482e220f08237ed8","size":138,"data":"","first_seen":"2023-12-01T02:41:08Z","last_seen":"2026-06-01T17:57:24.667429Z","times_seen":333,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"ba78027dcfdc9eb09767e4e83301b631","sha1":"1b7e7e0f0922b9165de433222ba8cc4afd0c59b2","sha256":"3de67c074b8692e1861e1c651848411308eb4c90e96f491e9cddc2df529a5da5","sha512":"158882fe08ddcf7bd297cd25a0e7b518789ef98ffa6ba9f14d1b565993ddd00de407f5be64c5c8a819e7a01c4da5887b21ba51f65308cd238c10076951e9e499","ssdeep":"","tlshash":"8ac08cd4a0c62d009646a51116ef36e4a0248026b8486b47cce4ec482e230b08633ea8","size":152,"data":"","first_seen":"2024-01-21T00:00:16Z","last_seen":"2026-06-04T04:33:14.481005Z","times_seen":445,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"cd7a34e714de94d5c29b8ac5acdde24b","sha1":"b722bccb435490630d97ef88cafeb02d92f70fd0","sha256":"312ebfdc50a0e168cff60c206811b02e944263a7d9060c2685509dacfacd7f71","sha512":"a724bc648a508c24e5bb1788e1f02b47030893bbb0b80a99e380d95480095983a35d8ec11193c53f0a67db47a289ab608fcbc9dbca846bfdd5d61a8832290f43","ssdeep":"","tlshash":"58e07d48ff28c7f316ce28ab516e770858d104d58c1b58024cebccc86935ed87291527","size":314,"data":"","first_seen":"2023-03-11T11:23:25Z","last_seen":"2026-06-07T02:27:59.890111Z","times_seen":36364,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/vendor-60f4284a.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"7dea06bb7c4794d23167de0f6a6d5290","sha1":"845e1c5f422c98e29446b0ee51e8023579ef32d4","sha256":"ea878f7d4c6463d5a5e75ccdf8fadc97ee00de8ff92525f927b4ff2ce8f8ec05","sha512":"d52479a3b3052833b822221a77915970edad63792d6ba2fe7c110c07c570b426fb802c2375b55f64fef37f4a2179b1e1b09a3537ccdb6dfb5e820e290b0ed96a","ssdeep":"12288:DkUj8c1zDw54eqccE/wrhqDFMdb8bv0UxzDpl6W1bOyQjm+a2sY:DkUjtMGeVcEfydb8Ympl6W1qy+a2t","tlshash":"d1153bc97292f06147ab20e240bb1006f3396e55744e8498f1ad98db7d79d89e2b7f3c","size":887678,"data":"","first_seen":"2026-02-24T16:16:06.379919Z","last_seen":"2026-04-21T18:04:36.01249Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"c0e88513b499aae066f13f6f0edfedab","sha1":"12fd9320e7be26e9257e2a1a39a698a5e2706292","sha256":"3ffd5a1fea533c35c122aeb0a36f3d4a37022e0a14c83167faeaa819b3ee8cfd","sha512":"36b57e74aa71e21ec5489637f206796e8b9097db32c59e4ffbbdd7eb11ce35c2f754178f996bd6e11abc560cdddd3af7cde3fc1847c1a455120b5c26ee4fb838","ssdeep":"","tlshash":"17c08cc8b0c6ad001602e45111bf25e4a024802770481b128d98e8483e220f48233e9c","size":139,"data":"","first_seen":"2023-08-29T11:10:58Z","last_seen":"2026-06-06T23:47:44.203025Z","times_seen":892,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"528dd01eb509d1fc3c68b48e165c9d77","sha1":"8d702f33d869eb8c53cf75c17014f96385322395","sha256":"b508dff20bdbd9138e31aa48c45bc501805e509d2fd4709b39c4a60cd5c6b43a","sha512":"4c1edeec560f431005363ff5291acc80c1c42edf7c9a6d6e4fde2f7539b6a35a8e36f0bc228503263277bf5df4525dc579575faadca614c32e5dfa885a2d343b","ssdeep":"","tlshash":"78a012bb71b851710cd51ba7a40455e01c20123105052c101c8d5151c011c171d394c0","size":84,"data":"","first_seen":"2023-04-07T06:55:59Z","last_seen":"2026-06-07T01:22:01.630639Z","times_seen":38673,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-c367822d.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"9b0ebec6c2bc8dfaeae96d2da133d6d4","sha1":"18f379f974e2c7c630b98e553d021854c8744098","sha256":"cec446389d66060c2d4a4c213546036a4b41e9fea735a8e2eacb5a2f64ab6fee","sha512":"70b4614c2049685e58983b0ea52fb71bf2c67415b5f34d0b70167bc1ad8467d1be28633de4335e374edbc712be713b6bfddb80854ccb3aef55b68b60ab7a7f99","ssdeep":"96:qbbkBKGJwfarblYVbqCw59vPvNUfpNTKwgWWPrbDjDn25+6a893hrUJ33MC7BgYV:nKGJwfyYBqCwvXgpNTKwd+3ngTlhrk3z","tlshash":"b9b1974ef48285b9adb65481089d005212ec3fe5b0ad48f2f2f9ec5a67b8db9d654322","size":5162,"data":"","first_seen":"2026-02-24T16:16:06.368953Z","last_seen":"2026-02-24T16:16:06.368953Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"4960895c746dfa908d21cbacd8b21bb8","sha1":"86c808fea849e1915b206c8ec1f952144d1a53e8","sha256":"9c6f9052795b24b7a44e4b46615fb3b664011c2b44c38aae55380368ea8117fd","sha512":"7eda14f6770aef2c9e9977abdfdeab0d5404d9cb6c091c8e9612b20acf542d3205ccb20b876be4f6d7702b15144e438352d6418253bb9e163b4d0873446b0b99","ssdeep":"","tlshash":"63c08cc5a0c22d209a26691010af24e89034402670485f528c98e8493e224f08233eac","size":148,"data":"","first_seen":"2025-03-06T08:06:41.486911Z","last_seen":"2026-05-18T14:20:36.342137Z","times_seen":45,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"6c9ecbc460a4c41177b8c84cf441d509","sha1":"a18c65f05a843af5cd2bcdcd5c4f3861a770011d","sha256":"7ae71331f337fd19e5d1fdcc74e5e7aea2d6add982ce071b3480b0271240ff8b","sha512":"84fc55fa8470f05fc5a1f5b1d0953d6f47d8b7fdffdffc1add7f12062c020032f9697b656d2c6945da63df342f3e72efec330c0f03c1032ef45cca458c9961b9","ssdeep":"","tlshash":"e3c08cc9a0c23e001602741112af34e89024412770482b42ced4d8482e220f18233f9c","size":148,"data":"","first_seen":"2025-09-12T08:50:03.466535Z","last_seen":"2026-05-24T12:07:54.974218Z","times_seen":27,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/#/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"d8a0b36a3bb5359d82373fd74ab0a55b","sha1":"109fcd2e9501021577ad657d5701aa40e771b723","sha256":"26b23c11a596c1301030aaa5e72296226d0b2c601ff7b24694d413a401ac9826","sha512":"ebb5fb5d0b9ad70253bc33b31f5fab9fa0efb74a89eefd5b900d6b956970a52ef306b8e62a73b47775339624aef7daf7f4779743b84394f80591c0ea8182f9fe","ssdeep":"","tlshash":"d8c08cc4a0d22d001a02641060af34e49028442670481b028ca4d8482e620b48233e98","size":138,"data":"","first_seen":"2023-06-06T09:30:31Z","last_seen":"2026-06-06T22:30:21.917795Z","times_seen":1323,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/en-d3e621c9.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2fee64b1f8b9c4c87e942aee26714c92","sha1":"ee6bcda5063573c8cf71db225ad7494d120c9c13","sha256":"93d35044ea7f0cc48353b291f6a7bfd4f371f15cd75928056e8e6372f03ba359","sha512":"07ebd99d2d7dafd63a8ad5719f05d42bad82685c9a7ac60826574379f031dd38aca2cf4e5432ff3a10cadcdf31fc30a57af484df33cbbe98f69f6a8036d8ac04","ssdeep":"768:XMtZcEw/o7rZOdosiBnAMC2rAaAMFVoP6+6sPGxw1mwO6fpk7aOLxd:1ponZOdoFE2rdFVLsPGwqLxd","tlshash":"d203d6893e1a989a04f3537674ce6e2160f60ac18255881f4fedc9fd53d2b67a363b34","size":40730,"data":"","first_seen":"2026-02-24T16:16:06.388744Z","last_seen":"2026-02-24T16:16:06.388744Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/charting_library/charting_library.min.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:34.297Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /charting_library/charting_library.min.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:34 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e74-2a6b\"\r\nexpires: Wed, 25 Feb 2026 04:15:34 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8Kfry2b3%2BWYmEcv40xJyRYPUqO9HagpMQHDkGz4weXAHLWkjUvfEpsVNBBU06ccxUOd5sOfewEEBLnhGj%2BDxdMeaT1xyN2nYrRr9JLNW9nKaz5%2BxvuJKUSU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d30432f5846f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10859,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10857), with CRLF line terminators","md5":"2a5fa40461c4e10123b62c021ab0a4ed","sha1":"527b4a35104eda6479c5ac876f57b5375ab00f51","sha256":"bcee984fd52b4a82bd6b23543bb33f6472e076c125edbdd8756d29ca230628cb","sha512":"51c91bff846f3825a21d6b301b1e4615d05bb27defef6c39c622e647f5d0262fdb0382924c9245c4a18a11cd32b60e4c913ed451b6f4b2fec1c87ce871eb874b","ssdeep":"192:9fdWSo7ktFUnoBelr6lw2LfnzuIQPlaJ1i10K+Ei/ISJhvHIheu5Ph3Ffa5:vWS2ktFUnoIlD2LfnqIJimK+5/ISJhvB","tlshash":"58224f58ed2478720acb54f0427f180f8239e278d84944ed3c84e6ec59fd44a6a6fbb8","first_seen":"2024-07-11T15:08:28Z","last_seen":"2026-06-06T23:47:44.161826Z","times_seen":997,"resource_available":true,"data":null}},"time_used":434,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":434,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-50674fb9.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.124Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/index-50674fb9.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ui0DN3SXWai9VNo9jC1PZi1j9yrZ7riVS7vbiuAQn196Fb7ffjVjVv3w7JQPAP4wrXKsb8%2F0NQy8mBH3cUckneboPj4bGmskc%2FcO2sAxpMzytc4vzgrPEts%3D\"}]}\r\netag: W/\"69677e81-308\"\r\ncontent-encoding: br\r\ncf-ray: 9d30433abbbdf527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":776,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (775)","md5":"2c6885cec8e2dd086a33d63593274174","sha1":"82469bdb0206964259b4995cb98c2e8790b8a7ba","sha256":"4ba5dbfe7e535e49f0e6b545fb251784471c3791a9d78496f3a3ca3ecba82813","sha512":"314a87259bf04d587d4c39ec51e93286cc482c1e9b101c80cd46f08b6371900ca5fa10789fa773036581aaa2356738c337ef82ba5de761f91fe52338b9d71cff","ssdeep":"","tlshash":"2801fdf8fc0c8ebb0fa20a4001902600140a1fddfa1819e198867d6a1be4940dbde32d","first_seen":"2026-02-24T16:16:06.334536Z","last_seen":"2026-04-21T18:04:36.040871Z","times_seen":3,"resource_available":true,"data":null}},"time_used":427,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":427,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=xal","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.390Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=xal HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en-US\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"6ffd38192ae9a9313f6cef6a134680ec","sha1":"c5037cbbc3ad60b7ca081adc87a42b8ce609a67c","sha256":"2e9d6f3bf70a8472f0f1e74387902b60d2f40fa4c44a373c7f9f5a1dacaf3a7e","sha512":"c1af3ba91978fa3b18dd2e72918f093dc5300be76607e916a646d8554935c5b84434bee31a5ccbd2df20125846cdc9ff2aa3e5233d08ab407380c1d0e29b7006","ssdeep":"","tlshash":"919002555c188242a88700a5d606160800347160262492484c5d923980881622040899","first_seen":"2026-02-24T16:16:06.337462Z","last_seen":"2026-02-24T16:16:06.337462Z","times_seen":1,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getAllSetting","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.997Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/common/getAllSetting HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang,language\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang, language\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/Onboarding-63593849.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:38.059Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/Onboarding-63593849.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-569\"\r\nexpires: Wed, 25 Feb 2026 04:15:38 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qQ%2F5RDWjPBtjrfqPiYl2HeZJqMNU6C%2BsWmKY3%2FLsNTXrAt7blaxzs7Dv2nPXliCHgiWANzNxSanBY4sDlj3CWY9tCUs4ISbb5d7m9TMdyKgBtH6XPaaLuOI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d304346ef51f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1385,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1384)","md5":"b2ce0111f5e19e9246b761169639061d","sha1":"c40833b87347bfce706349ed26c5ec5aca4107e7","sha256":"bc099045695cf98f77c26fe9752501eb949c08bf9353aa14aec2ee70966437bd","sha512":"b9f0d00913fcecffe0c65fceaceb86411dc4a64d71bf60ec444ee4011579165af4c3d84c4af922ff0e63cbc7df8d6707d0c0d84e27af97d7edd29301ab63d3aa","ssdeep":"","tlshash":"df21614ab96c177a2be664a44457401937b90beb20e1e6d476f90d7673fa820062f781","first_seen":"2026-02-24T16:16:06.341297Z","last_seen":"2026-02-24T16:16:06.341297Z","times_seen":1,"resource_available":true,"data":null}},"time_used":422,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":422,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/kline","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:38.231Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /kline HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 69\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":69,"data":"{\"symbol\":\"btc\",\"interval\":\"ONE_MIN\",\"limit\":1000,\"market\":\"binance\"}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42074,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (42058), with no line terminators","md5":"c8c3bb1442df60d625a1e0548dc4d8c7","sha1":"6d307da0c74acda4e84df32fa2dae37545a99ace","sha256":"7b09a28d5413ef36b327e3bd7800601c1f14a9e54a178aba94324daf9cc32b32","sha512":"6eee5932755b911a9a47084fd4a8b3adbb5023d6052bb2fcf8de554bca08744b2e0e8c08442cdec3154867e86fecc1becf12f2c0329f68ab86168cea198461c2","ssdeep":"768:VBlyjAcDRMZN4hDci8bE6nGq1o/IEyktCBur:VLqaZEci8bEOGqu/IEztCBur","tlshash":"05131b70fae9c049e479cec27fe3acb09b1a37d356ddce8905fa54418a857209169fc2","first_seen":"2026-02-24T16:16:06.34364Z","last_seen":"2026-02-24T16:16:06.34364Z","times_seen":1,"resource_available":false,"data":null}},"time_used":440,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":440,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/scrollbar-1e3b0025.css","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.107Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/scrollbar-1e3b0025.css HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: \"69677e81-2f97\"\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: REVALIDATED\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eb%2BNI4wj%2B5%2Fcxi4Q4YXvt%2FkJgx5VlZjhsDjHeQksJHs1%2FPUWcm47lLZXZHMu%2Bj4fhCDTdF9JmMr%2FEJMIZHfQDvHyFX7FAxL%2FyijxWn%2BneWLrATXhKz2SMDI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d30433aab65f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12183,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (12182)","md5":"03041fe39313dd448ce3915a7f5a5c97","sha1":"3e5bbeddfa6858ca1e63d3ecf96fef5a921170d6","sha256":"1e3b002519fc2d9dbda3f7fea74cf1f8eced61f23c22a3877d424adcc1c1e171","sha512":"6c29a716a3f02670bb7720f06312e831ed4963c893303b7b2ca17bb17a4ad22adc25241e0b912d5d55e1602e00845a6e0964de7e7c798da9c045b3aadc7ea558","ssdeep":"192:fmUJbiKne1TIbHZ+SCg2OM3fTf0nxu//2:+Ube1sbHZ+w2OsfTf0nB","tlshash":"b142fea85300281763134f370b759bb9dd7448820b938e6e91c0ae94d6f7cbd236f6b9","first_seen":"2026-02-24T16:16:06.345617Z","last_seen":"2026-04-21T18:04:36.023679Z","times_seen":3,"resource_available":false,"data":null}},"time_used":427,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":427,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/InfoPopup-ce3f4fb2.css","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.119Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/InfoPopup-ce3f4fb2.css HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-442\"\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DX8C0MByr6RY3fjEnlVKyQCmyYUbpLDv5WEomhWr2giJ2OSQcq1NWGAXNC7%2BwySkyizpf0X9VxjL2u2nOqZGKgNU5YnVLfrAvZZJ8c4SJw%2BJp2OAb%2BaZ%2BOQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d30433abbacf527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1090,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1089)","md5":"8f39ec9c948ba0a7700c9e4750a94aef","sha1":"29dd068b6bb7399ddba8ac7ff7a4d657c0788c2a","sha256":"ce3f4fb2f5036a9ee76b737c12596c49c1501fbf7d9fce0ea6ca2b99f96b7ace","sha512":"a027198ce5aa8ff37e128c491356f097dacaf33a0f7464f296ad6494578e4b825a33d4871b809961221e518bad6767dbcd576479458dfb8d1c2e4a1ccc87befe","ssdeep":"","tlshash":"db119e6af94c7d362c2e93b66a5945cc500039b2b5c28df48a22e54408878d3275e4dc","first_seen":"2026-02-24T16:16:06.347618Z","last_seen":"2026-04-21T18:04:36.044173Z","times_seen":6,"resource_available":false,"data":null}},"time_used":428,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":428,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/right1-7923839d.png","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.769Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/right1-7923839d.png HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-8ce\"\r\nexpires: Thu, 26 Mar 2026 16:15:38 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FA4rUHKuoZmEgPU%2FZAjN8sP62lxmwwF1WnE%2BFWwVNqeU3HCIlYv7gyeiMlt7QoS7K1mvs3XAU6dOIRIzUKFzXiw5ViejPPOs%2BWwf3RsjlaSeZytDbYKiikM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d3043451a54f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2254,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"605c6be84f9e293f8ccd783916de1114","sha1":"76007b9eab151b759a2ff3c80cfbb46f8ad27604","sha256":"7923839d2437dec300ea06d2dd19ece8f34f70e6da201dc0c90eb2c965b03724","sha512":"8041fc1137b503ee83e4858c29c81af90587936cf84a2e8d03cd0a0827d7cb2541e72547f6a022aa5d968cfc21bb0d1fb610d4322ec228ed646bda014f3a67f3","ssdeep":"","tlshash":"50414bdf8f0322454fcb115c75a03af4722d2d870ed83a7b5b2110a20ca7a86786f88e","first_seen":"2026-01-31T08:28:07.115917Z","last_seen":"2026-05-04T08:46:18.833949Z","times_seen":6,"resource_available":false,"data":null}},"time_used":428,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":428,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/1-d5891e24.jpg","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.771Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/1-d5891e24.jpg HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: image/jpeg\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-573\"\r\nexpires: Thu, 26 Mar 2026 16:15:38 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xpaK9p9mnLH9YWCUb4mU9prUPTg35YUHBimJZ9hrkT3zTLt3g2djIMu2Vit5LVoyWsgG9niNKpjWriNFuKUu8%2BJCux6kdhC22TkrgraB%2FcGecTEAu2rQaTo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d3043451a5af527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1395,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 80x80, components 3","md5":"34a360f8991dd8b0f068319b96bd53b2","sha1":"7803a5c63a210fbfbaacd8d793a25f4354a481d1","sha256":"d5891e245b18fb0c0b25e31bda76139d4b79d362f1d9d52a8a82e8f031506c1e","sha512":"39837a469d4ebe1ca8365d03a5503783c5c20f92de5d3d51810230176cd860dbce0203380e26610f121c32f74716b72553c398ae1d93cbe09dc6209618d43175","ssdeep":"","tlshash":"9821d8ae7858c221ec681e79d4fbad28f252771b6100ddf587e16a863c250e09c186c4","first_seen":"2026-02-24T16:16:06.350911Z","last_seen":"2026-03-16T14:26:38.517169Z","times_seen":4,"resource_available":false,"data":null}},"time_used":423,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":423,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/resource/svg/light/lujing3047.svg?2.0.1768390273654","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.774Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /resource/svg/light/lujing3047.svg?2.0.1768390273654 HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:00 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z1NbAKRjdsun44%2FvaY31XwWRFR1irRBPg8oGrofp68wbquDPTFYsJ4iiDt2ptrFLbiJTQkjMm5UhiRQeoTLay%2FG3caK2vusvkMZ%2FVuTzRsHmjdMwsJDsXRk%3D\"}]}\r\netag: W/\"69677e74-18b\"\r\ncontent-encoding: br\r\ncf-ray: 9d3043451a72f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":395,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"75fd0a8aecdbaaa755824e8e1bdb6955","sha1":"e9953daeb744f32b8da93c78d09fa4aad39918ee","sha256":"bde6c1110d488db935e323792e0d5288e0cf6446cde9a8606191595b5cba4357","sha512":"28faad026b58df1a98dc4617fae8b204bc34668b82b937b6f559ac28e903d3a62b6c2330d569b7db194dc383e27634e365f8b8791acc15c1524d6ae92cbdfcdc","ssdeep":"","tlshash":"b1e061bb754ff78d5459db1405ecaec8e5726011318500549b4216f69d04c839f708b0","first_seen":"2025-04-07T11:28:26.939708Z","last_seen":"2026-04-20T23:47:18.14058Z","times_seen":64,"resource_available":false,"data":null}},"time_used":434,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":434,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/notice/list?key=ACTIVITY_NOTICE\u0026modelKey=HOME_ACTIVITY","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.993Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/notice/list?key=ACTIVITY_NOTICE\u0026modelKey=HOME_ACTIVITY HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang,language\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang, language\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":217,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getAllSetting","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.833Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/common/getAllSetting HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en-US\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11968,"size_decoded":0,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (11634), with no line terminators","md5":"7343b2a465f525a534609fbd575c6f88","sha1":"2d4ffa034996def4e0d5a7c394e3ddd698e8287a","sha256":"df07503aefedf0f4606139dde7bb2d55e9b94bda8f4ef3456305da13a986b8eb","sha512":"3f7bedf83c289b1a680923be17f4ba9972f2257b96ccd7c4695fc8e076f69e439df6ba890097aac115f6a4695df95455c19b07a42b80587ec56bb8770b3cce85","ssdeep":"192:cEuwYPOFgQ+oTzBYUMSD+RbRuc2eHPExqQa1JBx4qstJ2sKbgMNa2p6ZvP3C8QCH:Cuanad2N0MqH9YQm1Jn8","tlshash":"0332545b35ecccbec2966ac220ef77a5a99ca47bdc465806d09bbf8cacd5531484700e","first_seen":"2026-02-24T16:16:06.353173Z","last_seen":"2026-02-24T16:16:06.353173Z","times_seen":1,"resource_available":false,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=usoil","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.353Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=usoil HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en-US\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c669e8b70c9df8aabaeba25bf36e2986","sha1":"63aba238dc3d2c45e05bc2166df2b794e9a2659a","sha256":"cebf40b35c6a5e1846ae8fc9d77ef5ce14f017e09c528ab313a1d50430715f3a","sha512":"ed322618d3a3be09c21f24afb47d2591cb7b5f6e1d88c1574d8b5854e5347ca71ce778681582656f6d284e15c7a4d4dc17933222ca28c342446b1514b3fa7527","ssdeep":"","tlshash":"ae9002951c189342a88700a59506130404243160262497484c59513580981622450958","first_seen":"2026-02-24T16:16:06.354737Z","last_seen":"2026-02-24T16:16:06.354737Z","times_seen":1,"resource_available":false,"data":null}},"time_used":233,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":231,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/resource/svg/light/mengbanzu12.svg?2.0.1768390273654","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.779Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /resource/svg/light/mengbanzu12.svg?2.0.1768390273654 HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:00 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SoCxrdpP9C1CtL3HqBF4Vb5PgN4f4Aar0lBixWB3nYIAQvBpT5dBvhwtVoQxh%2Fio%2FICmbhLLDr%2BW5Ykdf5sku%2FvhLxKCUSTL%2BW8zsiNdc4vezIs2qUoOX1c%3D\"}]}\r\netag: W/\"69677e74-322\"\r\ncontent-encoding: br\r\ncf-ray: 9d3043452a97f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":802,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"184d38c97adf35302491834eaf17aee3","sha1":"a21f6508e3eb8b4bf52a510ac9dd219783f561bc","sha256":"5cdcdf5fb66c61d69b6c308a4569e093ff7b0e178fbb1c7d94a599473339bf99","sha512":"a88827fe8f336cb9f4de9cbaade38ff0026d003f03cc096dc443724052a51c417432d1b96b7006e21c49498791fac31678492626f5643eb09d5b94b32afdb9f0","ssdeep":"","tlshash":"d201f6764321c19dd2538b80c7d93f44927eb65bb2d00448b3a32aa74e34f7f55bc595","first_seen":"2024-07-24T17:37:44Z","last_seen":"2026-06-04T04:33:14.422649Z","times_seen":360,"resource_available":false,"data":null}},"time_used":425,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":425,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/jt_down-8c2e5e3e.jpg","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.805Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/jt_down-8c2e5e3e.jpg HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: image/jpeg\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-1070\"\r\nexpires: Thu, 26 Mar 2026 16:15:38 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0kwKZNI1UIqHiaeLUbsZtNxs9H6fDrxBAG6gETHRcRsJkgLSdJuAOU1Ce98ulxctgl415QYnpFunn3W2PYuC0VF6p8pG4jEoBGRlikvMgNFessAEf6t3nUc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d3043454af9f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4208,"size_decoded":0,"mime_type":"image/jpeg","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"93890ae9debdbb2838da5d82d28756f9","sha1":"8fe4c205f01a21c992624603edae64f00c86597f","sha256":"8c2e5e3e10958ab23e8834dcf92d6ea53ae41734b8b2495d55f6d42ce2c7f9c1","sha512":"3757a36c130bc03b1f722262677658549d068cee39de69aa27efdffa2656203a9cfef819b11e8362e8ecd76e5e89bb06ecbc5daa6db3d6df0da6e18c67ec5c1f","ssdeep":"96:hZOFtNz8eBAmJ6r/unPgZpCDXKVpxynQ+afSnpr8eyS5MwgiFFfU2:POBiaPypkXE4qSnOpSywVFfU2","tlshash":"4d915d7729844b94c0a2ce380bfa0b94c6d5d11c769e132a072fca25fd11f953a65a36","first_seen":"2026-02-24T16:16:06.356623Z","last_seen":"2026-03-16T14:26:38.460019Z","times_seen":2,"resource_available":false,"data":null}},"time_used":423,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":423,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-bc011be9.css","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.090Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/index-bc011be9.css HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GfoD9b1LLwXzF0BoEmu969DP7OXE9BpeA%2BNigEYi0%2BndzUEL9HwzpXScXhl4OnTlwScyqUHM1pDQFFD6QV57EIpM86TKaUYzMOQOtCwmAa1cqxZuPHvOPhM%3D\"}]}\r\netag: W/\"69677e81-18d\"\r\ncontent-encoding: br\r\ncf-ray: 9d30433a9b30f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":397,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (396)","md5":"5353ff252ee4a5e7a3d0176de6a6c712","sha1":"c83942b5dfdb4aa8be53f26b39e53b0b257595e0","sha256":"bc011be90fd6cd33a399912151a5f69ba0d8e394563c71c4c1bea7a4ec032516","sha512":"9a17506817918ef0c9a5d0caebaed8f603641dc1015a726bdf247645a7e0a988b543756d7254abafa18dd4cd9d27c9a198300632156faf59f05c1e27f0a5e30a","ssdeep":"","tlshash":"5ae092c890d6927fb62b607d267c931ad425ac88d8007bb8e67fabb146c7ac53172215","first_seen":"2024-01-05T03:21:29Z","last_seen":"2026-06-06T02:42:02.411177Z","times_seen":706,"resource_available":false,"data":null}},"time_used":431,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":431,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/scrollbar.min-10f87a98.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.168Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/scrollbar.min-10f87a98.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-18d25\"\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 0\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x54aZiQ05ODec3dy4pH%2Fj2sYD27JXvlqNGai8pgjqLdFhN%2BaJSpOWFijNKmEFQG2yNAHYxAPBX%2FmN6YVwaZ6paJTxrdSEgGTMO1p%2FMB0fr8l2EtdXbxDdaE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d3043414f65f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":101669,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"93f359d2fb2aac21d8251c643ea3133d","sha1":"36dd3545c76295e2f2505526cc47d3de89b635dc","sha256":"9b2221a326e30f6c7b330535c59e193b8d352287610a1a2937bfc1f401ecefa4","sha512":"4509295fad5754f6466a887334897c936c0bf739eb856279591110b193c883daef6b64844c11aded2c2b436e4099c2efdfaf81c0e68ef67f64d8a18546cd46cc","ssdeep":"1536:Bg3IgYU9olguxrE9fGFhmUQsbHxFOUlwJAY7hxsKUOXc66beI02UwurxNnvc+5h6:9p5EilLxFOF1AKUeczbQ390+5h6","tlshash":"32a31a89b320b1a252fb5a979375820073b50944f408d8e4b1be5db7592ed9c13aeffc","first_seen":"2026-02-24T16:16:06.359093Z","last_seen":"2026-04-21T18:04:36.021322Z","times_seen":3,"resource_available":true,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=xpt","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.391Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=xpt HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en-US\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"134c3be77c2450ae90c4ad4b1883510f","sha1":"ead1a29783461ee9f297ff025beb59f53c0bec3d","sha256":"d4529690e2d59b083ac419f4549b253a13e4799e0704b9c99a8cc3ec81207d00","sha512":"f443ec1bf67d69c47730446a81c03cec5320634041e954204b17435564f5dc7a638be001b07a5c0b862f53125a282130d6c7a75324afd4efe91b5e5fff9d07be","ssdeep":"","tlshash":"c79002551c58d282fc8700b59506130400243160276493484c595165c09a1622460858","first_seen":"2026-02-24T16:16:06.362589Z","last_seen":"2026-02-24T16:16:06.362589Z","times_seen":1,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/right2-bb62724b.png","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.765Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/right2-bb62724b.png HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-b97\"\r\nexpires: Thu, 26 Mar 2026 16:15:38 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=51j8w6ygZozkklwsLjyQ26o%2FAXJXW2ZW7%2FXu7x7heTHH3QWQ5sB7AhB4V1jOnIRd05HCygtDbiaaXln5sKnNkGFZlYfR3u6HF2Ws1D3ZdVCrczXdZchiGlY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d3043451a2ef527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2967,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"b386c32bc754f7e3050b358251e299dd","sha1":"1700687c264b8f9bb8a23ca3a222db5075d912c1","sha256":"bb62724b4775e4370a91928bb54d6f4218b65828e79be8a05f833e44533fbd72","sha512":"5979a6444c58813028c56130ea3e6d1b04d02acc82eee5c5495f3aabc5b1891f393ec5d021b7c8d4fe1dfeb6d2a8c8b1532e2655325cfd95f33bd41f586f2228","ssdeep":"","tlshash":"5a514d537a61dc09b4ec54ed603ad453ed3d9bde0220da132cff8564da61202c19f1b1","first_seen":"2026-01-31T08:28:07.116966Z","last_seen":"2026-05-04T08:46:18.824926Z","times_seen":6,"resource_available":false,"data":null}},"time_used":426,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":426,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-7374a6d3.css","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:34.309Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/index-7374a6d3.css HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:34 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-4a23e\"\r\nexpires: Wed, 25 Feb 2026 04:15:34 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8fYV7FttphFShw4HcNBifwnYhuj%2FGVQsWB2mELc1lZS7NB%2Bn%2FAxUpBMslo0s7LcHnfvq7jFWDFyWVSVId2UlTnMTac5XxPbhG1MdpY7LsTOsDm%2FTfO%2B2FrQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d30432f78b9f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":303678,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65022), with no line terminators","md5":"6552a50a57ca0fa532123f211dbe8c2d","sha1":"aac42e2f555188a3c1feb9296f5147339e0e0b20","sha256":"7374a6d30b319ff3c977a3da6f5b99f17e08ab628dfe6e7fa4d70b30aa2a1279","sha512":"e5f3ee7c211b31590e5c2ec18d32a9b119f1e3ea0cb441da5ffb04865eb9f4e4f465fca33c06fd24dcd2616bf513f0ac9ce12dc062f79e79089e31cc6f816203","ssdeep":"6144:njB/9S/Jk4UkZ8w71ZACkFDS3vyf58rBeV05Ta:jB/54NZ8w71ZACkFDS3vyf58rBeV05Ta","tlshash":"5054c6a9a59051bc6f27aa7597ce4ad8f23ce6719c118de8f20160094fc3ff92363617","first_seen":"2026-02-24T16:16:06.366066Z","last_seen":"2026-02-24T16:16:06.366066Z","times_seen":1,"resource_available":false,"data":null}},"time_used":693,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":557,"receive":136,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/platform/dev/config.js?1771949736040","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.050Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /platform/dev/config.js?1771949736040 HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:00 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kRfY3o5ct42upw5Jpd3huWC7pruurBKGTMmhllQljz59UJi2zRhoX2W4%2BLofbzJf6jDAyqg%2FrqBKx0cQZZdRiuSuo%2BIR9gc0Mis%2B36HJKJfSGNsWdUclHvg%3D\"}]}\r\netag: W/\"69677e74-18a\"\r\ncontent-encoding: br\r\ncf-ray: 9d30433a5a85f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":394,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with CRLF line terminators","md5":"4bc52b1aa6813b98e0af16a138354c00","sha1":"91ee6accefe6f24544627bdd1ae2aba499d5016c","sha256":"bf904efa24cb62a824547b6df3a7bbade81bfa77cc27124d7766ae502e5d6231","sha512":"22c852a633d0c36ccf7d549fd1c6a800698e42994d993a47f534b92c8ff8430c14d668c72d2bf8eb79e8b4459f83116bc75ff5f5269f36bc3b8cf2cb9ae886ae","ssdeep":"","tlshash":"f5e0abab3138c16451b08f2b6cec4817f68b2733494c010bf8b469041e79d542178890","first_seen":"2024-07-24T17:37:43Z","last_seen":"2026-06-01T14:24:52.336032Z","times_seen":377,"resource_available":false,"data":null}},"time_used":432,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":432,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-c367822d.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.123Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/index-c367822d.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-142a\"\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HoJjKTauBrzJBwNjdpGQkpO75IBIbRNj5y9euo2OkbgGbi5%2Bc9Bb3MduC%2BKpTx2JoouF6RdES144HMgUQrQ10Zd3aQKoXE6KMWy3elUuyFlcri2%2BN%2FU36UU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d30433abbb6f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5162,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, Unicode text, UTF-8 text, with very long lines (5149)","md5":"9b0ebec6c2bc8dfaeae96d2da133d6d4","sha1":"18f379f974e2c7c630b98e553d021854c8744098","sha256":"cec446389d66060c2d4a4c213546036a4b41e9fea735a8e2eacb5a2f64ab6fee","sha512":"70b4614c2049685e58983b0ea52fb71bf2c67415b5f34d0b70167bc1ad8467d1be28633de4335e374edbc712be713b6bfddb80854ccb3aef55b68b60ab7a7f99","ssdeep":"96:qbbkBKGJwfarblYVbqCw59vPvNUfpNTKwgWWPrbDjDn25+6a893hrUJ33MC7BgYV:nKGJwfyYBqCwvXgpNTKwd+3ngTlhrk3z","tlshash":"b9b1974ef48285b9adb65481089d005212ec3fe5b0ad48f2f2f9ec5a67b8db9d654322","first_seen":"2026-02-24T16:16:06.368953Z","last_seen":"2026-02-24T16:16:06.368953Z","times_seen":1,"resource_available":true,"data":null}},"time_used":427,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":427,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=ukoil","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.136Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=ukoil HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":225,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":220,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-7de86585.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.170Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/index-7de86585.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nage: 0\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x0PRg66EHCe2c3bzXzVzqqOaTZ%2FPTIMENaMH1iQT9bCgL8lHjczhQ45216izJ6cA9x%2FdprdAW2oFQkUxSBNRaDhpKqtZXz9rd%2BU1%2F8O5gqBFtGhlazUxWJA%3D\"}]}\r\netag: W/\"69677e81-203\"\r\ncontent-encoding: br\r\ncf-ray: 9d3043414f78f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":515,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (514)","md5":"084dacc20f5381766c7bc46e75ef3e46","sha1":"59c8a167cd517dbd266c22e4815d19e38deeae36","sha256":"a0a4090dce1d2b802ce516b0db0412516305c45e239f84ef7a3dc5a9e48be0f7","sha512":"797b91bb6c5da3daa5247727401843eda4c6b16dffe50148c67e270cc91d9d84bb339b0e830912e53a4432c6009e86ac6def87edb1664f53d97860a025bb97d4","ssdeep":"","tlshash":"58f00e2fac7b50b21ba388fde1231811660c0f567734c5e8e58b0e00db388e7d21e628","first_seen":"2026-02-24T16:16:06.37063Z","last_seen":"2026-02-24T16:16:06.37063Z","times_seen":1,"resource_available":true,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/notice/list?key=ROLL_NOTICE","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.996Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/notice/list?key=ROLL_NOTICE HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang,language\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang, language\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/swiper@12.1.2/swiper-bundle.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.0.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:34.394Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"unpkg.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Feb 2026 08:16:48 GMT","end":"Tue, 19 May 2026 09:15:09 GMT"},"fingerprint":{"sha1":"F3:CF:0B:A3:28:07:E9:5A:D0:8B:F4:9E:A8:A1:9B:71:A6:59:38:23","sha256":"DD:EE:6D:62:AC:D0:59:11:F9:1C:53:44:27:F0:8B:A5:2C:A2:C6:C4:BF:B8:79:AF:A5:5F:B3:E1:29:E8:45:8E"}}},"request":{"raw":"GET /swiper@12.1.2/swiper-bundle.min.js HTTP/1.1\r\nHost: unpkg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:34 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-encoding: gzip\r\ncf-ray: 9d30433008836e70-ARN\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\nage: 383025\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 24 Feb 2027 16:15:34 GMT\r\nlast-modified: Wed, 18 Feb 2026 18:31:27 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: accept-encoding\r\nvia: 1.1 fly.io, 1.1 fly.io\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-expose-headers: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncontent-digest: sha256=:cyA7XF9w9FsxQo6cgtMGRe9AdxfthOcysy+Wq4SPCn8=:\r\nfly-request-id: 01KHS0976NBX296Y1HV1F6JYFY-fra\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":155178,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65278)","md5":"224a3fa93e9d34580cba66055e98e28b","sha1":"e5bbc5bd8a0ab313ff92cdbe26173fc413de4adb","sha256":"73203b5c5f70f45b31428e9c82d30645ef407717ed84e732b32f96ab848f0a7f","sha512":"98ca98cb0a742c81920c57e3424ed0f0c0dc06d9e9c477ea5a41a48ad918cce3278c812d5fd83114e535b4adf7cc3d09044c4284a642f2a20b4c12c9533c49e6","ssdeep":"3072:SQc7nYNuja+847k2GX4G5PqTlc1C2mjj+Anq:SQEnnja+8gk2A4G5P8yPmjj+Anq","tlshash":"c9e309896120b57645e716cb93a8c65172b54804b40ec5f870fd4caf99bec9803bfef9","first_seen":"2026-02-18T19:33:54.476246Z","last_seen":"2026-06-06T22:38:00.058038Z","times_seen":570,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/swiper@12.1.2/swiper-bundle.min.css","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.0.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:34.404Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"unpkg.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Feb 2026 08:16:48 GMT","end":"Tue, 19 May 2026 09:15:09 GMT"},"fingerprint":{"sha1":"F3:CF:0B:A3:28:07:E9:5A:D0:8B:F4:9E:A8:A1:9B:71:A6:59:38:23","sha256":"DD:EE:6D:62:AC:D0:59:11:F9:1C:53:44:27:F0:8B:A5:2C:A2:C6:C4:BF:B8:79:AF:A5:5F:B3:E1:29:E8:45:8E"}}},"request":{"raw":"GET /swiper@12.1.2/swiper-bundle.min.css HTTP/1.1\r\nHost: unpkg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:34 GMT\r\ncontent-type: text/css\r\ncontent-encoding: gzip\r\ncf-ray: 9d30433008a26e70-ARN\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\nage: 119585\r\ncache-control: public, max-age=31536000\r\nexpires: Wed, 24 Feb 2027 16:15:34 GMT\r\nlast-modified: Wed, 18 Feb 2026 18:30:30 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: accept-encoding\r\nvia: 1.1 fly.io, 1.1 fly.io\r\naccess-control-allow-headers: *\r\naccess-control-allow-methods: GET, HEAD, OPTIONS\r\naccess-control-expose-headers: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncontent-digest: sha256=:luxVrnBnR9z2CvS7noxOPcUPX9nt8w0l4LscODUm5/k=:\r\nfly-request-id: 01KHS0805F2NDNEFR3BZM1M9QK-fra\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Fly.io","description":"Fly is a platform for running full stack apps and databases.","website":"https://fly.io","common_platform_enumeration":"","icon":"Fly.io.png","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14424,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (14166)","md5":"ea4ddaf01ede858dc0d4d922aeb49445","sha1":"022da3322fff84a5ed610820576458facb2a9260","sha256":"96ec55ae706747dcf60af4bb9e8c4e3dc50f5fd9edf30d25e0bb1c383526e7f9","sha512":"facd00352cce6f8db506080bf5b180ac86220d0033eedf16ae5d302b17c4e6fbfa719fe9fd5f3dbc48889cabf898ba752e40be6eb0e16c38dfe85e4cf9487a7e","ssdeep":"192:/KnJI8pXuCzSOepi5TJDdG2YaHXGT+2JOzEf77LODKtVTYDSeSBeZJMPPIx:/2JFpXr4pETJDk2YsXc8YT7uRvTx","tlshash":"7b5253945310282b96335f3a67a0cbbce17858814f939ae990c0ed58d3fadf9076f395","first_seen":"2026-02-18T22:30:55.554999Z","last_seen":"2026-06-06T22:38:00.056607Z","times_seen":561,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getCoinList","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.058Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/common/getCoinList HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":1210,"timings":{"blocked":496,"dns":48,"connect":219,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=usoil","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.131Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=usoil HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":223,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=ukoil","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.359Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=ukoil HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en-US\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5712aefe116c3bee4c4976944627d26c","sha1":"abfab2a1ba488de678eae0daf9ea60a03134d876","sha256":"618a4dfe1a5a412c213134c2cf8cfbe43aacd93f0b1c0136ff9756ee1fef4d72","sha512":"8632afe950050ec3950925bbf0281e09326e760b59421e7771c02d88cff9cd4521b9795c43221e9dc7a5e57a8845b46d74fe2aaef529a7247e0ce0ee3494ccd1","ssdeep":"","tlshash":"8d9002552c188282b88b00a59546120860243160262492484c59d13980981662040cd8","first_seen":"2026-02-24T16:16:06.375162Z","last_seen":"2026-02-24T16:16:06.375162Z","times_seen":1,"resource_available":false,"data":null}},"time_used":228,"timings":{"blocked":9,"dns":0,"connect":0,"send":0,"wait":219,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=xcu","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.388Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=xcu HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en-US\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"45acb618b85e2f771494d6314e6a8748","sha1":"af8aa3bff34914f6b2a75f2d4278810e3d763c07","sha256":"ab0faebd4d168e2a96547919ac248773c4c3769d3fe1ec1f34c763d71ebeb019","sha512":"6753a0d00a273e09a7d3faa160f05f8957c9688befe92c9c12849d14e8b8fdb288c8a70a40ca6ef1ab6784b08b2b75973200b0f765d70ae78e8f4ce311dff78e","ssdeep":"","tlshash":"e79002651c188282e98740a596061208002431602624964c4c5d513981881622040898","first_seen":"2026-02-24T16:16:06.3765Z","last_seen":"2026-02-24T16:16:06.3765Z","times_seen":1,"resource_available":false,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/resource/images/defi/png1.png?2.0.1768390273654","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.828Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /resource/images/defi/png1.png?2.0.1768390273654 HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e74-1b25\"\r\nexpires: Thu, 26 Mar 2026 16:15:38 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tK1uXY8qbL%2F8zaVpW7gJ4ljLiDmH5p4CU7qROYQTdTjkW4R3tunyjitKwPN4bWJaDF%2FM6hMtqFd%2Ft4hGcX4QPojhswNolvvSGiIEp2xiPveOwzb6nArmtPY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d3043456b46f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6949,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"e42448179a7e4cfd76149fc4e340c190","sha1":"8c9bf373b329b7cbabb770586167fadc13c34fb6","sha256":"aad8f325c9108c1b4b9a5f5fd40bc6ad910e12a81b6014d4586f6f8e8131da19","sha512":"265b4ef947931ddd88d013c03c50a6546989ef54312ed83bff4dffcbf03588ac5a37ec62e2dfd38760fe8c34a911f5b14973249c06f7a1e2d06522e92b4b4e17","ssdeep":"192:MknihKLD6GjZm0AqoXmXXTEHuh3O4nG5rg2c1sQgl:fnihKtjZm0AqoX05h3O2Wg2ADgl","tlshash":"d5e18e0d78d15ca04e635781ffcd90a30b535581fee0b8427ca6ae5bae702b1ca2d9d7","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-06-02T15:51:10.703417Z","times_seen":147,"resource_available":false,"data":null}},"time_used":430,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":430,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-7de86585.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.127Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/index-7de86585.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WnsYp%2B52Aue4so77cFvWtn%2BdzVwFM%2FU69SyQa2kqF%2F%2FKXbptC9rclf0bfRr2gsS7MQ9621x3goh17%2FM3ICQ4AyxMThOR4ZzbDF42DTQVb5idPgHlODwu1QQ%3D\"}]}\r\netag: W/\"69677e81-203\"\r\ncontent-encoding: br\r\ncf-ray: 9d30433acbc7f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":515,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (514)","md5":"084dacc20f5381766c7bc46e75ef3e46","sha1":"59c8a167cd517dbd266c22e4815d19e38deeae36","sha256":"a0a4090dce1d2b802ce516b0db0412516305c45e239f84ef7a3dc5a9e48be0f7","sha512":"797b91bb6c5da3daa5247727401843eda4c6b16dffe50148c67e270cc91d9d84bb339b0e830912e53a4432c6009e86ac6def87edb1664f53d97860a025bb97d4","ssdeep":"","tlshash":"58f00e2fac7b50b21ba388fde1231811660c0f567734c5e8e58b0e00db388e7d21e628","first_seen":"2026-02-24T16:16:06.37063Z","last_seen":"2026-02-24T16:16:06.37063Z","times_seen":1,"resource_available":true,"data":null}},"time_used":426,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":426,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=xau","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.161Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xau HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":221,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-d6a1b62a.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:34.305Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/index-d6a1b62a.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:34 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-18a7b\"\r\nexpires: Wed, 25 Feb 2026 04:15:34 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BcKBBl8T0CvXIJ5x6Oyk9eIIGSP1S01qwpr8QK1ulZwh98tJhE%2FWCGQUGdzwc8yUqJ1L0n3VKd7luuLOt%2BvGA28MQNPXsZ9J7M2PAAEYHkerY5bAIVXewJE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d30432f688cf527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":100987,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65526), with no line terminators","md5":"d091bcb4fc44700520eccc44e85dca1d","sha1":"110b30ce0189f67728dbf97cbdd956373a3b0621","sha256":"94fe426ef8d3c4bfe2808b11a19a5bb4b2bad88c78a477906eb785954aab72c5","sha512":"9b3041c295d93f3ee7d4c7a26ab609d3860f6bd199a1618cb1b55ffb55dbda2493a1035ee216b89ccccaa31bb4de56c0b7c1cc025e612a13401483203b2e0f6e","ssdeep":"768:ar/46GmPgf/3g9IP2a1WD8HWYWcNhz95o2HohX4DHR/cYuj3QorVFInyRC7I3g5V:mJOJ1bWcNxUyyXj3QorVlRAEzeg5jQr","tlshash":"92a34a8e940b0fff59ad0858ad5b591020a90fd35c8c8c83b3baae5537facd4a75971c","first_seen":"2026-02-24T16:16:06.378532Z","last_seen":"2026-02-24T16:16:06.378532Z","times_seen":1,"resource_available":true,"data":null}},"time_used":577,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":558,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/vendor-60f4284a.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:34.896Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/vendor-60f4284a.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:35 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-d8b7e\"\r\nexpires: Wed, 25 Feb 2026 04:15:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aU0YbUftYn177XAsXKvQpxeDUa0tV%2F%2BZ4s4aepP%2By0ECBaNd3gARldVH8xIa8spsDyxghy5Zp4oSwLMAwW2m8oO3QHuFi%2F0a9lSXUO4TNB3Mb597SG9zBjE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d3043332c6af527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":887678,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"7dea06bb7c4794d23167de0f6a6d5290","sha1":"845e1c5f422c98e29446b0ee51e8023579ef32d4","sha256":"ea878f7d4c6463d5a5e75ccdf8fadc97ee00de8ff92525f927b4ff2ce8f8ec05","sha512":"d52479a3b3052833b822221a77915970edad63792d6ba2fe7c110c07c570b426fb802c2375b55f64fef37f4a2179b1e1b09a3537ccdb6dfb5e820e290b0ed96a","ssdeep":"12288:DkUj8c1zDw54eqccE/wrhqDFMdb8bv0UxzDpl6W1bOyQjm+a2sY:DkUjtMGeVcEfydb8Ympl6W1qy+a2t","tlshash":"d1153bc97292f06147ab20e240bb1006f3396e55744e8498f1ad98db7d79d89e2b7f3c","first_seen":"2026-02-24T16:16:06.379919Z","last_seen":"2026-04-21T18:04:36.01249Z","times_seen":3,"resource_available":true,"data":null}},"time_used":966,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":557,"receive":409,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getAllSetting","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/common/getAllSetting HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":1201,"timings":{"blocked":492,"dns":49,"connect":215,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-e4f28d41.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.121Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/index-e4f28d41.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-a030f\"\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x33H9e2AkTxhw%2FzUqaNffi3TbPuqQsEPLiFEs%2FGJ5jZQrb7VYf3vL4rfbcHE09xrR4gp54ywdDIVV5Rh6eLGCpda7TnaiD%2FS0WQ9S%2FoA8GkP8Ws%2Btp%2Bf9Ng%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d30433abbb1f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":656143,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"93bdb5c0898df85cbcd347d8cc308b6a","sha1":"2a9686d2c341f04c52b2f0b3c49b53943d4342a1","sha256":"507d598e5652fadce14791eadd6021a69697a5a3209aba584b85c3c7ef4bf7db","sha512":"ff1393530e7fdaddfab36977ba796161ed1c68b7e1f0d5de7ff8eeacbe01e216e6f29047289ce4e08614ba7857c1f7473769ddad2a8f8e4667eb29200d9819d7","ssdeep":"6144:78LAvvvGcX6rwahdOjGhAaqtTigdhrXjXFcFV4Z2+EHLzFYUU+5MBdx1jBfRUiAt:78896V2nZ2+EHLzl5MLBfRfAfOGvh1tn","tlshash":"49d42c46f25638338552129cc87f2607a3756d49598e846cf5bdd8e72ca8e4832bff38","first_seen":"2026-02-24T16:16:06.381401Z","last_seen":"2026-02-24T16:16:06.381401Z","times_seen":1,"resource_available":true,"data":null}},"time_used":874,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":559,"receive":315,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-c367822d.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.166Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/index-c367822d.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-142a\"\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 0\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1iMve6zA9AbazItY%2BL56WN5dY%2Bj4cSv2vaudR%2BoFDm1ci00b2vnUWL%2F3cELWOUODjmCWfZT6kw6wvifhlHIoVeZ8FOeMZFedjw2%2By7lK1p31kZvp1%2FFq7EA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d3043414f62f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5162,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, Unicode text, UTF-8 text, with very long lines (5149)","md5":"9b0ebec6c2bc8dfaeae96d2da133d6d4","sha1":"18f379f974e2c7c630b98e553d021854c8744098","sha256":"cec446389d66060c2d4a4c213546036a4b41e9fea735a8e2eacb5a2f64ab6fee","sha512":"70b4614c2049685e58983b0ea52fb71bf2c67415b5f34d0b70167bc1ad8467d1be28633de4335e374edbc712be713b6bfddb80854ccb3aef55b68b60ab7a7f99","ssdeep":"96:qbbkBKGJwfarblYVbqCw59vPvNUfpNTKwgWWPrbDjDn25+6a893hrUJ33MC7BgYV:nKGJwfyYBqCwvXgpNTKwd+3ngTlhrk3z","tlshash":"b9b1974ef48285b9adb65481089d005212ec3fe5b0ad48f2f2f9ec5a67b8db9d654322","first_seen":"2026-02-24T16:16:06.368953Z","last_seen":"2026-02-24T16:16:06.368953Z","times_seen":1,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/resource/images/defi/png2.png?2.0.1768390273654","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.833Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /resource/images/defi/png2.png?2.0.1768390273654 HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e74-17be\"\r\nexpires: Thu, 26 Mar 2026 16:15:37 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0XIG1YTOBU2q5mPo3uHtAvq0OyOSOSvG5AyAdrPHbpRxMh1cMvNPWN3onhsU75sE1Dnx8D1DK%2BMMS1jwFlDR6XtDHcaJKLOlyAhNEZ5qSZfqvKyFHHvlzXE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d3043457b49f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6078,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"8edb61a43ebbac5b1c00c183530722fe","sha1":"602712cb46dbce14c871f2ca1ebd29acf6136368","sha256":"b53157f804ec5e41faf0213dfcf9f05a00d55ec3390266848735d3e62275829c","sha512":"2edb5e4f1ac0068c4225b411d622a9c06162cfa2db87e6658df5b4cb14bc4670a6f64537d25471c27295a05549b89f9c3d5d688738591fd26989506019e6fb78","ssdeep":"96:MknmWIHF/KENGWGMHOzH5ogs4rpHggsBRC70n4wj7isQwtJDvv1Wm1VKUi8s528l:MknEj4+X2bsBsANjmsTDVnbfM5Gy3","tlshash":"cfc15c56d8b059751215e6592add30227f3603c08751ea84ecfedc7ab6600bd9dbcdc3","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-06-02T15:51:10.736764Z","times_seen":150,"resource_available":false,"data":null}},"time_used":149,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":149,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/type/defi_activity_type","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.998Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/common/type/defi_activity_type HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang,language\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang, language\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/swiper/swiper-bundle.min.css","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.0.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:34.300Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"unpkg.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Feb 2026 08:16:48 GMT","end":"Tue, 19 May 2026 09:15:09 GMT"},"fingerprint":{"sha1":"F3:CF:0B:A3:28:07:E9:5A:D0:8B:F4:9E:A8:A1:9B:71:A6:59:38:23","sha256":"DD:EE:6D:62:AC:D0:59:11:F9:1C:53:44:27:F0:8B:A5:2C:A2:C6:C4:BF:B8:79:AF:A5:5F:B3:E1:29:E8:45:8E"}}},"request":{"raw":"GET /swiper/swiper-bundle.min.css HTTP/1.1\r\nHost: unpkg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Tue, 24 Feb 2026 16:15:34 GMT\r\ncontent-type: text/plain;charset=UTF-8\r\ncontent-length: 51\r\ncf-ray: 9d30432f9f1a6e70-ARN\r\nlocation: /swiper@12.1.2/swiper-bundle.min.css\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=60, s-maxage=300\r\ncross-origin-resource-policy: cross-origin\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14424,"size_decoded":0,"mime_type":"text/css","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":137,"timings":{"blocked":28,"dns":1,"connect":8,"send":0,"wait":69,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-d253bac1.css","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.112Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/index-d253bac1.css HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KNmZJFk1vIVuLQKsAcC%2FczydSW%2Fxbvn4fCVghWuynTVfBoY8%2Bbe4NO5eISbwMu4VglKKo6n4bfr1nR8O5gP%2BKMMPDW0LQKCVQX%2BTLnVDgXLZ927HH5lvL9o%3D\"}]}\r\netag: W/\"69677e81-3d\"\r\ncontent-encoding: br\r\ncf-ray: 9d30433abb96f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":61,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"c88360cef8df86c995e562333879873a","sha1":"8674b487cf92f20149c0ef681b42a599469813bf","sha256":"d253bac175b5b52734c192e96d18c8b26b0c92b881584f63b7de91bff96c6149","sha512":"eeeb5ec01fe8c7d483182fc60a2b54ee1d02994718fd9b23a6182f49ead49d889889f21592b2955bcac8cc859023204782db3210d3a0c706a3e4677564db3636","ssdeep":"","tlshash":"f6a0026d11156404b2225341ff5ff95dce686917da91820453421c9135cbe8f25d821b","first_seen":"2024-07-24T17:37:43Z","last_seen":"2026-06-04T04:33:14.424259Z","times_seen":317,"resource_available":false,"data":null}},"time_used":422,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":421,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/jt_up-6189e55a.jpg","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.816Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/jt_up-6189e55a.jpg HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: image/jpeg\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-d88\"\r\nexpires: Thu, 26 Mar 2026 16:15:38 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MjWWRVV2RLMCWmkLr8i%2BiaIn2%2BAXgOc9fkUgZS02FryFwPWckslqVo1akHqcQGzRSpeDImegdwZLVG1Yn2dt%2BbVPYojYlzuFH3QzBP%2B19ekgaGhunkv9D1A%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d3043455b1df527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3464,"size_decoded":0,"mime_type":"image/jpeg","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"549563c1c9bcc1563e3e5b7833eb300c","sha1":"dadea9f019016da47d446282e160c25b29049c66","sha256":"6189e55a572ec69463782526884d703c36554cef37d8c5a43bf8748e8cd5ca26","sha512":"7f52b074ceac6bfc64205cba0dfbefdba7bffee3988566829275bd89a4a3da3f2042c8c7fbb58609376640fda9fed92397479986409aeb01f1517347c64b3a16","ssdeep":"","tlshash":"75616dc06be91984db5de57c5a0b1ce46f28635a64f1feb0005ae46e0d86ebeec18760","first_seen":"2026-01-20T10:42:16.657356Z","last_seen":"2026-03-16T14:26:38.510465Z","times_seen":6,"resource_available":false,"data":null}},"time_used":430,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":430,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/kline","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:38.115Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /kline HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 69\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":69,"data":"{\"symbol\":\"btc\",\"interval\":\"ONE_MIN\",\"limit\":1000,\"market\":\"binance\"}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42074,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (42058), with no line terminators","md5":"c8c3bb1442df60d625a1e0548dc4d8c7","sha1":"6d307da0c74acda4e84df32fa2dae37545a99ace","sha256":"7b09a28d5413ef36b327e3bd7800601c1f14a9e54a178aba94324daf9cc32b32","sha512":"6eee5932755b911a9a47084fd4a8b3adbb5023d6052bb2fcf8de554bca08744b2e0e8c08442cdec3154867e86fecc1becf12f2c0329f68ab86168cea198461c2","ssdeep":"768:VBlyjAcDRMZN4hDci8bE6nGq1o/IEyktCBur:VLqaZEci8bEOGqu/IEztCBur","tlshash":"05131b70fae9c049e479cec27fe3acb09b1a37d356ddce8905fa54418a857209169fc2","first_seen":"2026-02-24T16:16:06.34364Z","last_seen":"2026-02-24T16:16:06.34364Z","times_seen":1,"resource_available":false,"data":null}},"time_used":535,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":535,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/notice/list?key=ROLL_NOTICE","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:38.218Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/notice/list?key=ROLL_NOTICE HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlanguage: en\r\nlang: en\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2945,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"a13d9895493fa080da6f9677a7f12532","sha1":"64c565d4cd100830763771b3107804b5db267923","sha256":"f25a5ad079586ce82e9219bd7690b960976f5f24db5573295bdbaa4761cb0370","sha512":"fe825665443f99ecc87c6977f08b5b722eb78ed20fb64cda74cf00fde3cff81918f8f521f2d66f3bb18a02320676c7192ec5f497fd94a024ad6d78ca50978342","ssdeep":"","tlshash":"d7518d1e117c9e7a090684c711ccbecda66e1a47d6a1cd34865ecf5c42f26be1f2ba48","first_seen":"2026-02-24T16:16:06.38471Z","last_seen":"2026-02-24T16:16:06.38471Z","times_seen":1,"resource_available":false,"data":null}},"time_used":225,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":225,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/Onboarding-63593849.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:38.489Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/Onboarding-63593849.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-569\"\r\nexpires: Wed, 25 Feb 2026 04:15:38 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 0\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HuP7FTj7nP78pbqGz3BI8Ew1f0rsqJ%2BeydGw8tfrlZy4mrkHbObWrIKb9cLdvrS65UnWhHj3ms0q2B05PF%2FW5MeybjK%2But949IEtVqKjTc%2FAGsAZyBTVYTk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d3043499f83f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1385,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1384)","md5":"b2ce0111f5e19e9246b761169639061d","sha1":"c40833b87347bfce706349ed26c5ec5aca4107e7","sha256":"bc099045695cf98f77c26fe9752501eb949c08bf9353aa14aec2ee70966437bd","sha512":"b9f0d00913fcecffe0c65fceaceb86411dc4a64d71bf60ec444ee4011579165af4c3d84c4af922ff0e63cbc7df8d6707d0c0d84e27af97d7edd29301ab63d3aa","ssdeep":"","tlshash":"df21614ab96c177a2be664a44457401937b90beb20e1e6d476f90d7673fa820062f781","first_seen":"2026-02-24T16:16:06.341297Z","last_seen":"2026-02-24T16:16:06.341297Z","times_seen":1,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/11-1e256599.png","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:38.535Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/11-1e256599.png HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:39 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-4e25b\"\r\nexpires: Thu, 26 Mar 2026 16:15:38 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yFWbLrrxKpFzJS%2FEq80aI9QvslhQrEwI3NAF0QdkXMBktNOPzQySX7S754AmAGHUY99wDNwoHEeYJvs%2BUrWUUijwmhy50jOC43yNJIDt68V%2B67b8Jc6lim4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d304349d8a3f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":320091,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1079 x 1137, 8-bit/color RGBA, non-interlaced","md5":"8e8536741e44da9be7bcf23b8b8c68ff","sha1":"b3860403c1c3108a97d94d4d9fb9682ff002f06c","sha256":"1e256599dd6da8c0033d53a892ae7d20664d3e52f7555747bcf2fed368dd96e9","sha512":"2e24490f6f989362fe54b496f7935a9f698fadbe3eda946e51a90dca21dfc32de13fef2abdcc48dc1e1fb7bb7a61310d04be27ea6b352c682564c2f3c791218e","ssdeep":"6144:yVw8LN4QeXqFbZJu0PQlzz/RhTOseT1xLofpOZrIvO9x7tUKsNG5jtLNb:yVw5RXufZ8zoBqoeO9xSKsSjjb","tlshash":"146401336b1421309399de0e4ba24c51b99f656efc8f1e20af5e1363b46f6ed0d0258e","first_seen":"2026-02-24T16:16:06.38604Z","last_seen":"2026-03-16T14:26:38.477914Z","times_seen":4,"resource_available":false,"data":null}},"time_used":964,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":559,"receive":405,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"unpkg.com/swiper/swiper-bundle.min.js","fqdn":"unpkg.com","domain":"unpkg.com","tld":"com"},"ip":{"addr":"104.18.0.22","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:34.303Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"unpkg.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 18 Feb 2026 08:16:48 GMT","end":"Tue, 19 May 2026 09:15:09 GMT"},"fingerprint":{"sha1":"F3:CF:0B:A3:28:07:E9:5A:D0:8B:F4:9E:A8:A1:9B:71:A6:59:38:23","sha256":"DD:EE:6D:62:AC:D0:59:11:F9:1C:53:44:27:F0:8B:A5:2C:A2:C6:C4:BF:B8:79:AF:A5:5F:B3:E1:29:E8:45:8E"}}},"request":{"raw":"GET /swiper/swiper-bundle.min.js HTTP/1.1\r\nHost: unpkg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Tue, 24 Feb 2026 16:15:34 GMT\r\ncontent-type: text/plain;charset=UTF-8\r\ncontent-length: 50\r\ncf-ray: 9d30432f9f216e70-ARN\r\nlocation: /swiper@12.1.2/swiper-bundle.min.js\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=60, s-maxage=300\r\ncross-origin-resource-policy: cross-origin\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":155178,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":124,"timings":{"blocked":27,"dns":1,"connect":9,"send":0,"wait":58,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/platform/dev/logo_144.png?2.0.1768390273654","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.086Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /platform/dev/logo_144.png?2.0.1768390273654 HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e74-1442\"\r\nexpires: Thu, 26 Mar 2026 16:15:37 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jvg3dqCkN8vFgtEFX14Eu3TuoqQzsLGvFhOAF%2Fld88U4kp9DUOEG3qf%2Fhq%2FNs%2Bk7DB8tVDD6AU%2Fk4EQ07fRVobfQvwEyTW57%2FWihI3YUZClQ%2BDLf7PcbpQQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d304340ddeef527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5186,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 451 x 450, 8-bit colormap, non-interlaced","md5":"9cfcfa476c405543f284c087ced317ec","sha1":"0f0c0b2c9511e19b69ce0a233bb1c7d28698dc3f","sha256":"2d4cd12fc56274848940738aebb9e91a7358d58bdcfe6248f962c080b145d202","sha512":"cc2a635adfc264dac7d1ad48e1efb2101fd6f44bbaa9fa027673a4dcfa05e16607f26dc7fa5c0a5c12d969d5a947af747fe71aad1672951cf57e06d47dfc04be","ssdeep":"96:YFns3f33PLmff3f3rpHam3EDq2Nh1cC2lf9TP64bsX0CUjQFQA1T:r3na/cm3MB12nTVZSh","tlshash":"16b13bc7ac684579deb3c615b35ce8e056bef344844ec30a567c126b1983e97930af94","first_seen":"2026-02-24T16:16:06.387379Z","last_seen":"2026-04-21T18:04:36.028996Z","times_seen":6,"resource_available":false,"data":null}},"time_used":429,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":429,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/en-d3e621c9.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.155Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/en-d3e621c9.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-9f1c\"\r\nexpires: Wed, 25 Feb 2026 04:15:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OLyVZvddNXOUpzpxrfGmzzL43DiLbHcVkV0AQXdu%2FT2p1Q17oaXb1xJQGquIw6vOhznD8yGoQWa31XBEqP3ETq8y9Tsr7%2BtexiMIYGx2HcwW%2BwmuxaTVsKc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d3043413f18f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":40732,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (40709)","md5":"2fee64b1f8b9c4c87e942aee26714c92","sha1":"ee6bcda5063573c8cf71db225ad7494d120c9c13","sha256":"93d35044ea7f0cc48353b291f6a7bfd4f371f15cd75928056e8e6372f03ba359","sha512":"07ebd99d2d7dafd63a8ad5719f05d42bad82685c9a7ac60826574379f031dd38aca2cf4e5432ff3a10cadcdf31fc30a57af484df33cbbe98f69f6a8036d8ac04","ssdeep":"768:XMtZcEw/o7rZOdosiBnAMC2rAaAMFVoP6+6sPGxw1mwO6fpk7aOLxd:1ponZOdoFE2rdFVLsPGwqLxd","tlshash":"d203d6893e1a989a04f3537674ce6e2160f60ac18255881f4fedc9fd53d2b67a363b34","first_seen":"2026-02-24T16:16:06.388744Z","last_seen":"2026-02-24T16:16:06.388744Z","times_seen":1,"resource_available":true,"data":null}},"time_used":557,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":556,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/kline","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:38.013Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /kline HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getCoinList","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.864Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/common/getCoinList HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en-US\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22274,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"1e7f1dcd94aae004d9d290870a979f01","sha1":"afc3335c5eb1bd762e43da7f307a2132be30f436","sha256":"8b0cc5da3014a88cba08d6641a1c4b5f08192ab0d45083d83b4a00d49a2d946d","sha512":"164309b9e7da1b3641676309af9d0924792afc48bce52ce81be2a7b0547ea586311941865f42b64aa9ff00df507151da5028e6e70705c1a019464988ffaa98c1","ssdeep":"192:VXCTKXA8XUmX95WXDNXOg0XzXXkQwXigSwgupwXvwYgK7YYfVCKYTnj/Zf4NRDot:jS73rk5sz1Uo","tlshash":"f6a21d56a17c95bdc13994e12eef7d22118c313fecc68e1fc2ca4e998ee4ab15506b07","first_seen":"2026-02-24T16:16:06.390243Z","last_seen":"2026-02-24T16:16:06.390243Z","times_seen":1,"resource_available":false,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=xpd","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.159Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xpd HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":222,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":221,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=ngas","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.377Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=ngas HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en-US\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"0b545bb9d3b6f9ac3b3b863baf7a49a4","sha1":"d59b59f6e057a044b901547314b400a2f9444b9f","sha256":"b504b8ba44d1d8279683dbf5958b3488f6f403ddf9d1e3cfb7bba4278c4077e5","sha512":"5c6ab9e36d95992ff613994edefb3c639a952cd7eafe52d6f71d6f54a8ed065bee317a03e61a28d17eb7c2fd729fbc55b78d3043f4464ced1049cf0f6cba7b03","ssdeep":"","tlshash":"c09002551c188242ac8704b595061208002631602634d2584c59953980881623050898","first_seen":"2026-02-24T16:16:06.39268Z","last_seen":"2026-02-24T16:16:06.39268Z","times_seen":1,"resource_available":false,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=xag","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.395Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=xag HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en-US\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"7108dc7b4fd2e0ece238608a899e9e34","sha1":"f6ccd1cded00613c367214b45d8801a5ca0738d2","sha256":"3ceeea391fb61f1a99a6f5cf093da6c2773fcfbe30917a500864f53c38f1c618","sha512":"7ac1cd02d76f7d014b8a12a5a5eff5a192d8a66885e7d6b0568097071e738a277ce88a3ee0b58e934cdc2a4d9f8ad9d565fe9387c48566f2b653b7a70c530653","ssdeep":"","tlshash":"619002551c18a242a89700a595065344046431a03664d2884c5a512580891622050958","first_seen":"2026-02-24T16:16:06.394372Z","last_seen":"2026-02-24T16:16:06.394372Z","times_seen":1,"resource_available":false,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/22-b18f27a6.png","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:38.532Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/22-b18f27a6.png HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:39 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-84e9d\"\r\nexpires: Thu, 26 Mar 2026 16:15:38 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KgR8QqzZbpt%2F%2FY4VS4sMzjL9yIaUDYjjxSKXfSpdBbxc5a7cYnCFYz2giOAAsj4i0POFsd9%2FxzZ0NeO%2BlgOqf1otT5DiDalY0mGh3Os3hqjh%2Fa5ml8Tb5%2Bs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d304349d894f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":544413,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1079 x 1377, 8-bit/color RGBA, non-interlaced","md5":"624ece352cdaece9992b3044ccd27b55","sha1":"a4cc29fe69e54d4350c349336a90eecafc296dbc","sha256":"b18f27a6822e51594f92986eb7c14864066d7d22dd2dc2d331e90c737bc76091","sha512":"4b8584eaae8ac68ea735b52832707d9ce7aa6ebebcd1da39667bbea3b6deddda65b6bfe486141672fb2ac2dcce0aff8de3d1f2c39a142da8cd6ba88bd2ce251a","ssdeep":"12288:YZFnmXOlX4uH6eJTr21AXfykusrqDdX7j/cI:YZFuOlXLH6i3e+r4j/cI","tlshash":"6ec4235748c279732b0b9a2d6cc207d02f330b34658f8b7e6f1ae255249e9b02f6f559","first_seen":"2026-02-24T16:16:06.396084Z","last_seen":"2026-03-16T14:26:38.4826Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1096,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":558,"receive":537,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-24T16:15:33.599Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:34 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Hi2G1rGz8dZ40Kmg5v%2Bciw3XsOUFpxFNm0DiXB5JhcNKVyoeFUYOLnG7yUzui23k59KrqqKKEhEWL%2FSOdn%2Fn44jrrsSURG3nz1dxV5vahULXFSUD8oVVCYc%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9d30432b6a18a618-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Unpkg","description":"Unpkg is a content delivery network for everything on npm.","website":"https://unpkg.com","common_platform_enumeration":"","icon":"Unpkg.png","categories":["CDN"]},{"name":"dc.js","description":"A multi-dimensional charting library built to work natively with crossfilter and rendered using d3.js","website":"https://dc-js.github.io/dc.js/","common_platform_enumeration":"","icon":"dc.js.png","categories":["JavaScript graphics","JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6512,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1094), with CRLF, LF line terminators","md5":"f43fdb401433747353865535b3880e42","sha1":"249acba92726effb612971c2438f4041894a7841","sha256":"ac48e8d0bbcdd7f9660bcd2f598c871a8bf47b43fc75b49a5052ff0296ab3db4","sha512":"dbb4806ec5fa2fd6eed17c2653fdbfa1e57f2ea40ac8af42e46f8f536ad002c7da2ee6ad2c947394146ca6711d80c509babd428078903ef874e851db9be6d937","ssdeep":"192:+FX19PVg2T+uNOGmZCxfu2nfD3bwuB1ni5iof2:KLaZCx22Ni0oO","tlshash":"13d161bb59a598191331452baee7f008cb611193482e4c1578ed40ee9fb5fe6c4c7b3a","first_seen":"2026-02-24T16:16:06.398115Z","last_seen":"2026-02-24T16:16:06.398115Z","times_seen":1,"resource_available":false,"data":null}},"time_used":545,"timings":{"blocked":56,"dns":19,"connect":8,"send":0,"wait":433,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/vendor-72ef657d.css","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:34.308Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/vendor-72ef657d.css HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:34 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-16997\"\r\nexpires: Wed, 25 Feb 2026 04:15:34 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=I0R4lzQYRisYRrPYehzT5AJ591QeLisYpbI%2FOr0stcvIb2dAlvla4CjJVDtLIpOaBWx3JNwNqX3QJU5u%2Bj5D4E1IxUu2Zg%2BzQVUz0oZ%2F%2B9EcdzeZukm6ZjA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d30432f68a7f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":92567,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65022), with no line terminators","md5":"b40940e3efd47e3e653fe1fbec0ab363","sha1":"3911d44e1bceb07e83746e6bc68de9dbb587b11a","sha256":"72ef657df5906e9f23040a4ceb49985bf894ddcb4324d7d873a0c20b15d3e864","sha512":"f3706c9146b2091fb1a864ab4180d0a1538e801686af21bab4c7231421859a99fba7dd694632faaf1c457fb06711fcb16809e2221fe692c16390e7e98ccbf4d5","ssdeep":"1536:ZTIyNBi3MFYaQj73rx3WqyrtpqoSWEDZEnX73:ZdN0rxmNH9yDWr3","tlshash":"0193c5a5e9c4a1fc6f26f6659b4766d8f13cf661cc01daa0f109512d0fc7bf50223a2a","first_seen":"2024-01-05T03:21:29Z","last_seen":"2026-06-01T14:27:44.8802Z","times_seen":233,"resource_available":false,"data":null}},"time_used":688,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":562,"receive":126,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/resource/fonts/Arial.ttf","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:35.048Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /resource/fonts/Arial.ttf HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vipairesearch.nbmz168.com/assets/index-7374a6d3.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:35 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 1047012\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:00 GMT\r\netag: \"69677e74-ff9e4\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=he%2F5h%2FZwMSJmsuVI2oewcqxbw9jYSAvCLSDojrl2trmf%2BBjsjO5gvw17FNUcmvCfvp6IAEH%2BN7C%2FjMUX%2FCJPyNRJA%2BnSoSg0Cj%2BUcp%2Bo06NaV2ThkXMWZbs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d3043341f6af527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1047012,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, digitally signed, 25 tables, 1st \"DSIG\", 58 names, Unicode, � 2017 The Monotype Corporation. All Rights Reserved. ","md5":"ffe66dbfc4b07f36ef38dd621ad2c7cc","sha1":"e032b102cfc37c3226d17e1b462edea5fbf8fe1c","sha256":"c1216a01b3cc4e94df72577a6f618154058a1d8999ed58fa31ab7e54c7e4be4b","sha512":"3c7952b71c8117938c5284efca0e0b3e8c20d7b84c74a4890f76a72af3b26295786b0f7c33d9b6c980527b4c4c8dad628d1f5e7e5f202d11076367f082349bb3","ssdeep":"24576:NoQIQRjo/Y7wjgTmKJ4WxA7EAD4OBfDamXKE6AMra:NHIQJo/Y7wjgTm0PxAwJHE6hG","tlshash":"f125be0bf3929f0fe3902b38c9a5d761939b76189b2743b73d8c5858ecc85a45e487d2","first_seen":"2023-07-29T15:16:45Z","last_seen":"2026-06-06T23:47:44.198419Z","times_seen":1328,"resource_available":false,"data":null}},"time_used":1263,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":428,"receive":835,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/vendor-60f4284a.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.016Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/vendor-60f4284a.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-d8b7e\"\r\nexpires: Wed, 25 Feb 2026 04:15:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 0\r\ncf-cache-status: HIT\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mXkC95DMOZytkPJPRhgslGxFHdJXM7CEBh0d3ZKNWf1p%2F3OmBcIOajy8y5I4SsuFAjsHHTRkOsdYtIR8T%2FZQ%2FAYuXf%2Fzz4lu9iPmJq%2F%2BSrOVmY4oOrCdH5E%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d30433a29ccf527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":887678,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"7dea06bb7c4794d23167de0f6a6d5290","sha1":"845e1c5f422c98e29446b0ee51e8023579ef32d4","sha256":"ea878f7d4c6463d5a5e75ccdf8fadc97ee00de8ff92525f927b4ff2ce8f8ec05","sha512":"d52479a3b3052833b822221a77915970edad63792d6ba2fe7c110c07c570b426fb802c2375b55f64fef37f4a2179b1e1b09a3537ccdb6dfb5e820e290b0ed96a","ssdeep":"12288:DkUj8c1zDw54eqccE/wrhqDFMdb8bv0UxzDpl6W1bOyQjm+a2sY:DkUjtMGeVcEfydb8Ympl6W1qy+a2t","tlshash":"d1153bc97292f06147ab20e240bb1006f3396e55744e8498f1ad98db7d79d89e2b7f3c","first_seen":"2026-02-24T16:16:06.379919Z","last_seen":"2026-04-21T18:04:36.01249Z","times_seen":3,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/platform/dev/favicon.ico?2.0.1768390273654","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.087Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /platform/dev/favicon.ico?2.0.1768390273654 HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: image/x-icon\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:00 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lyqFgriDgr9aArie%2FT4j5MAnob0F%2Bpnlh0LyOsBqJi59cq2%2BjMmCrfKce%2Bilp03t0mzLeY1ratEY6MkXXzZdVAZyVegjg4TTPr1LQfVvB25Ju16ZF5%2F7kDA%3D\"}]}\r\netag: W/\"69677e74-1442\"\r\ncontent-encoding: br\r\ncf-ray: 9d304340ddf2f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5186,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 451 x 450, 8-bit colormap, non-interlaced","md5":"9cfcfa476c405543f284c087ced317ec","sha1":"0f0c0b2c9511e19b69ce0a233bb1c7d28698dc3f","sha256":"2d4cd12fc56274848940738aebb9e91a7358d58bdcfe6248f962c080b145d202","sha512":"cc2a635adfc264dac7d1ad48e1efb2101fd6f44bbaa9fa027673a4dcfa05e16607f26dc7fa5c0a5c12d969d5a947af747fe71aad1672951cf57e06d47dfc04be","ssdeep":"96:YFns3f33PLmff3f3rpHam3EDq2Nh1cC2lf9TP64bsX0CUjQFQA1T:r3na/cm3MB12nTVZSh","tlshash":"16b13bc7ac684579deb3c615b35ce8e056bef344844ec30a567c126b1983e97930af94","first_seen":"2026-02-24T16:16:06.387379Z","last_seen":"2026-04-21T18:04:36.028996Z","times_seen":6,"resource_available":false,"data":null}},"time_used":430,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":430,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=xal","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.153Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xal HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=xag","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.164Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xag HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getAllSetting","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:38.220Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/common/getAllSetting HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlanguage: en\r\nlang: en\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11968,"size_decoded":0,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (11634), with no line terminators","md5":"7343b2a465f525a534609fbd575c6f88","sha1":"2d4ffa034996def4e0d5a7c394e3ddd698e8287a","sha256":"df07503aefedf0f4606139dde7bb2d55e9b94bda8f4ef3456305da13a986b8eb","sha512":"3f7bedf83c289b1a680923be17f4ba9972f2257b96ccd7c4695fc8e076f69e439df6ba890097aac115f6a4695df95455c19b07a42b80587ec56bb8770b3cce85","ssdeep":"192:cEuwYPOFgQ+oTzBYUMSD+RbRuc2eHPExqQa1JBx4qstJ2sKbgMNa2p6ZvP3C8QCH:Cuanad2N0MqH9YQm1Jn8","tlshash":"0332545b35ecccbec2966ac220ef77a5a99ca47bdc465806d09bbf8cacd5531484700e","first_seen":"2026-02-24T16:16:06.353173Z","last_seen":"2026-02-24T16:16:06.353173Z","times_seen":1,"resource_available":false,"data":null}},"time_used":238,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=xau","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.394Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=xau HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en-US\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"71aa32ca27df2076ef39e6308ce4e7b9","sha1":"3e3201ca3fc34aac53cacb8f0225e68a7dd5c78d","sha256":"c2b620bd4bb58e50b6f9ae06d39e0ff028ad1217e5fb2276c5810afdfce4b7be","sha512":"7d33cedf7f48968ee5e78fe8f6b8b0651a477670effc8256b1350e5d08363a0944106a2317278957ee9e8aa79f4543f74523b581c3b9ecea6ba00c44b11ca78e","ssdeep":"","tlshash":"849002551c18c242a88740a596061706003431602624d2484c59912580991626040859","first_seen":"2026-02-24T16:16:06.402612Z","last_seen":"2026-02-24T16:16:06.402612Z","times_seen":1,"resource_available":false,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-25f8b00d.css","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.100Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/index-25f8b00d.css HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-a6f\"\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VBeAMd0mu3vixKrtWNHSIujEOL27wjXsEdz4pY%2BNQq3NT9%2Fov9%2B6kLjGLE4zistKPP0wEF32bGzaiUBhI7F3DfyEI5w0Po3cL6NlUTeF4c6YS%2FbjkOeuAVE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d30433a9b4af527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2671,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (2670)","md5":"ae14aebfdf99d73eed6c7a74491b83f1","sha1":"df4e45a3f439d52aa3ebab38dbbc8307f37d9287","sha256":"25f8b00da7652597f7854deb11af13397125ee8bd4798ed0c1ac81fdf4313803","sha512":"12d5dc451209c384e4baec867603a632999c0ddcafe717c7d4759731e61d2819c33fd12fe4cdeb09668e398dc03a3a975f20caf36967df2b09768db6347619f6","ssdeep":"","tlshash":"5151224ef39521340c73c9db6e745a8ca1047ed3e15bddc2fa6386260adfaa3163425b","first_seen":"2026-02-24T16:16:06.404736Z","last_seen":"2026-02-24T16:16:06.404736Z","times_seen":1,"resource_available":false,"data":null}},"time_used":428,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":428,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=ngas","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.147Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=ngas HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":229,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=xpt","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.157Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xpt HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":223,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":223,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-50674fb9.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.171Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/index-50674fb9.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nage: 0\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3bAMszDXPT1oF4B%2FGXDiQ6jCBxCDXZNVWk9fYMgNPXdzxFfFsh%2FVJORw9lU83AOxjaGUsRPsUWJ7UGAjd3BeojhfAgMBIugnfsI%2FAZPIGCmxviZ4v67bzRQ%3D\"}]}\r\netag: W/\"69677e81-308\"\r\ncontent-encoding: br\r\ncf-ray: 9d3043414f7df527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":776,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (775)","md5":"2c6885cec8e2dd086a33d63593274174","sha1":"82469bdb0206964259b4995cb98c2e8790b8a7ba","sha256":"4ba5dbfe7e535e49f0e6b545fb251784471c3791a9d78496f3a3ca3ecba82813","sha512":"314a87259bf04d587d4c39ec51e93286cc482c1e9b101c80cd46f08b6371900ca5fa10789fa773036581aaa2356738c337ef82ba5de761f91fe52338b9d71cff","ssdeep":"","tlshash":"2801fdf8fc0c8ebb0fa20a4001902600140a1fddfa1819e198867d6a1be4940dbde32d","first_seen":"2026-02-24T16:16:06.334536Z","last_seen":"2026-04-21T18:04:36.040871Z","times_seen":3,"resource_available":true,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/load-9f47dea0.gif","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.838Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/load-9f47dea0.gif HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: image/gif\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-2d627\"\r\nexpires: Thu, 26 Mar 2026 16:15:38 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6lHRtmt39p%2F9hFekhl7m0s9GzrhP9Y58Byf5t3v2746cxtQFWD3Zj1GPcKt5DGDcMkjkbh4f5LMDNzNR7Bfc6RIzPVn5IkVCdYWE8ddpPFnFCU2oNrlkJxw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d3043457b57f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":185895,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 300 x 300","md5":"e3a625d7bbfbd740bce1feecbbd7f32a","sha1":"bea75c691e705d04419186af0afc003d35632c5e","sha256":"9f47dea00c9dedea5e3086a96402f603afb37fb3b323b63c93904e4a2c7a0889","sha512":"904baf4ed7851ba1746e8979a2506e0284e5e3ceb926a6b747d8d22b1a4c1fe733a14a5c95edf081fda0f195d1640ae3fd0ce56b22ac8b3c2455a80ac9531a74","ssdeep":"3072:GMhwjbiOE6RnTsJixjXP0jPr4RyXBRnIFNnTOtecf1hzSRMJ:GM2ftEoTQr4R6fGGqMJ","tlshash":"9504d0d188b460e5f617563d239fc7146c6cb08d347cbb332c42b6a2e6f2b9c14e9966","first_seen":"2026-02-24T16:16:06.40691Z","last_seen":"2026-03-16T14:26:38.505397Z","times_seen":4,"resource_available":false,"data":null}},"time_used":827,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":558,"receive":269,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/kline","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:38.111Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /kline HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 68\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":68,"data":"{\"symbol\":\"EURUSD\",\"interval\":\"ONE_MIN\",\"limit\":1000,\"market\":\"mt5\"}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":37950,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (37934), with no line terminators","md5":"690456f8d1c14ed21b21cbf5a45a7910","sha1":"dff1f53abdd5af2a81566abaffd86dafedbf64a2","sha256":"efeb0ea93c615d66981d621f44399fee341bc9f5160af1307269da59b311c1c2","sha512":"82ceda07b93b20053ac8ca27e99dc0040130d463d1d01b5265464af10d9c9b97841e0812d52e871530cf01a3685f7a8bb4f72c1be8d1cc0f3440c3f87468f3e1","ssdeep":"192:VOf+BUsUW4UUO9nc3mnEi6VbQnbPFk5YlFlcrIcIbCVebM+R7Asabhys9W2JDh:VOf+B4DO9nc3mnxbRgIcUCVeg+XaF9L","tlshash":"8103bd3c5bd8c15896308cc17fd3ada1be56f1d78aceacd7c5d82c08ea841299127bd6","first_seen":"2026-02-24T16:16:06.409105Z","last_seen":"2026-02-24T16:16:06.409105Z","times_seen":1,"resource_available":false,"data":null}},"time_used":367,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":367,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/notice/list?key=ACTIVITY_NOTICE\u0026modelKey=HOME_ACTIVITY","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:38.213Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/notice/list?key=ACTIVITY_NOTICE\u0026modelKey=HOME_ACTIVITY HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlanguage: en\r\nlang: en\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1829,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"dd8f6524a16bc4c8c285b8a38b070683","sha1":"31548d4db3376ebfcb8dcb4929eab95dc4c9c1f0","sha256":"035ce9e388fb94c2ff606348a4c49526c9e847f45815471bdde6f4d366bdd5b4","sha512":"07f9bb34f451a0267bacb0e296ea3bb443542df9e36197c1b20ee2c0c15230c3b24a9e60d9c5ef4bde2679735b2cfefe981f16cb3654f6ecea08d4f7c34077b0","ssdeep":"","tlshash":"f531535a96904f304c0342e6512d7ad6ab5da2ebe3514d75068b8fbc94c687b1b3f8c8","first_seen":"2026-02-24T16:16:06.411407Z","last_seen":"2026-02-24T16:16:06.411407Z","times_seen":1,"resource_available":false,"data":null}},"time_used":226,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":226,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"webapi.tmgmh.cc/ws/2f8e8f7f-70ec-4786-bc98-13107fa42852","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.131Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"GET /ws/2f8e8f7f-70ec-4786-bc98-13107fa42852 HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://vipairesearch.nbmz168.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: K/Jl5iCA4FiElWkyLmR38A==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 \r\nServer: nginx\r\nDate: Tue, 24 Feb 2026 16:15:37 GMT\r\nConnection: upgrade\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nAccess-Control-Allow-Origin: https://vipairesearch.nbmz168.com\r\nAccess-Control-Allow-Credentials: true\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: gSrQ3bRWecHmJxpdV+Hnolf0zAM=\r\nSec-WebSocket-Extensions: permessage-deflate\r\nX-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":1976,"timings":{"blocked":-1,"dns":657,"connect":872,"send":0,"wait":222,"receive":0,"ssl":882},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/resource/fonts/DINOT-Medium.otf","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.878Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /resource/fonts/DINOT-Medium.otf HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vipairesearch.nbmz168.com/assets/index-7374a6d3.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 73096\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:00 GMT\r\netag: \"69677e74-11d88\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gdLpz%2FUxvQeFUbGf3lGFBwvhOyRssKEEN3OHaPAkn1FdxAEhdYHUx3tPZ984pOGeiALBcAStFWUYYdsFz6dPr52zvh7Tjd8QsuID1E%2FRfSWervkM0iq8v%2Fc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d304345cc14f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":73096,"size_decoded":0,"mime_type":"application/octet-stream","magic":"OpenType font data","md5":"ab876400560626fbe045633dc44f0748","sha1":"85bbfb1729e86f40ddc9af7197b5f54ed6136226","sha256":"5888b24f6b65ff7c989b4a258dbeb5d997320d61417371210da0258be21d854d","sha512":"82e96ade51b0570c1f691ba45d1a3c0802015dad7598954675c4abe2fa8a9fc705adbe6eb5e677aa5cc03b6704e594cfe99279c678855ebbbcbade6d5028dbd6","ssdeep":"1536:TlK/cP2D2oV7otQjBG1+acfZZHHDEdom1hvd5JItkB7k3Z:TKQQtG1yZSdomrvpIqcZ","tlshash":"0b636f031d4fb9548de4513a52de4ea34bb39ecc1ca493c30ae12d938fece6657152ae","first_seen":"2023-08-16T00:37:20Z","last_seen":"2026-06-06T23:47:44.188483Z","times_seen":960,"resource_available":false,"data":null}},"time_used":693,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":424,"receive":269,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/kline","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.895Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /kline HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":216,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/kline","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:38.011Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /kline HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/type/defi_activity_type","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:38.221Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/common/type/defi_activity_type HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlanguage: en\r\nlang: en\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":635,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"7a423e3451e474878191a0a7f1d323b9","sha1":"13312f533f380295131f6a1540f425d0c98a16ba","sha256":"49c938e0bb3a834cab9319575489cf6c1694cace3f1ceb9671570024328e2a35","sha512":"0522e47fc06c4329cee21e354b264c90ae4b0725941d75cf63af54bee4a307fbe91e7078a412bd9750f3856657159ffe5efff139a652ec0443368f7c146bfdbf","ssdeep":"","tlshash":"5af028143d3dcebf098f65e745ec7818399c152794a0fca058ab0f3c5ae4171088921c","first_seen":"2025-04-07T11:28:26.961944Z","last_seen":"2026-06-04T04:33:14.419392Z","times_seen":666,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-eff798d6.css","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.115Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/index-eff798d6.css HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-4605\"\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=g7ziQDJp3ySexY9cWqwHlakWa1aJxxn6waKdc7CB7WI0n%2FywnE1hJIzmegVlMSnkGqF%2FaswydZLO%2FEc%2BekBRu3lKo8bjJ4Uj1eTZUFvjYjfi0UimNhiCUlc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d30433abb99f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17925,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (17924)","md5":"a2f26d2f388d7f48dcba577c974f89e1","sha1":"5d5dae1f0ecfac9a57ed1f8c51525a1df7a67de9","sha256":"eff798d657722a936b8535229bf5e9ea30d17a685d5ef15e3b7b3d04906b6458","sha512":"e4ec91e465ee47111f0c305b0b32f8aef8a307f58eed6254544ca6b4deca3281aacdf2284f4375b1d3b61866650558488a940946344a394fc3b911468305331b","ssdeep":"192:tsMrAqyYu63Up2ECu/LrCspPALOiQZOgMWAePfl:p0qjuvFpSgMWA0","tlshash":"558276a8b79826349e33d1556fc48edcf109bb61e55389c8fa9756328ccb7a32931188","first_seen":"2026-02-24T16:16:06.415474Z","last_seen":"2026-02-24T16:16:06.415474Z","times_seen":1,"resource_available":false,"data":null}},"time_used":426,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":426,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/index-e4f28d41.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.554Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/index-e4f28d41.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-a030f\"\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 0\r\ncf-cache-status: HIT\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nUYeGWKOUL4bzc6tE%2FXG4w7%2B4azfS%2BiiUixNCr3gOkkDCwSDdteiuzUte%2FtKFSpxKLwdHSrUrC2UC4qYL0%2Bb8Xd0GbhG1zWcJMDNlONhrLP4Dm%2BlQlL2e1Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d30433d7c45f527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":656143,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"93bdb5c0898df85cbcd347d8cc308b6a","sha1":"2a9686d2c341f04c52b2f0b3c49b53943d4342a1","sha256":"507d598e5652fadce14791eadd6021a69697a5a3209aba584b85c3c7ef4bf7db","sha512":"ff1393530e7fdaddfab36977ba796161ed1c68b7e1f0d5de7ff8eeacbe01e216e6f29047289ce4e08614ba7857c1f7473769ddad2a8f8e4667eb29200d9819d7","ssdeep":"6144:78LAvvvGcX6rwahdOjGhAaqtTigdhrXjXFcFV4Z2+EHLzFYUU+5MBdx1jBfRUiAt:78896V2nZ2+EHLzl5MLBfRfAfOGvh1tn","tlshash":"49d42c46f25638338552129cc87f2607a3756d49598e846cf5bdd8e72ca8e4832bff38","first_seen":"2026-02-24T16:16:06.381401Z","last_seen":"2026-02-24T16:16:06.381401Z","times_seen":1,"resource_available":true,"data":null}},"time_used":431,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":117,"receive":314,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=xcu","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.151Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xcu HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":225,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":225,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/kline","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.893Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /kline HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/kline","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:38.234Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /kline HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 69\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":69,"data":"{\"symbol\":\"eth\",\"interval\":\"ONE_MIN\",\"limit\":1000,\"market\":\"binance\"}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40369,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (40353), with no line terminators","md5":"e20a17637c00697938d58d3d82d555bb","sha1":"483c2f85de8ba42ee4b3e817d42b9a87e90e4083","sha256":"6a19dbc07db817fa328d76f3e0e0cc9d2642380808eb3064a79ea21d6edac8be","sha512":"bb6099ca94bb33a936be080376fa16e518a78c9acc3a8e235f06e1d660b6af2baf7d3307bee846849c12d0ba57035a2c1f168c2fb70e1aae6265b11fcbc2a282","ssdeep":"384:4HeOzhdfu99TKbTUrG78RO1T6lLkwBhQjz1MahjVRrvvLWYwi/5iY:4HewuKbArG78RO6lLdmXixgT","tlshash":"5003a036ce88d459d83b4cd66ff3fce0072633d306eea85149d95b125ad4e28b126f92","first_seen":"2026-02-24T16:16:06.417863Z","last_seen":"2026-02-24T16:16:06.417863Z","times_seen":1,"resource_available":false,"data":null}},"time_used":426,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":426,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/scrollbar.min-10f87a98.js","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:36.126Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/scrollbar.min-10f87a98.js HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:36 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-18d25\"\r\nexpires: Wed, 25 Feb 2026 04:15:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4wHvNWXOT40P6UpzJw6B2UgY5LGeBAvpK7vYpt7PmoToig2O4KWO0Tfl7%2BBI5LRSqJX2JRGAK9qovKRplrLr7IewrbaJu4VQ%2B1fjNGPNq0SZYlZvOYKUTG0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d30433acbbef527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":101669,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"93f359d2fb2aac21d8251c643ea3133d","sha1":"36dd3545c76295e2f2505526cc47d3de89b635dc","sha256":"9b2221a326e30f6c7b330535c59e193b8d352287610a1a2937bfc1f401ecefa4","sha512":"4509295fad5754f6466a887334897c936c0bf739eb856279591110b193c883daef6b64844c11aded2c2b436e4099c2efdfaf81c0e68ef67f64d8a18546cd46cc","ssdeep":"1536:Bg3IgYU9olguxrE9fGFhmUQsbHxFOUlwJAY7hxsKUOXc66beI02UwurxNnvc+5h6:9p5EilLxFOF1AKUeczbQ390+5h6","tlshash":"32a31a89b320b1a252fb5a979375820073b50944f408d8e4b1be5db7592ed9c13aeffc","first_seen":"2026-02-24T16:16:06.359093Z","last_seen":"2026-04-21T18:04:36.021322Z","times_seen":3,"resource_available":true,"data":null}},"time_used":573,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":570,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=xni","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.142Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xni HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: lang\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: lang\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-07T02:09:46.692243Z","times_seen":16200239,"resource_available":true,"data":null}},"time_used":221,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=xni","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.361Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=xni HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en-US\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"adedd27b15d52ea0552e38843b18403f","sha1":"34c047eb485982422f958a4a603011f66e1d9ee2","sha256":"d90a57d1980da3a7cae1495ca6127b2033dd9bffdf918cec14f4bda95d306a1a","sha512":"0d040f70b833ff1d4edd3c5319a86a9fd898577a28314aa3a0470de915790a76ea24a8c2e3408696e064741c4e2716a5b982d1b0ca7486002bbc31e9f524d621","ssdeep":"","tlshash":"d99002955c188642a89710a595061305102431603634a34c4c5a912580881622040c59","first_seen":"2026-02-24T16:16:06.420206Z","last_seen":"2026-02-24T16:16:06.420206Z","times_seen":1,"resource_available":false,"data":null}},"time_used":228,"timings":{"blocked":8,"dns":0,"connect":0,"send":0,"wait":220,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.tmgmh.cc/api/common/getMt5Amount?coin=xpd","fqdn":"webapi.tmgmh.cc","domain":"tmgmh.cc","tld":"cc"},"ip":{"addr":"116.204.186.154","port":443,"asn":9294,"as":"GNET INC.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:37.393Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.tmgmh.cc","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 21 Jan 2026 11:26:41 GMT","end":"Tue, 21 Apr 2026 11:26:40 GMT"},"fingerprint":{"sha1":"7F:C1:FE:AA:69:54:73:10:67:42:8C:EA:24:E0:5A:17:F9:43:34:65","sha256":"EF:16:68:C3:DB:FA:1F:1D:C3:C3:6F:07:F4:E0:14:F5:81:E3:B6:07:04:9D:49:AC:A4:77:8D:64:5C:48:F8:D4"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=xpd HTTP/1.1\r\nHost: webapi.tmgmh.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nlang: en-US\r\nOrigin: https://vipairesearch.nbmz168.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 24 Feb 2026 16:15:37 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://vipairesearch.nbmz168.com\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"a9d5e839f9d2733075f761cd9c48ee4f","sha1":"7de984d7bcd9e13d2995bcaf850e3be59e16ed18","sha256":"61a8f1e49896ac9de78bb3e66d68891f6174e7d26093b8d1509b1a5e8fe8dcd0","sha512":"75b621e149fac1d7033e6fdbfe91492da794eca003b417ff16ebe382640f0187f83b2b24c020b5f4f536106feda160502d5943c5ea573ccc0bcbc4379d4d4222","ssdeep":"","tlshash":"7e9002551c588242fc8704a695061304002431642a2493484c59516580991662044858","first_seen":"2026-02-24T16:16:06.422758Z","last_seen":"2026-02-24T16:16:06.422758Z","times_seen":1,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-24","alert":"Sinkholed","trigger":"webapi.tmgmh.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vipairesearch.nbmz168.com/assets/Onboarding-4a7f6373.css","fqdn":"vipairesearch.nbmz168.com","domain":"nbmz168.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vipairesearch.nbmz168.com/","date":"2026-02-24T16:15:38.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"nbmz168.com","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Sun, 18 Jan 2026 06:25:00 GMT","end":"Sat, 18 Apr 2026 06:33:42 GMT"},"fingerprint":{"sha1":"68:CB:11:43:51:9E:0E:1B:84:A7:AC:CA:9B:6E:C2:9C:1A:75:80:04","sha256":"56:B2:6A:1A:83:3E:D7:9F:37:FF:41:A0:08:A9:57:93:87:78:56:6B:45:A6:1C:38:DA:B4:AC:E3:00:A1:38:29"}}},"request":{"raw":"GET /assets/Onboarding-4a7f6373.css HTTP/1.1\r\nHost: vipairesearch.nbmz168.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 24 Feb 2026 16:15:38 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Wed, 14 Jan 2026 11:31:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69677e81-8d4\"\r\nexpires: Wed, 25 Feb 2026 04:15:38 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vW%2FKyjueoubARyh8ixedk1nr6kNVU%2BgpkiHOP%2F1eZcEZFs3qq59xB3NGCypwLWYFIwfhgYB8di4LRd%2Bai0hkFYJXvV47t7mQtsz%2F4sHi1HU%2Bt7zgGboJtJU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9d304346ef4df527-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2260,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (2259)","md5":"0e3df38bcef0b87cc381aa6883188a3f","sha1":"047e0aebbf45151e22caa87ffabc788578f094b8","sha256":"4a7f6373a4683c4a8afda6f2d2a4628e718289b353ee18d495e6c175b733378b","sha512":"51c79d3ffc2b762b1bb221cca96b25e0264b0dce1c9fb7828b604f5d015ed21d88ecc047c035a31ef60260729e1c3cbe68b196325701c60158ace0771d89e4e3","ssdeep":"","tlshash":"2241ed90f9c91907b1a78fd47dc7abda5014c6b2e0c39f6861d37990c5832db357631a","first_seen":"2026-02-24T16:16:06.424843Z","last_seen":"2026-02-24T16:16:06.424843Z","times_seen":1,"resource_available":false,"data":null}},"time_used":428,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":428,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}