{"report_id":"51ee4e88-cf5c-4114-9a52-705ad30d5f00","version":6,"status":"done","tags":[],"date":"2025-10-21T12:30:35Z","url":{"schema":"http","addr":"www.u52j.xyz/","fqdn":"www.u52j.xyz","domain":"u52j.xyz","tld":"xyz"},"ip":{"addr":"110.42.43.240","port":0,"asn":136188,"as":"NINGBO, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"final":{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"title":"welcome-BET365"},"submit":{"url":{"schema":"http","addr":"www.u52j.xyz/","fqdn":"www.u52j.xyz","domain":"u52j.xyz","tld":"xyz"},"ip":{"addr":"110.42.43.240","port":0,"asn":136188,"as":"NINGBO, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-25T12:30:35Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u64p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u64p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"www.u52j.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"www.u52j.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"ssl.gfw301.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"img.esportsdata.cc","ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-06-01","domain_rank":0,"first_seen":"2023-07-06T16:47:53Z","last_seen":"2025-10-16T06:20:24.904689Z","alert_count":0,"request_count":6,"received_data":14936,"sent_data":2850,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"u64p.xyz","ip":{"addr":"110.42.43.240","port":443,"asn":136188,"as":"NINGBO, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"domain_registered":"2025-10-15","domain_rank":0,"first_seen":"2025-10-21T12:30:42.931176Z","last_seen":"2025-10-21T12:30:42.931176Z","alert_count":4,"request_count":2,"received_data":602,"sent_data":954,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www.u52j.xyz","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-08-22","domain_rank":0,"first_seen":"2025-10-21T12:30:42.932894Z","last_seen":"2025-10-21T12:30:42.932894Z","alert_count":4,"request_count":2,"received_data":556,"sent_data":878,"comment":"","tags":null,"fingerprints":null},{"fqdn":"ssl.gfw301.top","ip":{"addr":"23.224.132.157","port":3600,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"domain_registered":"2025-05-06","domain_rank":0,"first_seen":"2025-05-07T23:01:33.498355Z","last_seen":"2025-10-20T11:42:54.914012Z","alert_count":2,"request_count":2,"received_data":24128,"sent_data":1086,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"u65r.xyz","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-10-18","domain_rank":0,"first_seen":"2025-10-21T12:30:42.92659Z","last_seen":"2025-10-21T12:30:42.92659Z","alert_count":134,"request_count":135,"received_data":19650619,"sent_data":69164,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"img.365live88.com","ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"domain_registered":"2022-08-16","domain_rank":0,"first_seen":"2022-08-16T10:26:51Z","last_seen":"2025-10-16T06:20:24.799401Z","alert_count":0,"request_count":48,"received_data":4716685,"sent_data":23376,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/65246.1756903329400.c090be2c.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"9695de283c01f0fadf4795c612b010e2","sha1":"9e9b20c41d8eac731f465f87713f570eee532180","sha256":"82d3d78a522caa25376deb145964490b699e6d2c976ae6cdad15f2c4e57cfc7e","sha512":"5f583070eebf753cebbbad1720360c270ec09391ef530c0efb982a92e03b1a10689136cbb74c005fa386f20111b32a602557c0fdf5e2d716062da09d942e2f6e","ssdeep":"1536:r2+iDvYvNjx4Uyao0L8oDNzAuMMsTAQ0mqt2pXYzA4dANV1:i+iDYvPo0L8oZzAuMMsTA7mqt9zA4dA1","tlshash":"c773a501f78272384fa7e290220f2026e16d191505ac5bd8f179ffb93ef4954aa7d7b4","size":73516,"data":"","first_seen":"2025-09-04T00:49:32.778143Z","last_seen":"2025-12-29T13:58:58.019409Z","times_seen":420,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"9c81c3beaf90f98ca844465a7002e3f9","sha1":"6ddbbdc0cd6b49c92e369b53a70c0ce79e64e086","sha256":"36b56b4bb4fa9bad85b500d256518422d24b33749d33d98e70faae4026d27cd8","sha512":"a8a005f93401fd5cf3728852fff090519833c71539000aa3e63732878b6daf16ad01ae2a4eb5a1e1dae7afde4af219abbfdac27710c2d972d8a5640c56f2f71c","ssdeep":"","tlshash":"24217b195ee698211033703a1b5bf3443435c01b719dde013b5cc394af2896ba972ad5","size":1203,"data":"","first_seen":"2025-08-09T20:01:20.302285Z","last_seen":"2025-12-29T13:58:58.092967Z","times_seen":726,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"5281f83487c386b7836c0a61310eee71","sha1":"b69aa5eb7750fa2d18540f7a8f28dab10d4b2631","sha256":"5c4f27503b020517fa4d8a831ce6ea7c9b425cbda5603e8e6ce9119aa406cea4","sha512":"4d7ca7094121bc51fd7e24de7f2b9218624f1c7c2b5949e25ad2be53f4b1babc0ac6265a9e20acd2d51fec4e844baebdd7d1aa300a7f52f3b360bf36a8979ca2","ssdeep":"","tlshash":"5c8004047d5d50540000503014740c0d5c133c57403f0314340dcc013fd5c401447441","size":36,"data":"","first_seen":"2025-03-03T20:54:16.013922Z","last_seen":"2026-06-23T09:11:58.933356Z","times_seen":2969,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/chunk-init.1756903329400.f53cb96a.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"daffbf99400a4f119f452d48a10ea62a","sha1":"0ae2d45d2befd0f11ae9373195c409f491a511d9","sha256":"1dcfbbb596d333e200aa1b0e4e282c296f29bfafdee19ff4014fad30a394ae45","sha512":"8e39ce35d7f18deb579cf03330a935e18308541617b1a265e4d7f88480b4d29608598e6d2be86328106fa64c4d707e608f333319bd1e7627df53a0170de079fa","ssdeep":"3072:etwqhOIKENB85doKa/x5wc0dB5/J+UUknCqdnr4QMA/C:HENm5ox2Br+2nCjXz","tlshash":"ea441b98b3d171b846cb53e5622b1035f6ba1ca33098e4f0d219ea547f3168dd52eeec","size":273064,"data":"","first_seen":"2025-09-04T00:49:32.986263Z","last_seen":"2025-12-29T13:58:58.044472Z","times_seen":443,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/13575.1756903329400.cda1d494.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"60a85822cef01147878bbad7876a1fe8","sha1":"94563a78fcb76c76cce769d2fc4021baf782c844","sha256":"5b0a33a268e1507f5e758833c854e3cda700d19c35357e4a2098263a80da8892","sha512":"c23f2184349d611d1c54c379a0aa29d9564ea4b76b44c049647f0caf9e5b9dfd809c87eb9fa94c58377df9a9540580d0920802784fe9f485380985f36eaa4a5b","ssdeep":"3072:z7jHoKRKphCnDgJoec+IDWIzls+7Xr0X7:sKRBgUPDWCW7","tlshash":"42141a84764170b8c396a165322f601ae22f789650dd9c24f3789ba47f7470df26fabc","size":194924,"data":"","first_seen":"2025-09-04T00:49:32.754298Z","last_seen":"2025-12-29T13:58:57.972807Z","times_seen":438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"49bea4e1330b9d3f17c1c143ce23cb3e","sha1":"3a8874032b5979ba1fadfe141c0ebf28baa32fc7","sha256":"07f2a8f457d336c5a0cb2267f53a4be2676d30140da225305675f4b3957eb68c","sha512":"9cf0ea9cec23fb496db40aae14fe1df1a305d4a847e23a724645052c742a5995250f9d7f3f0584d3226aa17c6af04201f72cf7fca01bf4c788df2ab4cf488ad0","ssdeep":"","tlshash":"b580040cdc5544570000501014500cc57c170417453f435f750c04451fd34700007c40","size":36,"data":"","first_seen":"2023-03-08T15:23:49Z","last_seen":"2026-06-23T09:11:58.930085Z","times_seen":3036,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/theme.config.a0ea1565.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"81c0ad2c8936f5f90cc4ba2b2e53366e","sha1":"8abbe251b908b7d81c73d8537d9d144d3ded3ff7","sha256":"61e7b259016e16c5f842da901c3b2f8202b73db878acb4366eccc217a4dc0b58","sha512":"f295e613097c68b8cb8d0a2530d07c3e883ffc75fdf6d0cd35c23040f1bb182401671c0f70781b64c97db7a37fe9d6d8163de658aef95ce9327ae0068afec7f8","ssdeep":"1536:D2JREob3mtlIRM4Sb2mc42mnzyJog9Cc0hM:qStlGu1pnz45HX","tlshash":"a1a3bb7ee20c963a6177a9bfb46ce111c12e9c0cab1d5fdef13e10a25710669c831de9","size":106213,"data":"","first_seen":"2025-09-04T00:49:32.985127Z","last_seen":"2025-12-29T13:58:58.024831Z","times_seen":440,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"0ce02dcf11f1634908b4afc4e1bcc632","sha1":"f8911bd806c6ddd3daab7f3eba10081d7af38f74","sha256":"46c7be5f428c72dac25551dbcf74f494989a3cf773ff04f9e115e15ad7dc2893","sha512":"c4f56e0a143f096a106956d55a60f07405a2418d8eec9917a027d0ede74e7119884002051c598445519ff87ad5526d035c221bbcfc65ce817539e6162f157ac3","ssdeep":"","tlshash":"1901735d483748107b2225bd537f5045f1a2516f9e87cc103c1e5b00eff48a72591bd9","size":750,"data":"","first_seen":"2025-08-16T16:35:14.594808Z","last_seen":"2026-06-23T09:11:58.933867Z","times_seen":2561,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/index-a3dad144.1756903329400.268893b8.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e70d98f5d06556fb2df3ec9ecd519e37","sha1":"f15f33973e2498e949a62791b8fa6c7ff03c7a98","sha256":"7c6448354a71dab7081c1a9083e1ef15f7c59ff568fb924930620b4758169df2","sha512":"d225d0cca1709f789e457dd14df16ceda4bf4118d6c8f9db25bb9cbd5f30151e6b23d497ba51761a0eba97686323b0393dcfe43652e832dbaecc97b69bccf802","ssdeep":"6144:G4InKyBbhFOuyKO0VPoJBR58n3inyHpZolRlY1z9f7ZwTl0A+:izc90VPoJBR58n3inyHpH1z9ftM+","tlshash":"d7743b94f76cf1bd874e55be793290a4902c1b41b0c89d58d29e2944ff6b385eeb08bc","size":348653,"data":"","first_seen":"2025-09-04T00:49:32.964012Z","last_seen":"2025-12-29T13:58:57.98751Z","times_seen":435,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/21954.1756903329400.57c97863.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e2c9f0777c63b333fc66af020ed0ef8e","sha1":"72714b7bdf899cc87c7399253e37aaa2a2f4487e","sha256":"0a2a1939d88947975b56974be20cb84a9c00f3c94cae6e057836b39aaf6b8c41","sha512":"fc02eb76f16f16c8a7346f72e7ac7ef4a68bca53cc7a5bb9f1e00b43f1bb002ca7847e2804be7d6bfe0713c3466210038acc4d5794bea5bec8f0190135f3e7e0","ssdeep":"768:DBPsaSfmzKrMdvf0eMQ/96loumY1PI1yBK9LudEz+yUy51y9y0yk6Dio+ILqpTeY:DP81R6Ipyk6o","tlshash":"0a132088fac2b06dd3eb7330857f505ae66a1dc0668c5438e260d6917e7198dc1fb9f8","size":41968,"data":"","first_seen":"2025-09-04T00:49:32.704767Z","last_seen":"2025-12-29T13:58:58.045079Z","times_seen":433,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/chunk-svg.1756903329400.5bf5ebac.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"7f3450cde65c4d0964dcc6d243a1656e","sha1":"ad5b362b491b71dff95398219d8e190c80650865","sha256":"924472178572d451953cbf73efcf577a697b3102176fc17d9ab8c379b6b37bee","sha512":"e8f2350a17821376b71a040626a3d5c58cf5744b22d512fbef45b3246558b0f7001ca4d48d32e34831ec7750e40008f7aef529b4e618c6770bb5e72e4c028cd2","ssdeep":"3072:38nz2uaLZSZvx6Q/sIPrekK+m36Ua94sRZI7gbpU:38nz2uasNxpXPrekK+m36UHsE4pU","tlshash":"7aa4fcb4c190f4edf704ce196e7c9e1c50321688e0a9e9e52da9fe0d9e85d6b241cdec","size":461002,"data":"","first_seen":"2025-09-04T00:49:32.781171Z","last_seen":"2025-12-29T13:58:58.073596Z","times_seen":441,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/home.1756903329400.bfa8c420.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"caeef6f42deb46a855ccb60a2ed5b445","sha1":"13594059c305a13f3f001270017ab9aaa21443c2","sha256":"ede9bdf96f357afd7f61662fc1654334932bdf9d3e0ad7e9581a792bf2912530","sha512":"0f28cdf6693505cf9c674caa54a226cb16de87aead1b75244f3c6e68ee5d206b133b3e5f081aa9a1db2b285e8ac607f1a1a289401afb0b6404b3e2865d0d9d03","ssdeep":"3072:f1E8oNSIMrtwsAFJBuokQvFUqlGSBJZhxffj7TEOiGRA3:f1E8oNSIMrtwsANKUFHzffjAGa3","tlshash":"c3040880b5f0e275575fd2bbd7371024b22b1686d0ccac60e1f66b187e18799b236db8","size":186713,"data":"","first_seen":"2025-09-04T00:49:32.93504Z","last_seen":"2025-12-29T13:58:57.964054Z","times_seen":424,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.u52j.xyz/","fqdn":"www.u52j.xyz","domain":"u52j.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"b6a1fdb7ed84d21acca6342934b5f901","sha1":"ce783195b5cea5b0e1168babbf7a0e2ca2f88acc","sha256":"77244349fcc5d1da869946058a03515d3c9734f7866060c9a3e479e1b57cddcc","sha512":"54483adae7f23b88ec493f3a59386d809778d819f983611e20683c661143a0a4924e26379f6237b0ce0a68ea7bc531afd19d3addc13e6370597c3b35ff8a1109","ssdeep":"","tlshash":"ede086f324418a7056fe325bab23b7553d2250c73e51700540185c51a12cf8bc63ee99","size":321,"data":"","first_seen":"2025-05-07T23:01:39.8276Z","last_seen":"2026-04-18T12:05:04.237348Z","times_seen":3235,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/52388.1756903329400.521cb32f.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"cdd31eb0b7ccfc1eafcead314123dfda","sha1":"2bd4708c1e30cebc08cdada8ef890baec6ef8622","sha256":"669b207d5cf11b0e229699f6e54104836b252c5398e20c4bb564b89b2525f0a2","sha512":"9c48059df23c4a9632eed22a28d883786e40c593fe3ffddb9144fbca21a45322121e36580084fc642e9058f086d3657d819f5d2b9528a91633aeb2085cd5ff06","ssdeep":"768:f9Vl3u/ffsp3aNWchZ4IIATAJ016fkmD19mprq2xd7QjDv1gyT8CpYCVc5WsNiU:8308O1cq2TlW0","tlshash":"84c20a80d6b4f5fd636ec9ab8a3a8464602637c5b0c8ace095ec6e8c3d4475774788fc","size":27418,"data":"","first_seen":"2025-08-29T11:05:53.257205Z","last_seen":"2025-12-29T13:58:57.988641Z","times_seen":422,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u64p.xyz/","fqdn":"u64p.xyz","domain":"u64p.xyz","tld":"xyz"},"ip":{"addr":"110.42.43.240","port":443,"asn":136188,"as":"NINGBO, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":true,"md5":"b6a1fdb7ed84d21acca6342934b5f901","sha1":"ce783195b5cea5b0e1168babbf7a0e2ca2f88acc","sha256":"77244349fcc5d1da869946058a03515d3c9734f7866060c9a3e479e1b57cddcc","sha512":"54483adae7f23b88ec493f3a59386d809778d819f983611e20683c661143a0a4924e26379f6237b0ce0a68ea7bc531afd19d3addc13e6370597c3b35ff8a1109","ssdeep":"","tlshash":"ede086f324418a7056fe325bab23b7553d2250c73e51700540185c51a12cf8bc63ee99","size":321,"data":"","first_seen":"2025-05-07T23:01:39.8276Z","last_seen":"2026-04-18T12:05:04.237348Z","times_seen":3235,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/45540.1756903329400.c33043f4.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"000be9e193b9b0e7a8e7e2fc6a908605","sha1":"1f04ee0d0816dcb4a310f1bf9053f36c15561922","sha256":"0968ff07195a9aad5c3f080a919c803c162ccb3bb176330b762c1e4e884e75d0","sha512":"d05ca2e4dbd262beab20be9f7872c1faf4d88129b59234fb2009c9ecc7114341558d7813d701cc5aa54dfa4ec028ab007eeff864ac6bed87a4ed8d42499954cf","ssdeep":"6144:rYD4wFsYiSGfKnCKPP6Xm9sm3MCln1OSgpozfEe5a:rYD4wFsYiSAKNH3TY5","tlshash":"2b24e894f294f1be075fc1f1d23b501af35b5e6120cc9ca0d296e6942e20b49da77eac","size":229352,"data":"","first_seen":"2025-09-04T00:49:32.837166Z","last_seen":"2025-12-29T13:58:58.015173Z","times_seen":439,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/64369.1756903329400.27cb8135.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"ce99014ab42559bc99f808a69bf596c2","sha1":"adf52a59aba8080dae7b97585e346f5aa782141f","sha256":"39076e64a0e5facd6f6f3d4db7f7fa71039c87d4a6250298dd4bd3059bfd9863","sha512":"ede23f1e36658737f40782ab61a166f1a2a6f61957524beefc283035c39337325c487d6236975bd97cf44aa91b31ed6985a3416ef561edd5b977ff02fb6b1b54","ssdeep":"3072:cHW7tB4Vgj5tNlxyU5YegxYffj7TEOiG1Zl+DJVkzEcx1nKR:cHW7tBwgttXxyUtffjAG1T+DJVkzEcxE","tlshash":"6cf31bd4f2c070f6475f45f2a22b1075b26f4d92318c98b0e15ba6597f21a48c7abeec","size":158174,"data":"","first_seen":"2025-09-04T00:49:32.946075Z","last_seen":"2025-12-29T13:58:58.086406Z","times_seen":434,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/index-399e2569.1756903329400.c784c4ca.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"6117cdb5accd41ccb0125c70452306f1","sha1":"80f85cd8a495c476087fa382198b2a06f5d309ae","sha256":"794e522144c7d6885ba07f4654bbf62f0b06f1b985a897645092cdf029afcfea","sha512":"1737016527bd862c7804e4dd164e109c7f3a087b5c0a751764c22f8b2fa9a10f4fddb8f98234d4da33eaf7a314648d28eed89c0750dabf2006ee105b6f8a2cc8","ssdeep":"384:EZSANHLDaxKalO7PT/Wy4QfHhwrxrjgIhK47ZyQQvXTcdw5F3oWf0Af/nqxtU8X:HYDaxKUO7LZ4QvhwVEMKUZpe5FYxAfPQ","tlshash":"c6b2c6e63392bda4c24f9276f33a58ecc53f9241c30fc4f8d265bdd47da8644a992684","size":23421,"data":"","first_seen":"2025-09-04T00:49:32.717031Z","last_seen":"2025-12-29T13:58:58.089613Z","times_seen":434,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"bc8a294899b949ca9677d96ab1c49745","sha1":"983c5ec164a83ee42e930da5b41946e6b0884dc6","sha256":"1f235d2a99775c3e5208abb2a05db1d9b6da61997a61ca5f7acb6ecb63caab29","sha512":"544b86acb0f595a5b12b887d5270444b63e23af877db68c8bce9ee5c66b37de75648eb9ea0757f899dba25f6376013beb278c9c8f801674f8886ae4368264e6f","ssdeep":"","tlshash":"4551b16d856684711db3346d2b5fb34835b340a36149de113d4d8f802f6895e82a6bea","size":2590,"data":"","first_seen":"2025-08-16T16:35:14.597318Z","last_seen":"2026-04-26T06:01:10.157524Z","times_seen":1785,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"3d053d2da6a5968d7b648d3f7360092a","sha1":"32ae5713edeb00288a3f8f3c02462a5d0ca9dbb3","sha256":"8896d194e4c39e87f52924073dd2d56b4aaab46fc9f7c56a57534545eef1d7f3","sha512":"01f9b63cd24ab6e0e097637341b78cda657192f98e37a39f0f75548f8fe0180418a86594df76858aee7d514282ac4dfb8263e1729ff325035897b841d09206a3","ssdeep":"","tlshash":"82f0a00e0ee548131963707a4c0f9201203b2513414eea08bffe9bb24f92a688a679cc","size":550,"data":"","first_seen":"2025-03-03T20:54:16.018132Z","last_seen":"2026-06-23T09:11:58.931662Z","times_seen":3033,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/config/initGeetest4.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"4b773fe272ef2f3dc7c7e443cd8a0e98","sha1":"8f81f38f03c362533ba34d119215bf83b7574ed1","sha256":"9bb8b869af3ceacb9261dc2cb9165d2716b150bc35ba9da63dd23674fe0773b0","sha512":"e0539af0bc1ad92c1799b6f5c0c759a68537b8063730bd0577aec9f7cf620d34cd166bd5a15c25d89cad49d80f51938b6072c4aa27d07f010e6aaa83ce6e3c5d","ssdeep":"192:hN3ar8HuCDoNu5dq+ExNiqc4K25MB5VsaiQxta4SScQVy8QRHIqaawzjTki59r8Q:fJe61XHlii5aI2PG4lyUIVKQTwwPlB","tlshash":"2562200d68f750a35553b43c8b9f6014b5388a93041cde41be9ce394af9843d9bbabdc","size":14854,"data":"","first_seen":"2023-12-16T04:09:07Z","last_seen":"2026-07-06T04:48:18.66713Z","times_seen":2858,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/31098.1756903329400.4108b3dd.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"215815c091a19829f9fd6e5f28039f0a","sha1":"8ff2707b0ab4498bfd2bb7f99674b5a245ecceee","sha256":"06371440853645a0532df5edbbfd5c9e9661bec969aabc25b3353297c6f6574a","sha512":"34933b0388cddca0826af79fdd0f82c31c1264e87f004cd921360b19dc83a0ff188ac52a4de89427cc1c09f2785179fdf4d0ff7526d4a74a55f7971fa2738e9c","ssdeep":"1536:Ow+0YvC9jlTKAUSseG1SY46DCdlBBo3AgXOG9AsqCfCXsvCfCXsLCfCXsyCfCXsf:O/KK5sY4brG7O3SnLJNpL","tlshash":"1574b6f4c248c6fdea04ce0a7e7d6f2d50723783f2ec96c446aaf8865e91857245c4da","size":352758,"data":"","first_seen":"2025-09-04T00:49:32.813984Z","last_seen":"2025-12-29T13:58:58.029423Z","times_seen":409,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"2558541837b83dea0f1c8ac757de88d1","sha1":"73dc5d3a5d36b0d2f64662712b98ed67d38fa7eb","sha256":"c39e91ac138a222cb7b8c2cdd75880822c57543218803e85847fbc402cd58aef","sha512":"6bc2837169d8c2a6fc06110969305fa31b87bbc31cc683d0e95ab2eec28606e623d1e07114f031e73419231c41bee11bd93dc8673f5b548a711aa28921fd9177","ssdeep":"192:KQFwqx5Cvtib5XOQRzlaECoXZTAoV51nsPhwzvBa/id3+36a/E/97g6I52MdobsN:K2VwiYwJvSoVXsp+pa/iZcVk97g6nMu6","tlshash":"1c322a69a6b71bba24673036277f301889b080630319fd957c0ff61e4fe54256297be3","size":11820,"data":"","first_seen":"2025-07-24T23:59:52.586926Z","last_seen":"2025-12-29T13:58:58.105973Z","times_seen":599,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/45734.1756903329400.46beea1c.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e5f34b5441b6b582d6d469c537f6f97a","sha1":"defd5aad4e0d066131c97173b21b7b3442cdb951","sha256":"44db08eec9e6d649f62d7d208bce223e33424ebc58c21098181a90ae5a1c6437","sha512":"4096ae8bc07709597c8411157950bea75aba46cee36964fe1e280a31a2c2c9d4a8d5821c3e8a4cca552919511930bc9f834e2054580c452acc17c1011d1e6168","ssdeep":"6144:F/EFTU8Ra90Jjytg7DiQPkcsz1h84faSDWidmVHrqZL:9y/jytgPJP484fa5VHryL","tlshash":"2a441c84b291f0b4879b42f7922b4055a17f48a130ccacb4e2a5ed90be7555c927fbfc","size":277026,"data":"","first_seen":"2025-09-04T00:49:32.926111Z","last_seen":"2025-12-29T13:58:58.062377Z","times_seen":438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/chunk-common.1756903329400.8e9f70b3.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"1b35e779a9012cf73988d1d4b0d9e5f2","sha1":"c139c75aed4b303657e5a48a1fb036d7fcec6533","sha256":"9231e7c73c53eeebd2a055dc9c7402342f21053dbbbdd257be62eaf29c98fafa","sha512":"53ab4c8aaf4fb2bd81c55c7356348b96d509ee4f2a91869043061c8b6ffac404ce76a6ca57caddd47e94dfa5e821a3e6a85c969cc94675fe8625cf44d689c05d","ssdeep":"1536:6ZVB2bNNcdWUc2UTC6oryXHuLmbErF/G7D1dMI5MHLui7TAN/voVG5glVbGD3tFZ:6ZVBM/TC6yjFecHLui7T4/voVG5agD3t","tlshash":"73f3e8c5b3a0f07e9a1ed53779331499b12f758274c87c60f1a1ada6bf19708a436ca8","size":159516,"data":"","first_seen":"2025-09-04T00:49:32.82259Z","last_seen":"2025-12-29T13:58:58.058135Z","times_seen":438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/17600.1756903329400.89772027.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"537a1190cc025f0707bbb2a736630283","sha1":"1ac2e221c5e4e26737c6e1b7fddf2d363e4b65c3","sha256":"296f9d35557dc9588e8c6bed7134ca0e3055473306531756660582a6886bfedb","sha512":"3202114c8afb764ea0c4cd32bd78e7ad51295face85601b71b7316535d8fc29ecfb314bc1ace4ff0f54ef46a2016d09e764078ea1d7bd08ae75077ad6eab2341","ssdeep":"1536:+D5AxGst7xILpT0iiRs1vE/yKLJdLI065veGiHjLFIEfma5/xY8SbF9JiNp/QQbU:+DqxNfns1v4yKMpBesDz7+I1ou","tlshash":"d8e32a94b380717887a743b5b21f5196d22a08601098bca4f26eed94bf749ddf63ecdc","size":152171,"data":"","first_seen":"2025-09-04T00:49:32.979776Z","last_seen":"2025-12-29T13:58:58.065817Z","times_seen":421,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/64906.1756903329400.e9e9ec75.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"18789db02e1943b9b6e2a4bc1db4cc9e","sha1":"ab3db8b123be3580e4d5198c5ca7b99e0cd00d4a","sha256":"381bb6518856ad825c2e3fa1ec233fefa0ef52a11dd2a2dbca840381687dedb3","sha512":"6895a97c1c487d492779c4d0166bcdf0599a8634c8af8c051b573d84f001b730738eb8194f5edb5ca5eebff733289c293cd9889ea0b373330a3d9860cea872ca","ssdeep":"6144:9MhEyLkbLniyyeBHlBfb08rzZAncbtiTisXuLCoSltnIwb/mmtMDj0Rts:9MhEyLk3niyy0HlBfb08rFAncbtiTisY","tlshash":"3b241b94b690b17883bf85ff7224a164e24e1f9860cc9de4d26e2b407f12706b8775ed","size":217749,"data":"","first_seen":"2025-09-04T00:49:32.707517Z","last_seen":"2025-12-29T13:58:58.048456Z","times_seen":418,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/configPage.js?v=9/3/2025,%2020:46:11","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e6aa74bb352ef198ba3e1c9a4b01b014","sha1":"2ea8bd6b5045475a36432f7665a129728e822d9e","sha256":"73828e873c0b6e847b37d78941ca436247471dfc90a12f743964f869f75abd5c","sha512":"2faaf24fdf1e4da637af8e9f82d1778bf061b00752dfca0c8f73432ba236a7b69410a7ad2a73727bc83e6cd631fd6555c3cc0d9d3a5d8a7f81818dd66566011f","ssdeep":"","tlshash":"be117aaf57444dffcf1d7e00a08b0a5ea8bc61d261889d4da8e9cf29e1c99002378978","size":949,"data":"","first_seen":"2025-09-04T00:49:32.949926Z","last_seen":"2026-08-10T17:58:48.47216Z","times_seen":2885,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"37cda9c8bd90ed9eff421ef541ce8c9b","sha1":"10e30e7f37c9d3f9047b454674e5bbd39325c17f","sha256":"141be120131ffc192dd677c685472431beaa361d4dd03539f79d814cf1434cbd","sha512":"02044fab2c82a7e34f9c9cd65fec0c8f4dda3b52170d846bb908d40cbc34d719d33b1586be421dbdaf4085c442760a8f1f0db93a5e0a9d3ae7d38d5b8072d106","ssdeep":"","tlshash":"fa11cc5a59e28132aa5b302735bd43887728a023d144cf423dcca955bfa8da5cabf6c4","size":923,"data":"","first_seen":"2025-07-08T00:41:53.041569Z","last_seen":"2025-12-29T13:58:58.107019Z","times_seen":628,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/home","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"u65r.xyz/img/no_data.02e9590c.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.871Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /img/no_data.02e9590c.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T02:51:57.151416Z","times_seen":17879698,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/fonts/DINPro.9ee75b04.ttf","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.994Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /fonts/DINPro.9ee75b04.ttf HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://u65r.xyz/css/61540.1756903329400.030a612e.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: application/octet-stream\r\nContent-Length: 119892\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nETag: \"68b83893-1d454\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 9C0EE4F3-64DC-4DD6-A6D0-EA8DE9425C03\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":119892,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 10 tables, 1st \"OS/2\", 30 names, Macintosh, 2005 Albert-Jan Pool published by FSI FontShop International GmbHDIN Pro RegularRegularAlbert-Ja","md5":"028cefac160ed3b006f47106fbc68d1c","sha1":"efcecac09684435facd7397e4f6163a5069802c2","sha256":"fb841a09a82787982ad1774bdeb45e8e06ff4909161a9ce33fd42f8822c5ddc3","sha512":"3a5a284d0c4da6593b857ba785a4ba7d5f2e2b73d22a2ef25435b9558063d2486228d76a3cd5d3a59b5abe4c0da696a75373111b3569a94a9dea1516cf16091f","ssdeep":"3072:YhtN/CZnt1tbtKtHtFNgz1QZt0tbt2ktwtNstAtqNaEctWpy8TLtsIb66AUeo:YhtNGnt1tbtKtHt7t0tbtxtwtNstAtqV","tlshash":"5ac308c153e8fa4ad83996388511c7434226ff2de65d4f36ffd94d8c688e8e9064e6e0","first_seen":"2023-05-08T18:58:40Z","last_seen":"2026-08-12T08:19:06.4043Z","times_seen":5602,"resource_available":false,"data":null}},"time_used":451,"timings":{"blocked":213,"dns":0,"connect":0,"send":0,"wait":213,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/2302128d758e1ff3f488493a3fb6d052a6b3e?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.607Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/2302128d758e1ff3f488493a3fb6d052a6b3e?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 13178\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1811410\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"2302128d758e1ff3f488493a3fb6d052a6b3e\"; filename*=utf-8''2302128d758e1ff3f488493a3fb6d052a6b3e\r\ncontent-md5: vtmcy8dfJbHCerkBbI7p/Q==\r\ncontent-transfer-encoding: binary\r\netag: \"Fna-hYupwCg1b3bkWoylRqB-a9sr\"\r\nlast-modified: Wed, 06 Jul 2022 13:02:04 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-25;QNM3\r\nx-m-reqid: aXZ5V2yfY\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: PJQAAADaqkXjv2kY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13178,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"bed99ccbc75f25b1c27ab9016c8ee9fd","sha1":"76be858ba9c028356f76e45a8ca546a07e6bdb2b","sha256":"60df905fb19e9d75761b325f5ccd73d3cc5181bdcaedcb9e4135743e8b5ede29","sha512":"ea93f418ab375bf0553dbd32184fafdfb6a8373057702844edf987ceaf5cc4a79d374f5efc0985321d9c6282356967a257beaffd9cd6f7332d73f87e8cc3a26f","ssdeep":"384:9AIrshi12rHc8+O3+oHUk+LlIEvckp13TTtAWau:shi12A8+yb0JLlIIVH3TTiy","tlshash":"e442d0d3b289e727e43e222f1b907407155575caefabebc56dc3e7281e83084b508127","first_seen":"2023-07-06T07:05:29Z","last_seen":"2026-08-10T17:58:48.224628Z","times_seen":209,"resource_available":false,"data":null}},"time_used":3174,"timings":{"blocked":937,"dns":0,"connect":0,"send":0,"wait":837,"receive":1400,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/10305f9ef365617f04c2ead6ff988038d7ff9?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.625Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/10305f9ef365617f04c2ead6ff988038d7ff9?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 21348\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 252666\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"10305f9ef365617f04c2ead6ff988038d7ff9\"; filename*=utf-8''10305f9ef365617f04c2ead6ff988038d7ff9\r\ncontent-md5: 9aNkvwE+TYJF3HRP0M5DGw==\r\ncontent-transfer-encoding: binary\r\netag: \"FoovD6vVdag3mRta5uvIw9YvfUzX\"\r\nlast-modified: Wed, 06 Jul 2022 12:53:56 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-9;QNM:fn195;SRCPROXY:fn270;SRC_***:6/304;SRCPROXY:6/304;QNM3:7/304;QNM3:39\r\nx-m-reqid: Zsc9iDCTN\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Validate,Hit\r\nx-reqid: pbIAAADMG_haL3AY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21348,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"f5a364bf013e4d8245dc744fd0ce431b","sha1":"8a2f0fabd575a837991b5ae6ebc8c3d62f7d4cd7","sha256":"494f7641be91251fdaa0448b032866e47020ed8a33dadd664f6389eb49761da4","sha512":"206c962396e1eefe6d1bee1bab76eb920cfda37022dc1dc67feab1be42eb7845a8fb88d597983ac187ca7635f62afb9651f78a02b6d44bd56bcaab83f91791ff","ssdeep":"384:Xp3muJfuYYVfxmeXJTjNXWwxX4p3xS9wGrZx+L0xFP:XtRdDq0YTBXrZ5wGdx+LGP","tlshash":"77a2d0da44924b3a240d63f453e39e1e02a99233f7ffcc550a3c7a32147f265d3a6169","first_seen":"2023-07-08T08:51:57Z","last_seen":"2026-08-08T12:57:07.001123Z","times_seen":315,"resource_available":false,"data":null}},"time_used":3159,"timings":{"blocked":919,"dns":0,"connect":0,"send":0,"wait":838,"receive":1402,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-21T12:30:02.001Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:03 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: public, s-maxage=600, max-age=0\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049803=N2Mzwq8fLWQhe5PvbYJKnT1J9Jk9QgjpDkS98sT0zMkxLwtxh6uDYKsuHHgZ92HdOrvsCoOXZCeUHdYDG4WOFi8shXZ1ri+iElYDeZ1akQ3cSi8Vkg1DM7B53M3dJgpaHf6bli/J85KwiwvgYpuXBz3LFDvFlDARwGqtVF2qyuwPxvG8f0dCKPXCjzO5DnCS\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: 48D5C2A9-E973-4F39-A7C8-3E2D524AD061\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23624,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5777)","md5":"87588e90bb24e209460bdbf1bcbcc074","sha1":"f3c57be16a0eaf6879f3469c6a2db7720a699832","sha256":"61ed38427305a473065294efb15ef101340cf9d3e19be35a6c6c86083698c328","sha512":"160c240e67f56096c7c519eeb5b11bd9fcac971ffbdaecd231be6aaba4f98a1dbf5f44a22c0edfbe64860e3039a11eba5be0eb13802c82e7033543d7891a8e51","ssdeep":"384:kR7B3v2VwiYwJvSoVXsp+pa/iZcVk97g6nMusplliz:kRdviNYiKop/E6wkpcu2lUz","tlshash":"9eb2292e8df349762523703a2bbfb208797180134309ed803e4de7584fd59aa46e7bd6","first_seen":"2025-09-04T00:49:32.720758Z","last_seen":"2025-12-29T13:58:58.052747Z","times_seen":445,"resource_available":false,"data":null}},"time_used":2426,"timings":{"blocked":982,"dns":426,"connect":272,"send":0,"wait":254,"receive":208,"ssl":281},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/heying.d446c85d.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.814Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/heying.d446c85d.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 1425\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-591\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nAge: 101403\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 9798FDE7-AB27-42D4-BC03-B20ECA0A245E\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1425,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced","md5":"c0d0c516850381dd1ca39dd94b08f21b","sha1":"54522affec52debd9c0bd3784f0ce9bf692f5d6d","sha256":"301cbb9a8c3fae88d732c8b8fdfe40113e3257831d37150e95564cc0f9b8fbe7","sha512":"6d6b1263f2de2b35237c784fd0aa127c469f8b6ebf347ff1987d791611d5b36f0909f3a81f9db6b1571756ecae60454d854e776e5ed782acbdfcce4fda2b9c86","ssdeep":"","tlshash":"dd213b5023742cd0e8ae3457ef12e5fdb823417994f8dd0c99b9bc3e84908b1057a48e","first_seen":"2025-09-04T00:49:32.953523Z","last_seen":"2026-08-10T17:58:48.227911Z","times_seen":2285,"resource_available":false,"data":null}},"time_used":606,"timings":{"blocked":400,"dns":0,"connect":0,"send":0,"wait":206,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/563fdc4de0035b25c736c5da77e280df.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.594Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Sep 2025 14:31:39 GMT","end":"Sat, 20 Dec 2025 15:31:26 GMT"},"fingerprint":{"sha1":"17:3D:A0:9F:DE:47:81:66:EA:33:3D:E8:54:E5:E5:AC:9E:D3:7C:A0","sha256":"22:D9:7A:16:0F:64:68:7D:00:46:B8:BF:15:6C:E8:BE:57:96:C2:BA:12:A5:4B:90:48:16:F4:58:C4:DA:9D:36"}}},"request":{"raw":"GET /202/1/563fdc4de0035b25c736c5da77e280df.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 1093\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"78255438f1ea1d7465790e559065949f\"\r\nlast-modified: Tue, 08 Jul 2025 07:13:16 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, accept-encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 18707459B8AE989A\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: max-age=2678400\r\ncf-cache-status: REVALIDATED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JVRzQjmTYnXLWQxMqSPFOmFW0TD4E0XUU3JT5IR2YuCZ77jIC6PwkBZX7BxMJKKvML1BQtHdCE3XJxXiaEJxIeFuPbi09ICDPMEB7AGwFieb\"}]}\r\ncf-ray: 9920c3b1bde35fac-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1093,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 4-bit colormap, non-interlaced","md5":"78255438f1ea1d7465790e559065949f","sha1":"8745d06e71f69bc3c9f7b137ec85db7c82576069","sha256":"881037144fcb344c04c3064a18654a4790ead950dde5243ddfcf2ed034b97893","sha512":"4b41aaece3ae536f83fcb0847851d22013a5e890af15c5263c73752475d6802a8a18fbca3c80b1a07428c163f6a74b57c44e39deedf1191a7e7176528e61dd4b","ssdeep":"","tlshash":"a411f95c27975c4dc8033de315b6ee22846abf7a64f01ad774743521a0453a5cf84249","first_seen":"2025-09-01T05:05:19.800028Z","last_seen":"2025-10-21T12:48:58.410311Z","times_seen":9,"resource_available":false,"data":null}},"time_used":943,"timings":{"blocked":-1,"dns":30,"connect":1,"send":0,"wait":835,"receive":0,"ssl":75},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size704x442_73525908-fb7b-43df-ab6b-ee9a1274a74c.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.699Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size704x442_73525908-fb7b-43df-ab6b-ee9a1274a74c.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 223136\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b9HpxqeuWJv2yMemvwjNNb7wTaaMlPwBCNbaK2RBVErmhMeGhqI%2Fh13EIIqHv%2FGVSpTbg6mMiOwcOvhaO%2F6WjRH6b1p1KRknc8W7VN4vQJLZ1n%2F0QclWczre3yCO\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"da3b1020a9a2b09010b291184754a369\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:13 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189678\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacec1ada10a3-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: DB582C07-9F0B-46F0-9B3C-A20F3E907D7C\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":223136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 704 x 442, 8-bit/color RGBA, non-interlaced","md5":"da3b1020a9a2b09010b291184754a369","sha1":"c2d83f8c56c6e87dece5c934a28ca227ae094d48","sha256":"14b50178eb3b3f008b02476fee254dfaacb43181b760be8d3a1c7e5ff5401dd4","sha512":"3eeae26ae8746f3dd69d1640b0a791149692ef83b86997d98f0152f98376e931637a574bd82110c7765be51f0184bc8e33c9d04659f510d51c47b1bcc7be2059","ssdeep":"3072:c7iZjMzh8mXTYQ/tDoXB0TX8jLwAqw6Gw/mS5xr4OMWf8SG4DcXtHRpf7JeOrrUS:miZjMzh8mX02lo28vwAqVGoxreZHfl","tlshash":"80242397c71e3ebfe8a25c53b962143e66328042ba0dd4f85cdd14b6b12b1f50ca8d5e","first_seen":"2025-08-29T11:05:53.247777Z","last_seen":"2025-12-29T13:58:58.050217Z","times_seen":297,"resource_available":false,"data":null}},"time_used":2228,"timings":{"blocked":1729,"dns":0,"connect":0,"send":0,"wait":256,"receive":243,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_7cfebff3-4c66-454b-88d8-9c5d49ce282f.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.722Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_7cfebff3-4c66-454b-88d8-9c5d49ce282f.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 117557\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9WoxudjL%2B0ba0H7gGf%2Fj0oASCH6aEiMdSlM8ql%2Fw7747rUcfa2SxiuAfT7q4B%2BMeog2TL1yh%2B0gzkA9lCyT3qN%2Bg8ILdSjy6xGeht18bfqyfGBCVARUZRnVMxD6s\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"9e83fca5814dc8c6f5216ddd2954753f\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:12 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189686\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacc20e78852e-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049810=8XOhqPYzNvtuGG/4OcysAi/9c1Ix5YgXavBiBH6qc9bjm9WqeG2yII9Rd1CIWAUKAG0FxykRuvJXzDnxMKqk+rS68KDMASNbTzkdswwt4XDucm6b5py1vQ6G35la3BMmWsZTXXT6A4L15Kx99KWkHMnTvjv0qUeu4ZUmFH0QFz5BQ+0r3VTY4mBrhnaqQbQB\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 6723B51B-96C8-4EE4-95B0-43C02144FA9E\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":117557,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"9e83fca5814dc8c6f5216ddd2954753f","sha1":"195e8e55b3695cadfbf008fc564f3db6f7f27138","sha256":"96381a09b2d57a73d12bf13159486d928265ef0fcccd68de29940e0f9b9cbf75","sha512":"58299782fe35d16deacbab30de671c3cae7c084f870d903256bda214a89a74b2cc3b50c2723eb4ef5d4e5b2fd42664aaae657f58bd494ad973ad4f65feba4773","ssdeep":"3072:SfajIRE+wUtta+B8lNSiRcaPiWjb8XfOOGnZ:SfWU/B8lN8e+cnZ","tlshash":"07b312d338d322eac968d1b79ad4927c6552f300f66ee12a13f1e4671c9b4a134317eb","first_seen":"2025-08-29T11:05:53.335758Z","last_seen":"2025-11-06T16:32:28.486517Z","times_seen":217,"resource_available":false,"data":null}},"time_used":3275,"timings":{"blocked":3015,"dns":0,"connect":0,"send":0,"wait":254,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/bj2.a8fabbac.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/bj2.a8fabbac.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://u65r.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 360604\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-5809c\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 101404\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 5EF49F8D-F50B-4365-8A42-9BD74759A209\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":360604,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 641, 8-bit/color RGBA, non-interlaced","md5":"e0fe8ffeed1841f74df53c3b0c1f2db0","sha1":"77bf6dfe664cdc936776654af151f49368479ec3","sha256":"db4d87e8a403e388c54dd5d114b738c82e1d2dbe65b95630fd5782179f0d7d54","sha512":"825bf73262c2b613b6a8a8397f869db6b2cd4118e554689d228503e7a04c4e674d49c5649e4ac8e2423a7b526c0f6621c259566d0e9bb6ebfa0712a7352968fa","ssdeep":"6144:iAHwIFRCiRIygxWS9v34xfZzuwbIYGzl8BPp0eIiOk3Fg7la6RUIs4pU2:rwy0IgxDEfQwbjw8dpmiOiFgpLHFU2","tlshash":"2874238d711d48cc9c9b45003dd82d9e1c55aa2f7aab20b58264fed24d17ddeec0ea3b","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.55439Z","times_seen":2546,"resource_available":false,"data":null}},"time_used":1743,"timings":{"blocked":1116,"dns":0,"connect":0,"send":0,"wait":207,"receive":420,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/15323abd0495f640b47559c7c29a32e115692?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.528Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/15323abd0495f640b47559c7c29a32e115692?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 9437\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 173267\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"15323abd0495f640b47559c7c29a32e115692\"; filename*=utf-8''15323abd0495f640b47559c7c29a32e115692\r\ncontent-md5: oKpul9Qa7P3CYddTl41Pxw==\r\ncontent-transfer-encoding: binary\r\netag: \"Fo3R4O9wobvFBP7vyYT7xDy3b1aK\"\r\nlast-modified: Wed, 06 Jul 2022 13:04:15 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-20;QNM3\r\nx-m-reqid: QHJk0wDQ4\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: spcAAADOC8uXqm8Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9437,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 302 x 329, 8-bit colormap, non-interlaced","md5":"a0aa6e97d41aecfdc261d753978d4fc7","sha1":"8dd1e0ef70a1bbc504feefc984fbc43cb76f568a","sha256":"141c6269b61ee36038e548f5715f2f162043541b748220537049b65dddbc7f91","sha512":"c44acc54b9e1cd869c992699672b3da7d62a8dcadb369c5181580f4af1b2d1a9572755df38a5cb6b74698a559980694e67439ada27c067a08fc282c671ddc4dd","ssdeep":"192:EQnnnnj9aAEgZoLidygxtnPQn2VZ2mEQlLMgAflON1mbxyP90KX:EQnnnjANmoudy8nPQnmzEMMgElo1mVA","tlshash":"d912aea581b19d314ea01afd46a213e6764f67d8f1071c0cd0a92ce9e2f9317caaf50e","first_seen":"2023-08-24T20:41:52Z","last_seen":"2026-08-10T17:58:48.255596Z","times_seen":183,"resource_available":false,"data":null}},"time_used":2970,"timings":{"blocked":1014,"dns":0,"connect":0,"send":0,"wait":837,"receive":1119,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/12210b9f7de7394ae4bb398f2b59d9272e348?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.570Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/12210b9f7de7394ae4bb398f2b59d9272e348?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 20930\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"12210b9f7de7394ae4bb398f2b59d9272e348\"; filename*=utf-8''12210b9f7de7394ae4bb398f2b59d9272e348\r\ncontent-md5: GRW2vq/G4Yvjui4XH6HV+Q==\r\ncontent-transfer-encoding: binary\r\netag: \"FrIvx8BTengQrZWGlmvBBdpQwW2j\"\r\nlast-modified: Wed, 06 Jul 2022 13:02:29 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-1;QNM:fn229;SRCPROXY:fn271;SRC_***:22;SRCPROXY:22;QNM3:23;QNM3:37\r\nx-m-reqid: OazpXAnI3\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: fF0AAAA44JB7SnAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20930,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"1915b6beafc6e18be3ba2e171fa1d5f9","sha1":"b22fc7c0537a7810ad9586966bc105da50c16da3","sha256":"05bd6425b657ad0327b886c680918756e47981141220cdd082eaff31adb32881","sha512":"b86130366a1a1b800b410ec90994a2827cd5a98564137e6bf6040fc86545dd203998770295c3bde6c5ef66733b072f18470cbb472c5d312074cc236bb1e4b0a0","ssdeep":"384:g2Cysq6ZvgvI7IMsSXNR42b2LZUcuqSI7INnA6Pwv2oK:pMh7bZdR4q2ac/SIMNnA6PW2T","tlshash":"ae92e1694114f0d00abe87bbb90e2340763adc5c1bfe4e532ad06db5161ca5b54e1fec","first_seen":"2025-02-04T17:13:01.023819Z","last_seen":"2026-08-10T01:11:53.649476Z","times_seen":356,"resource_available":false,"data":null}},"time_used":3205,"timings":{"blocked":974,"dns":0,"connect":0,"send":0,"wait":837,"receive":1394,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202506/_raw_size1164x872_0e80d399-2c93-4f64-89db-61a96d3b05e4.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202506/_raw_size1164x872_0e80d399-2c93-4f64-89db-61a96d3b05e4.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 216312\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sfCrhAfqT5jU8j34T2u3gV9hnBwPMUtJEXue%2BA65t7UOetDptQktZlX%2Fkof3KrHUHGiGPrjhDhzp6m2lP3RCCgr4ysVuD4WMtTkC88MqNw7J%2BZOsAy6aNFhcuRzy\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"4a57e212f11798f459137139c2f5bb01\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:21 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189697\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac760a5504cf-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 3BE2E2AA-886F-4757-AC03-CB4EFAC333DE\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":216312,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1164 x 872, 8-bit colormap, non-interlaced","md5":"4a57e212f11798f459137139c2f5bb01","sha1":"0ff7a4bf94e0d27bca7e36651637f02900f4cbc9","sha256":"947dcc120d07e5be157b5e2122b563b2291e17bb797e4f253b9b721601296412","sha512":"6a2b161befcae34ceb4835b6435adfe769896ccbc56214410545d6def652290fa13df00d80490dd6111176f53b24bfbad359ef40741239fc201b5a1f0a0fcc3c","ssdeep":"6144:/nUGyYD33U0fwEG5JaO2SXnoTlxXQ7k0kYY:/nPHU0YEGPk+o5xgkZ","tlshash":"f62413abe3f3e57eb17456350ed57b6c92f23e82a3611d152ec361d2275a930c31ac60","first_seen":"2025-08-29T11:05:53.081023Z","last_seen":"2025-12-29T13:58:57.986615Z","times_seen":294,"resource_available":false,"data":null}},"time_used":2035,"timings":{"blocked":1757,"dns":0,"connect":0,"send":0,"wait":273,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/31098.1756903329400.4108b3dd.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.378Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/31098.1756903329400.4108b3dd.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-561f6\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 403E55DE-AB04-46D9-BB33-D671346367F5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":352758,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65338), with no line terminators","md5":"215815c091a19829f9fd6e5f28039f0a","sha1":"8ff2707b0ab4498bfd2bb7f99674b5a245ecceee","sha256":"06371440853645a0532df5edbbfd5c9e9661bec969aabc25b3353297c6f6574a","sha512":"34933b0388cddca0826af79fdd0f82c31c1264e87f004cd921360b19dc83a0ff188ac52a4de89427cc1c09f2785179fdf4d0ff7526d4a74a55f7971fa2738e9c","ssdeep":"1536:Ow+0YvC9jlTKAUSseG1SY46DCdlBBo3AgXOG9AsqCfCXsvCfCXsLCfCXsyCfCXsf:O/KK5sY4brG7O3SnLJNpL","tlshash":"1574b6f4c248c6fdea04ce0a7e7d6f2d50723783f2ec96c446aaf8865e91857245c4da","first_seen":"2025-09-04T00:49:32.813984Z","last_seen":"2025-12-29T13:58:58.029423Z","times_seen":409,"resource_available":true,"data":null}},"time_used":622,"timings":{"blocked":364,"dns":0,"connect":0,"send":0,"wait":245,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/1354465be8a664cd3404a875ba9ca2d8b3cb2?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.418Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/1354465be8a664cd3404a875ba9ca2d8b3cb2?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 184253\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1354465be8a664cd3404a875ba9ca2d8b3cb2\"; filename*=utf-8''1354465be8a664cd3404a875ba9ca2d8b3cb2\r\ncontent-md5: LyKMWsh35LA5EcMRnCE3aw==\r\ncontent-transfer-encoding: binary\r\netag: \"FlXe57KqkBgALkPYe0D7G9QJt6iV\"\r\nlast-modified: Wed, 06 Jul 2022 13:05:50 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-3;QNM:fn227;SRCPROXY:fn270;SRC_***:28;SRCPROXY:28;QNM3:29;QNM3:83\r\nx-m-reqid: UWOqpYCDy\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: FLQAAABrD7_I728Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":184253,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 1200, 8-bit/color RGBA, non-interlaced","md5":"2f228c5ac877e4b03911c3119c21376b","sha1":"55dee7b2aa9018002e43d87b40fb1bd409b7a895","sha256":"b4819a642ddf2d4e68c28c5d8c791c9d64693987394b1fae6f11869f9162c958","sha512":"fd1a9369fd56b0d1df1e71800a59b4fc3259fe5a60cc4d65485e5435cfed8e62ed4a6c756c45be5aa403b34a16b234cea119d3dcba2a8a5764dbe7f21ded22f0","ssdeep":"3072:xnLB9h6Y0yd5h9y+qxYLqTLVxrHArSR5rJ0aFKdG993YJtfyJPkBba3paSLnm:x7wynh0xYwHTArU5df91Y/76paSbm","tlshash":"1704239344924cc3c87b183355d855bcf7c3f45ed6391da2d5a012a014aba5f19eecee","first_seen":"2025-02-26T14:48:47.855286Z","last_seen":"2026-02-18T18:52:42.558732Z","times_seen":44,"resource_available":false,"data":null}},"time_used":3107,"timings":{"blocked":1122,"dns":0,"connect":0,"send":0,"wait":836,"receive":1149,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/42c7eccef1cb9a0d13b382af9f5fb812.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.595Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Sep 2025 14:31:39 GMT","end":"Sat, 20 Dec 2025 15:31:26 GMT"},"fingerprint":{"sha1":"17:3D:A0:9F:DE:47:81:66:EA:33:3D:E8:54:E5:E5:AC:9E:D3:7C:A0","sha256":"22:D9:7A:16:0F:64:68:7D:00:46:B8:BF:15:6C:E8:BE:57:96:C2:BA:12:A5:4B:90:48:16:F4:58:C4:DA:9D:36"}}},"request":{"raw":"GET /202/1/42c7eccef1cb9a0d13b382af9f5fb812.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 1029\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"c66f8cb77481a7c7dc88e1154db429eb\"\r\nlast-modified: Thu, 10 Jul 2025 04:46:12 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, accept-encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 18707459B6E049D2\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: max-age=2678400\r\ncf-cache-status: REVALIDATED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nrYgBoXKvrn%2BLoxhTZaIW4kqj3sbW8mB9R0CSqHCAn7X2CELn42oDO4ruK8Xn9AaPiz31KnHuKzUUaLPaxEB6II3YB%2B7gmTIxBs8hOy4Pgux\"}]}\r\ncf-ray: 9920c3b1cded5fac-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":1029,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"c66f8cb77481a7c7dc88e1154db429eb","sha1":"0a86d933bd3f5953182e59ad7becaf4138371f8f","sha256":"2a9f1bba2d22fef3023e915bef9a8898f189b465be6d134170c30309972a9e38","sha512":"2d8af079dd489e8c9929124af8577c790ace9fda8d4e7650fa1734b6d90f1e49e48aeb04663eb8d935557f76261ae4ed78f04622b2d404161e16164f0b9658fa","ssdeep":"","tlshash":"1a11d8522105fb74d9f060c15d712a60d2eca03e67e249e11003f9ed1c23749b2c73a1","first_seen":"2025-09-01T05:05:19.622795Z","last_seen":"2025-10-21T12:48:58.433032Z","times_seen":128,"resource_available":false,"data":null}},"time_used":952,"timings":{"blocked":-1,"dns":28,"connect":1,"send":0,"wait":842,"receive":0,"ssl":68},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/api/sport/match/player/match","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.674Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /api/sport/match/player/match HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nx-request-source: https://u65r.xyz\r\nXign: R1PuS7GC0sLTpua+fKmxr51FhriNdAmTVFK86DINxRDEiLYpkOAZbF3Pg7IT9ldTVzvLf+M/kmNAnSXazKaus1e1KDglka76u0cMUhMG2nZFpP0Lf1z4FurjKtxoBeVfAXp47i6mtK7/8IEjWzyjzPjbxAy/tZ3vS2gysfdeHpQ=\r\ntimestamp: 1761049807435\r\nsign: n7fp5c4r5l3a436q\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: htmZ44nXYhd2SnrNty4ztc2apf5FpAim\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: D3A313EF-FA80-4F71-8B64-9473E08FC596\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ad1b5cbc37e087c212a41eca07a863ae","sha1":"f990fb40077ca4c90bbde8ffb87c73e1c06fd931","sha256":"0fca88eefe8bb5f59242b88e2b8b179148a088b4cde3499e1c56fef8c84c309a","sha512":"fe056eef22791a958cc37f63c1cc4b3f35bd990c34d1d321f34504b7b99769b571fe46cf18ede31f7ca0e564baf63aaca9d4f3601395bd7a3ce424e50a2aaf87","ssdeep":"","tlshash":"56a002473a282ea49bc31066b50e7a5500a421749a55f469cc8e623dc755453b546531","first_seen":"2024-05-26T00:49:06Z","last_seen":"2026-08-10T17:58:48.562049Z","times_seen":2693,"resource_available":false,"data":null}},"time_used":272,"timings":{"blocked":49,"dns":0,"connect":0,"send":0,"wait":222,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/home-bg.1e09954b.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.636Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/home-bg.1e09954b.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://u65r.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 4014\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-fae\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 101397\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 6E44A456-60EC-4138-9013-5383AF4042E0\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4014,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 278 x 80, 8-bit colormap, non-interlaced","md5":"ed0eb6c81f949885511fbbe4d666a2f0","sha1":"d74fb98c3b01727753bb182eb5ee5d6eedf3da4a","sha256":"7fecf4ed61ab1535aafe2800474ac643b49264b83f54fc1da596d7334868ae75","sha512":"dd2f749e24e6b35f80fa77856c9c8b1cb1e0cacb9250b947403283e152d8bb9e7bf539df00ca6743d4162aeac014e47ce82191b62847fabe6cbb5693b4cd7fec","ssdeep":"","tlshash":"1a816c7eb31a4997296ff194138b387d74b0709d0b546934388a9c31a4791fcf39e526","first_seen":"2025-08-29T11:05:53.155399Z","last_seen":"2026-08-10T17:58:48.423629Z","times_seen":2359,"resource_available":false,"data":null}},"time_used":243,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":240,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/appdown.6e7c9177.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.984Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/appdown.6e7c9177.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://u65r.xyz/css/index-399e2569.1756903329400.f2d3fd45.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 10111\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-277f\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 101404\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 71411F03-4398-4EB8-A847-1E0E486FB3E3\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10111,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"716d097b193628397635cfac41b561fa","sha1":"545d1876219bed15fe850a499a08322de6a26866","sha256":"50276d87fae9c1e30a32c32b4e90dcc2e227cabb4e3bb1d60ecb22fb50c5f2ff","sha512":"47ea5928e921bec4ce4d9c807ee921f6115a6dd27af6fa7325e6d988058d22cf36c03693ebc56665203809cfd6d008cd410380e688e90b36d7eeec18ce6aa92f","ssdeep":"192:cALsiDRih/bWKl4Hq2BHZE6+3paMeCsuTvB6hi6tswYmd:lBEv2Hq2BHS1ZaMJtB+tsud","tlshash":"4622d047a584327b826ec79c8fe98c112470ad1ce6f04d5ac44e711128e8df3503baf2","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-08-10T17:58:48.372171Z","times_seen":2565,"resource_available":false,"data":null}},"time_used":1830,"timings":{"blocked":1569,"dns":0,"connect":0,"send":0,"wait":260,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/LOTTERY.4e81790a.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.932Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/LOTTERY.4e81790a.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 59689\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-e929\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 101397\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: D22E31F0-1A96-4C10-B00E-02ADBDCD48BD\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59689,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"f86c9671c7aed55212fe0eb5219a664d","sha1":"6e765dfb0ce3c646d8c808940071554e78e7d409","sha256":"4ba3fff550a17eff9585d6acbc4a96bd515149510f6a8bb7638985fb4b41a181","sha512":"706aa66f138a3459eaf34f5b7a8ffed3dfacecec6adf14a2e83f1149143cfbb059f97aaaac2032587a80c0e30c62e5b46b07b4dc6f3cf5925e6e1db2a8ed45d6","ssdeep":"1536:Cyp1EBaRnsFt9ZXZj0wEYsRvqm1waPbZsY:CLB+sFtzXN0w2ym1fFsY","tlshash":"914302f36beb0bc5b07adbcf4ed354f0067a71496b42dcd44f4120e61ea6199bac420a","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.458595Z","times_seen":2361,"resource_available":false,"data":null}},"time_used":1163,"timings":{"blocked":959,"dns":0,"connect":0,"send":0,"wait":202,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202506/_raw_size1260x1156_03543abb-5967-4969-b0c5-87347b24c4d6.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.751Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202506/_raw_size1260x1156_03543abb-5967-4969-b0c5-87347b24c4d6.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 300115\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IG80cQaOKeQaa%2Fdg74WrUqPcAykLU5e78xvsK%2BrGUgus66d7mDlJ%2BtFG%2F3Q%2FKmnr3rWUszijbDGntuGDj7sKUWh6J0%2BX%2Bb912DBdPA06%2FMrR6UOgWF9igwrmiR%2FK\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"37fec7c80a51688c04f77c1037326004\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:17 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189701\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac6d8d9e20e8-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049811=yfEHl6AolJP0QC5NkMkOAeL2cxw2cvQEQ0CJoyH0PwylhAu+93HbTVa2aaGzmwCJZPRlEiCkJ/Lezou0DkT7iNjC2gSEaRk5/ITYUs6HFP6vgf9C2kZ+8cKO8dprXM2S7lcJEzc2ZecPldSfp0XqpOhoW/bsw+EQEoKlKZs4TyR039jUu6QbtWk2lIQvTHt+\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: B563203C-A83B-48F5-A35E-5E6242D472FE\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":300115,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1260 x 1156, 8-bit colormap, non-interlaced","md5":"37fec7c80a51688c04f77c1037326004","sha1":"fd665b933bab23652f0cff470fba5592d3b74474","sha256":"b2b5ae8374cea37ae3d437a86c3f7149cfc0620470c5dc46a606a2858c9ea805","sha512":"4628d46516b68b86a355a4e48f93e3e662e57a75a061037c5bc151bda4ab7e9521cb9d7a41e2e61796c4f933c6d063fe5aefa99713532591a1a471f7147071a6","ssdeep":"6144:b3lXZwKOHfoPrrp3/CkvaKB7dufM9jn8J7ReuTXVGxwEk1av3YP7Ll7yi:b3hejHfoD9frj9j8J7RbXV5R1A3M3lx","tlshash":"215423b70d4d2a3be017d2f40e9f294a80955e91dc868270affbec95ca7777880749d1","first_seen":"2025-08-29T11:05:53.270915Z","last_seen":"2025-12-29T13:58:58.068155Z","times_seen":289,"resource_available":false,"data":null}},"time_used":3768,"timings":{"blocked":3491,"dns":0,"connect":0,"send":0,"wait":260,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/kc523-1/sponsor/sponsor_nav_web_2.png?1756903280095","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.962Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_2.png?1756903280095 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 6434\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1922\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049808=sBeSKsiafNlkKsLs4C/dAiFvvIebGS1CCiZrVBTiq6N2BrMHJO/A06D5FyfgjgTxmm65szHCxvbeWCjEoLhX52ZT+6aWyh2Ly2dWJuSrJO8MDlgQ2vONi+MIwEavNqtGmMx1nEqf7c6BCaib745OKSMBePL4GHCI7LEl0G2xpUJD22vca5uX8ey/KW8PlWax\r\nAge: 92156\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: CF777480-2D47-40DC-B6C4-A9D2E8562832\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6434,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"e31cb9f70abcc458288bb53868031352","sha1":"965f7cb9aaf0d166c21b8681b0671d17e019c74e","sha256":"33295ad776e1fde54dace5b0343c9aab9a2d70cfa8848e5cbd09065c340e294f","sha512":"acd328b1f4cb6e1c7267696487f637ea5ae4b724f7ab32516632a3eb2c8b4e374fa472ab77120230258fb49a23f54ba3988b155004b46e69519fe3ef57ee79c9","ssdeep":"192:RYc0QiGWn0WG2WmjNJMjOluoj/xrASMJmoJESULHT:RYc0QiGlHmjOo1j/xPMAG2Lz","tlshash":"c9d18ea6ea2a4a52cf8d0d633efc5b0671508e582f390826809a1d1d57767fa24a13e7","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.260713Z","times_seen":2230,"resource_available":false,"data":null}},"time_used":2947,"timings":{"blocked":2694,"dns":0,"connect":0,"send":0,"wait":253,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/12234727b82ee6fa141ce87626e7d68d1f441?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.482Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/12234727b82ee6fa141ce87626e7d68d1f441?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 16630\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 2455479\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"12234727b82ee6fa141ce87626e7d68d1f441\"; filename*=utf-8''12234727b82ee6fa141ce87626e7d68d1f441\r\ncontent-md5: 6MnsEk5z3p9kMq37xMmrlw==\r\ncontent-transfer-encoding: binary\r\netag: \"FpSxifYi1jqGs2gONiJk2VyE-G_Q\"\r\nlast-modified: Wed, 06 Jul 2022 13:02:47 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-26;QNM3\r\nx-m-reqid: S7lOluTCR\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: as4AAAC3zkscdmcY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16630,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 195 x 195, 8-bit/color RGBA, non-interlaced","md5":"e8c9ec124e73de9f6432adfbc4c9ab97","sha1":"94b189f622d63a86b3680e362264d95c84f86fd0","sha256":"f3fa64fca704c69a3c1929f06bae0bb5a8fdaa158287950eef70753f9451a84a","sha512":"b740b69d5f0415fb73aaecb39899711fd7b7ffcb120b1b4c8cabe1e485ed51a3dcc5a32772efc8285159eba5ff03b67d1eb01e10e5faf6eb29bdd1d62cc892fa","ssdeep":"384:tcUej7mWkZJeHEU5AdpHyRwYWwhBBFnIZMHB2cb3W85M8W60:tcj67ZJeHRAdByRwlyfoqHb3l5Mj","tlshash":"6172d0a815ae646b93e5f7f7012a5eba4fe4601a0672f934ffc132e6848494012fcac0","first_seen":"2025-01-29T13:39:14.549428Z","last_seen":"2026-08-10T17:58:48.326019Z","times_seen":150,"resource_available":false,"data":null}},"time_used":2728,"timings":{"blocked":1059,"dns":0,"connect":0,"send":0,"wait":836,"receive":833,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/10064d6e7fde6b95f46189801ff4f1896945c?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.508Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/10064d6e7fde6b95f46189801ff4f1896945c?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 16271\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1997691\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"10064d6e7fde6b95f46189801ff4f1896945c\"; filename*=utf-8''10064d6e7fde6b95f46189801ff4f1896945c\r\ncontent-md5: U1XmGKY2Mgsap6zpVkUgmw==\r\ncontent-transfer-encoding: binary\r\netag: \"FvKSNsX1NvIN5JG6DByqwBbw5jDd\"\r\nlast-modified: Wed, 06 Jul 2022 12:49:07 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-3;QNM3:15\r\nx-m-reqid: EEZiRnLzU\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: cugAAACqSO9JL2kY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16271,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"5355e618a636320b1aa7ace95645209b","sha1":"f29236c5f536f20de491ba0c1caac016f0e630dd","sha256":"cbc2444fdb67f4349eebd78cb6cec49f1203156e62296a8d6b3093caf80a7d3f","sha512":"e33bb1f62d8feee5154403d5772bb758094007cdfc4837473d151799e90d9179644c370c4daedab823a04b7df59f70db6d660da7a5988a252c4a6d0dae1931c4","ssdeep":"384:jSvfyExVEEL9iM9BmnglgfzH8G+GpM1v/LrIL0STwptPs7PFrN:jSvtxVz9iIBmnXfz1FM1vTrkjTuANN","tlshash":"4672d18020abde5d4e3561d73379e6d041f9ad9ade6208ca6cc62f3caeb90b15304205","first_seen":"2023-08-30T20:30:43Z","last_seen":"2026-08-06T06:25:53.353787Z","times_seen":219,"resource_available":false,"data":null}},"time_used":2712,"timings":{"blocked":1034,"dns":0,"connect":0,"send":0,"wait":836,"receive":842,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/114046b6b83a3b87f4230aebf376c2a488c05?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.575Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/114046b6b83a3b87f4230aebf376c2a488c05?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 21763\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 2370296\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"114046b6b83a3b87f4230aebf376c2a488c05\"; filename*=utf-8''114046b6b83a3b87f4230aebf376c2a488c05\r\ncontent-md5: WQulGlDFQWv0xZmO+qCBXA==\r\ncontent-transfer-encoding: binary\r\netag: \"FnwVVDs7fqk6PaFuq9xDDuPFe0FZ\"\r\nlast-modified: Wed, 06 Jul 2022 12:53:53 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-25;QNM3\r\nx-m-reqid: zCYxa5qsP\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: WfoAAACYHqKVw2cY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21763,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"590ba51a50c5416bf4c5998efaa0815c","sha1":"7c15543b3b7ea93a3da16eabdc430ee3c57b4159","sha256":"8b92284125a3f7d228e93351ad42585d71644bcec91b6dc7872d1ae3f7b048a7","sha512":"ed856da353a7cb20a5660c7b833161e1df29a1ca245640cd76a5af0d1639cc22a87aff2be563b8dd1735fbe7bae4add4aad077201ceb26ae2ca6b7480ff56fbb","ssdeep":"384:fiKrZDe8b81qiKRfWt1IiQLowXkQRqH3n//48Q3G3ZFj4K9FO2a1c32U42Yn:RFDxBfWtioUkIqno3G3kgFOZn1","tlshash":"53a2d1a1ce95b4273a51e7227b5522bcf034851856aef606f716bc93e3721f288b01df","first_seen":"2023-07-15T11:13:39Z","last_seen":"2026-08-10T01:13:04.353825Z","times_seen":209,"resource_available":false,"data":null}},"time_used":3202,"timings":{"blocked":970,"dns":0,"connect":0,"send":0,"wait":837,"receive":1395,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u64p.xyz/","fqdn":"u64p.xyz","domain":"u64p.xyz","tld":"xyz"},"ip":{"addr":"110.42.43.240","port":443,"asn":136188,"as":"NINGBO, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-21T12:30:00.442Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"","organization":"Default Company Ltd"},"issuer":{"commonName":"","organization":"Default Company Ltd"},"validity":{"start":"Fri, 13 Aug 2021 15:26:37 GMT","end":"Sat, 13 Aug 2022 15:26:37 GMT"},"fingerprint":{"sha1":"7F:71:6D:55:95:E9:03:F8:C4:FE:7A:50:4A:D5:BC:0D:AC:06:4D:5A","sha256":"03:38:40:ED:33:E3:90:09:B2:EA:94:5A:FE:F0:7E:A4:2D:09:7A:E0:F3:EA:75:2B:BE:B2:A5:0C:AC:D2:BE:50"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: u64p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:01 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: close\r\nCache-Control: max-age=259200\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":428,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (427)","md5":"759c9e81f47f9d3a046481df016ee731","sha1":"d7b4494b58220e4087ef6017b9f5ab64812d492c","sha256":"91aa842e334376aaf3cf5e91e59064a92f85a83aef8a35d0a151e199ff9dddae","sha512":"3cd63571ee590cedfd150f1e786a039fe36ed43804d4c59f311e4136dfd76d0a1b4885f250cc77b3329842cd2cfa6589f371397584272799d8920a99c7c4a61e","ssdeep":"","tlshash":"04e0ecf7285185746af93287ea63bb552c1261c73f41b40140445c62a51cf8aca39e99","first_seen":"2025-05-09T03:19:07.689337Z","last_seen":"2026-04-18T12:05:04.161646Z","times_seen":1091,"resource_available":false,"data":null}},"time_used":2350,"timings":{"blocked":1046,"dns":1,"connect":257,"send":0,"wait":257,"receive":1,"ssl":786},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u64p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u64p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_e50c5112-b480-4217-95c2-f187843fa431.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.760Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_e50c5112-b480-4217-95c2-f187843fa431.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 394695\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lKPjUu7uNlDIKG2TorN2eY51xkal0kp6nu6tVoI%2BINNnB8%2BOXK6x4ZohM4ANqcjb%2F7fzQHT7PNhJrrMk7fiAGiUNwntPgguf4aelpQTUH%2FejeIXhLwlo47xm0A%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"ca824a845494796bec5f55ecc8538334\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:36 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189693\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac9b8d8f2416-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049811=yfEHl6AolJP0QC5NkMkOAeL2cxw2cvQEQ0CJoyH0PwylhAu+93HbTVa2aaGzmwCJZPRlEiCkJ/Lezou0DkT7iNjC2gSEaRk5/ITYUs6HFP6vgf9C2kZ+8cKO8dprXM2S7lcJEzc2ZecPldSfp0XqpOhoW/bsw+EQEoKlKZs4TyR039jUu6QbtWk2lIQvTHt+\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 10FDB0B6-93A8-4496-AE69-BC02EF4A4E43\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":394695,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"ca824a845494796bec5f55ecc8538334","sha1":"9c2b5d8af27d464f37c9d295963b599bfe2beb6b","sha256":"bebf296e754e5c331ce43009b1274293b6a1a04655c7efc872798ce1c4b424d2","sha512":"6d9d216a82bf7bc4137ddb2147f4395ecc5b2f00a530040a077121d452301246d32f43e53fc60e95a3de7f6b98f2d052a635ff1ac3499c554bfd085676f386fb","ssdeep":"12288:O3HGCN8Dz0DbOdIxqZJuaWvddMynAO+PIy:RoKCbZxqZ0TMyAOu","tlshash":"418423199bc439bb47ceaa53e18143caf8416d57ac7042df982f3c141bc9160f89ebe6","first_seen":"2025-08-29T11:05:53.121779Z","last_seen":"2025-12-27T06:51:48.739517Z","times_seen":278,"resource_available":false,"data":null}},"time_used":4094,"timings":{"blocked":3860,"dns":0,"connect":0,"send":0,"wait":211,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_6ba5f6e7-0a03-42b1-aae6-3de33d838c71.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.764Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_6ba5f6e7-0a03-42b1-aae6-3de33d838c71.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 441285\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DS1SK2g7akoQON98YhNaUmqxP0bcpdAeruMghjmWjLPm3zOln84n6OJuay50Vq8wbb3zJqZcsFjjLFkTFebaN219IX2peq0yB42x8Y9KGPXevVZLKvgQ54gX7HXF\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"5cbd1adda9f772a16f34c0a26b141c20\"\r\nLast-Modified: Mon, 08 Sep 2025 20:42:24 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189693\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac9acf9304b7-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049811=yfEHl6AolJP0QC5NkMkOAeL2cxw2cvQEQ0CJoyH0PwylhAu+93HbTVa2aaGzmwCJZPRlEiCkJ/Lezou0DkT7iNjC2gSEaRk5/ITYUs6HFP6vgf9C2kZ+8cKO8dprXM2S7lcJEzc2ZecPldSfp0XqpOhoW/bsw+EQEoKlKZs4TyR039jUu6QbtWk2lIQvTHt+\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 49936784-BE81-496B-BC3A-BBBC6657E217\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":441285,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"5cbd1adda9f772a16f34c0a26b141c20","sha1":"3d829154f18db91028e797aa4f7a3bc27c0fb5a3","sha256":"cd182233fcca00c129d8b8cc6a71f285b7ab087ba40292106fa03f470d351100","sha512":"2985899304431b84e38d588c430eabcd09bba19ced9275f0900a35495404c21e4a208775b18cf6450eaf0499fe3f10fe06d9bbd509a094f311a3090399fa6d24","ssdeep":"6144:vQ3IELp1ifxXQrauVNCK8SmnYIzbSM6h7fValiX/HtPnSxjr/CaOwwKd7SORGEen:I3IA+oDES4TiMMt1X/YzJOwBXeogJTp","tlshash":"9e94232be93505e99e8306337aa7f320edd099c82c062423d15afbf197c4c64b7d95da","first_seen":"2025-08-29T11:05:53.315748Z","last_seen":"2025-12-27T06:51:48.749594Z","times_seen":285,"resource_available":false,"data":null}},"time_used":4252,"timings":{"blocked":4020,"dns":0,"connect":0,"send":0,"wait":200,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/vs.21f89f73.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.638Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/vs.21f89f73.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://u65r.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 1306\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-51a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 101397\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 8DA49322-719F-42B2-8B56-60EC54C7A444\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1306,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 70 x 28, 8-bit colormap, non-interlaced","md5":"41cff06a80e61ee3fcd32f7c29a6493e","sha1":"bb70bb0a3a0fde7a132788777aee629392c756e9","sha256":"3240fcea2e4168dc863b8aea602750e6a1fe11a557c18ac6a381781ef487746b","sha512":"fce7ff9f62b51c4f8994f0a8ec4a56f21570d0cd163471d99b357eb0a9a735c800b389c4a8a611ba441b208cea7eb483140042f5d11ef110b591c1c1898bbb8d","ssdeep":"","tlshash":"e921eaffe15b2c75ccb59bb3bc6c12656809582970866b137125e7588c539217f0c461","first_seen":"2025-08-29T11:05:53.184813Z","last_seen":"2026-08-10T17:58:48.487849Z","times_seen":2350,"resource_available":false,"data":null}},"time_used":229,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_d4d2b521-861c-48d3-89a5-438931453851.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.720Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_d4d2b521-861c-48d3-89a5-438931453851.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 477126\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uK6tKcxFq9XBK0N6sT%2F5gbNvtwBE5HeVh2gQ1d6vSnKhZ0cHuUkzwtBwBIR4RmaUUmItb0cWAHDUfcAknJ%2Bb4fS0YaiZ1xh%2F83%2FxVMF9FtKxRnknGlFl4l6oFg%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"7794a1e83dd1cb6d323415eb8a3dadd0\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:24 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189680\r\ncf-cache-status: HIT\r\nCF-RAY: 990eace56c6bb445-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049810=8XOhqPYzNvtuGG/4OcysAi/9c1Ix5YgXavBiBH6qc9bjm9WqeG2yII9Rd1CIWAUKAG0FxykRuvJXzDnxMKqk+rS68KDMASNbTzkdswwt4XDucm6b5py1vQ6G35la3BMmWsZTXXT6A4L15Kx99KWkHMnTvjv0qUeu4ZUmFH0QFz5BQ+0r3VTY4mBrhnaqQbQB\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: E6EBB051-DDDE-43BC-BEF5-CE3EF3A3FCE6\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":477126,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"7794a1e83dd1cb6d323415eb8a3dadd0","sha1":"c692abae4e09255d43bbf4fe9839df3a0b42248c","sha256":"42a87f6dcadfb0ca9d2251974f0c53bd4d90d806c617737c734ed7655a5c7b9a","sha512":"9bf6e3bf06ae91cf7c57bef19f899b267203f646225e73debddb6b773b95a615ce83128b27e57e4c5cb0865ec120c5cadccaef29e544ade6c7e1819ce6626543","ssdeep":"6144:XnRMmtMWjUHq6Q/dpcBs6nyBO2BXI109eFefYmD2KJrMeQOKA5XdtJQpysRmcCjQ:3RMenUF6dpVRPD2SL1XdtapocCuz7TTz","tlshash":"c8a4231db113b3e608eefcfcf6a145d0dab34a53c8076a4fcf1b51092616b5f429a85a","first_seen":"2025-08-05T06:40:24.16226Z","last_seen":"2025-12-29T13:58:58.060042Z","times_seen":290,"resource_available":false,"data":null}},"time_used":3653,"timings":{"blocked":2686,"dns":0,"connect":0,"send":0,"wait":229,"receive":738,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/css/index-399e2569.1756903329400.f2d3fd45.css","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:03.388Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /css/index-399e2569.1756903329400.f2d3fd45.css HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:03 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-e0fa\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049803=N2Mzwq8fLWQhe5PvbYJKnT1J9Jk9QgjpDkS98sT0zMkxLwtxh6uDYKsuHHgZ92HdOrvsCoOXZCeUHdYDG4WOFi8shXZ1ri+iElYDeZ1akQ3cSi8Vkg1DM7B53M3dJgpaHf6bli/J85KwiwvgYpuXBz3LFDvFlDARwGqtVF2qyuwPxvG8f0dCKPXCjzO5DnCS\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 93A67156-DF66-4ADA-B09D-E60CEC5D5599\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":57594,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (57594), with no line terminators","md5":"0bef4e7c4e84f6239d22f4203413192b","sha1":"f78cb75a974a7ef4ad6fb57d114c15a9b01e7fa7","sha256":"5b262fc0f9fc795ec63fd0e9afc4330757a5084ada12fd0163e40db339faf636","sha512":"65794dd7ecf908684da4c74a3360c5ddb3f51d12288d394002038de44677de9de92284164a288ca328fdaf3e15ea9aa6f16f750431488c0f3e87d68c6df6eae4","ssdeep":"768:E0ouj7X8vtr9UL5srs7hAqpLe20TCKiNkZICSA2ohGyHukQ9aaV+TJtU+WQZLq:Hop9isrQAqVe6KekWRlkQ9hf+Pe","tlshash":"6d436c2526e435ade27ba715ec91ea49312b8701f127725afb03322bc1c32f5c677b41","first_seen":"2025-08-29T11:05:53.260224Z","last_seen":"2025-12-29T13:58:58.036511Z","times_seen":443,"resource_available":false,"data":null}},"time_used":1337,"timings":{"blocked":443,"dns":1,"connect":220,"send":0,"wait":422,"receive":15,"ssl":233},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/license.ea57c78d.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.985Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/license.ea57c78d.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 1976\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-7b8\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049808=sBeSKsiafNlkKsLs4C/dAiFvvIebGS1CCiZrVBTiq6N2BrMHJO/A06D5FyfgjgTxmm65szHCxvbeWCjEoLhX52ZT+6aWyh2Ly2dWJuSrJO8MDlgQ2vONi+MIwEavNqtGmMx1nEqf7c6BCaib745OKSMBePL4GHCI7LEl0G2xpUJD22vca5uX8ey/KW8PlWax\r\nAge: 117975\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 6F784BB0-A68B-4364-BE2C-75CB1256EAA7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1976,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 161 x 52, 4-bit colormap, non-interlaced","md5":"60a2c7c150b01809fbb7b97932684b5b","sha1":"67fc9647c452a17b519c6a51dc8c38daa23755f9","sha256":"c5ce31558a1f979ae78c7779d2f312b196750375541e9c147b73d6e44d47c276","sha512":"2328442fa1c74e47c6eff4adab55920c7e7738e7ae51bd2b222fb696bbcf8201a14805089a33baa80c28a40db47061048d817c384bd72735b2e0c0116ff63c6f","ssdeep":"","tlshash":"b3412a6266729beced1a8c47592c7df1d8338ca1a200e1c150ed761f1bf8e1060e7a94","first_seen":"2025-08-29T11:05:53.23289Z","last_seen":"2026-08-10T17:58:48.288942Z","times_seen":2497,"resource_available":false,"data":null}},"time_used":2964,"timings":{"blocked":2722,"dns":0,"connect":0,"send":0,"wait":241,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/ecb/8f8306425eba6e0167bcdb25a31b67ec8f","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.289Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /ecb/8f8306425eba6e0167bcdb25a31b67ec8f HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://u65r.xyz\r\nXign: tZLezvbi9z/9UWLJ8aRINnCjKMY016OYX995RekSWO4VZx+SQ5f4uSspXzE7GPw78p1d3E/LqQeGG0pqD7XPg/0Zysd5gqxB+3CbW7jLVZjU2ffDkXM6XnX0ZnUTcCaxVvxhKw2JTtG4yzDHB8FRSzGlxsBz46iXAUeEvlMMQPA=\r\ntimestamp: 1761049806283\r\nsign: 72h33251t1h341rl\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: htmZ44nXYhd2SnrNty4ztc2apf5FpAim\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Tue, 21 Oct 2025 12:33:06 GMT\r\nCache-Control: public, max-age=180, s-maxage=180, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: A19FED30-8BA9-4970-A75D-939B065116C2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3609,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"5e818df19e98b3a87d0cdb820d30478b","sha1":"2d0ed8817cef2a5253abeb1ae42651f8e1c9c660","sha256":"3cbc59b8739f23f614fff9901496e8c53d01743bd5b6d6f4dd9ac20f2f5c0e8e","sha512":"9be4734717c034c094456fd5f2edd9494bc57fa9b7136042975e35a0a646a5b6f0061c630e09550dfa4975256468a3b37950756db6aea63524995c13803673c8","ssdeep":"96:eOGS7hTEAd9FXFQlxFV9mfTBk6qGQwXD+K+xnM2CEaN45zBbJNai4QPrHo7pVzGh:VP7Sk3KlTVofOGQ46fJho45NzaHUjoXs","tlshash":"c1b14ec5016cb738e7b418fe79184fe8a08553dccbf9ebc6d06345d0645a482db6e507","first_seen":"2025-10-21T12:31:20.480739Z","last_seen":"2025-10-21T19:10:13.028098Z","times_seen":2,"resource_available":false,"data":null}},"time_used":231,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":230,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/133054971ebc77685464f841be53c8f6cf5b5?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.581Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/133054971ebc77685464f841be53c8f6cf5b5?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 119726\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1606746\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"133054971ebc77685464f841be53c8f6cf5b5\"; filename*=utf-8''133054971ebc77685464f841be53c8f6cf5b5\r\ncontent-md5: j9P9v1YLJc+kHEqjlph3FA==\r\ncontent-transfer-encoding: binary\r\netag: \"Fs_O-uhZyt5eXFdO3uoh5S_7akJr\"\r\nlast-modified: Wed, 06 Jul 2022 13:04:05 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-24;QNM3\r\nx-m-reqid: EAix03KUz\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: pyEAAABez9QnlWoY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":119726,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGBA, non-interlaced","md5":"8fd3fdbf560b25cfa41c4aa396987714","sha1":"cfcefae859cade5e5c574edeea21e52ffb6a426b","sha256":"a000ed2893ead5c77fa11c37378eabc4b0e20bfe84bcac7d0c904ddb3ea7c2cf","sha512":"3dbcc192acd7f1756632ff7c8120caad8082c7892b1091efc7f788255c687760cc728e571ae8977c85f5518147d6eee7257856b71fade20b8346ff36530a61f0","ssdeep":"3072:vqwoN0hNpsAkzE2x1h+RkvgSpfcDv4CIpCdWx:vqXNopnkY2bh+KvVpfcDNIeWx","tlshash":"83c312488d3f6484c41236fe6b59d18c3698e0ebf5009bb1fc6eb925a038971919b5ff","first_seen":"2025-03-28T18:20:50.046867Z","last_seen":"2026-04-26T00:17:34.07753Z","times_seen":91,"resource_available":false,"data":null}},"time_used":3474,"timings":{"blocked":963,"dns":0,"connect":0,"send":0,"wait":837,"receive":1674,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/13077a0d27b1566c7401d9f1144f7c1fb5c99?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.590Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/13077a0d27b1566c7401d9f1144f7c1fb5c99?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 11211\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 240259\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"13077a0d27b1566c7401d9f1144f7c1fb5c99\"; filename*=utf-8''13077a0d27b1566c7401d9f1144f7c1fb5c99\r\ncontent-md5: YREgpJ/usZcaa7c8v8Q+lQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FkZrxaufn-RJ0P_-1RL-0yYhAAHt\"\r\nlast-modified: Wed, 06 Jul 2022 13:01:22 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-27;QNM3\r\nx-m-reqid: efgoOvnkz\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: ltAAAADfnYQVcG8Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11211,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"611120a49feeb1971a6bb73cbfc43e95","sha1":"466bc5ab9f9fe449d0fffed512fed326210001ed","sha256":"e8a5c33626871a42b8fc5970096f66bc59d2f5dad26bc84386a83ad5de35d2d1","sha512":"11dea02fdf4f653f56bbc05e9caa10337fc6bb3ed43ecbe9af064bb8618671fde52e7ede038b3a2cd28e24ae708ca8e15ad30a3657b7281377bffcf0f3b43228","ssdeep":"192:At55jHqgpf5YUAuuhvKKBG0G4q/ULiXmdrqBIJKrW8aCwxORhmmCQ:8/Ke9uhvzE0G44ii24VNDwEhmmCQ","tlshash":"b432c0463aad8c651d308f6ed6ea427420e7d2e1532dba6be012c0c177ec870f834ad5","first_seen":"2024-12-13T03:40:21.259541Z","last_seen":"2026-08-09T01:57:58.570043Z","times_seen":239,"resource_available":false,"data":null}},"time_used":3191,"timings":{"blocked":955,"dns":0,"connect":0,"send":0,"wait":837,"receive":1399,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.u52j.xyz/","fqdn":"www.u52j.xyz","domain":"u52j.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-21T12:29:54.293Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: www.u52j.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T02:51:57.151416Z","times_seen":17879698,"resource_available":true,"data":null}},"time_used":2067,"timings":{"blocked":0,"dns":1252,"connect":268,"send":0,"wait":0,"receive":0,"ssl":544},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"www.u52j.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"www.u52j.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/css/61540.1756903329400.030a612e.css","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:03.387Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /css/61540.1756903329400.030a612e.css HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:03 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-59bbc\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049803=N2Mzwq8fLWQhe5PvbYJKnT1J9Jk9QgjpDkS98sT0zMkxLwtxh6uDYKsuHHgZ92HdOrvsCoOXZCeUHdYDG4WOFi8shXZ1ri+iElYDeZ1akQ3cSi8Vkg1DM7B53M3dJgpaHf6bli/J85KwiwvgYpuXBz3LFDvFlDARwGqtVF2qyuwPxvG8f0dCKPXCjzO5DnCS\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 50FA224D-0FAE-4176-A845-3D017B191AD2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":367548,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"ab44c516a5aa84faae3bbf2852ebc655","sha1":"ef60c256d0028ecec909ffd9895ea2e63c1d1f1b","sha256":"456781f16fd25de012286211ad4b06e5ce32d9dfc9fb28a2364d80f76a2994ea","sha512":"4e214b9fc84d1e3b914c9bd025947162323db0251c704c668fafbbf226e604899d9d8d21e2f8b3b401ddb966981ba0edc97cc87c6ddd3eef29aab80010446656","ssdeep":"6144:z4+4r0H8Tu4+4r5cRlGuEQUQ929scKGnpTPIlyJ:z4+4ZTu4+4FKLlyJ","tlshash":"de74fa7caf1030ae15a7cb27b660f5589c36a443f9bfde9af3a53d580789a510623c13","first_seen":"2025-08-16T16:35:14.576567Z","last_seen":"2025-12-29T13:58:58.009689Z","times_seen":607,"resource_available":false,"data":null}},"time_used":1088,"timings":{"blocked":207,"dns":0,"connect":0,"send":0,"wait":455,"receive":426,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/css/64906.1756903329400.0ab0fca2.css","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.749Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /css/64906.1756903329400.0ab0fca2.css HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:05 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-1439\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049805=po6D+l8dMhfLGKAdfLLnVeIRbjpxlkQDEuGKbtlEOTQWkshI6okgIymixUARr4wGybpILVpsVTfVc7k0JaAkDpC9mG+fNrxEIVp7sH1o9IEd57siolGhKy+cprba9qHT4pkoamaJpfQkaW28kwG1+DFqQQxzksZj++jdxZwG6L+cO51eyJYwemgSWglzoiWi\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: CE3B2FB5-3F70-46AD-824D-0DA9967160EC\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5177,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (5177), with no line terminators","md5":"a0ef4268641ef0b005737ce8cc0c4b44","sha1":"9bb50b9000a419e7a701392b0d7d6c992cf585bb","sha256":"f64c7a7e6ecd620d1c7f8cc67e1eda83a0a115a8d86f3954efdaba3c09d62e66","sha512":"07605ebd7e16aef28f0ad5ed406f29ea9b77e8ba6b2079c810aacf8faf0b4a8d18d4f7775c62860cbf6d4379729a60076103a4daa833c860ddebeee3793ccbe2","ssdeep":"48:ZSPkOO2s2L5Pukasq+nArLkrL4QuQKhUjUkM5P6CdRDRWURcWaTHR/:iOvyP2r4rEDFP61LR/","tlshash":"d1b1412f01703349641bad6807dc67098325d8b399eb37da259d2a0dcbc3f861eb718b","first_seen":"2025-06-26T16:31:28.933081Z","last_seen":"2026-08-11T10:23:49.12464Z","times_seen":3741,"resource_available":false,"data":null}},"time_used":266,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":266,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/LIVE.88ccbf98.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.929Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/LIVE.88ccbf98.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 61665\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-f0e1\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 94890\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: 11725E88-5AEC-4F30-BE84-D135EDD961E3\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61665,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"372d01a2bda7ccdca1e7966af39c2327","sha1":"d438c1947b711d032c5621a6b4b08bbbca2c338d","sha256":"4eac7be4c06fa607ef5e95789e3ead43806bfeff97872ed6567e3810f2f661bc","sha512":"9f04160df8696cf984cd77604dddaea73969479e4f1c5050e53351df7f11e85d8ecccb14ecb87dcd58bea0ba04d9ba5ea3f99c69a179ba88ad38d5416b7a94d3","ssdeep":"1536:jTjrlfQBxhFWiXt2lnJE9mARbSK0k2C8ve1HfarCtt:jH1QjwWUC9mA10jC8WZfaQt","tlshash":"dd53124a2ecc3a1f7bf21e5e06f286814d36a186d0f9ba5bc6e70ef1218521de0e4535","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.447669Z","times_seen":2378,"resource_available":false,"data":null}},"time_used":1149,"timings":{"blocked":885,"dns":0,"connect":0,"send":0,"wait":261,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/kc523-1/sponsor/sponsor.json?1756903280095","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor.json?1756903280095 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: application/json\r\nContent-Length: 646\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-286\"\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 9DA5BFC6-37BA-475D-9033-75229962BEE4\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":646,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"10d2161de8cf99c474812f4c43645a26","sha1":"71884ef7281cdcb5084088f16d4550ce8790e634","sha256":"bb02fd7438bb49dd4decb6f76a71f11e93355332fd9f965d6f9f13bb8175aeca","sha512":"bf0fd1232309fcc5582d5c42644e1c7b4b8d235b1066e988ff55e0dd94a956f89742401f00c2d904359041c8e0c2bac8e9316252fab60db5eb0a3b4c935172f0","ssdeep":"","tlshash":"d8f0f44ad8b25b93211fb57c58cd050470294a8f0eccaac4baac987c4f598ddd1e839e","first_seen":"2023-06-16T04:51:50Z","last_seen":"2026-08-10T17:58:48.246933Z","times_seen":2852,"resource_available":false,"data":null}},"time_used":271,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":271,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/136301653a9f61a31437caa2e9e798592dd34?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.497Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/136301653a9f61a31437caa2e9e798592dd34?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 24077\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"136301653a9f61a31437caa2e9e798592dd34\"; filename*=utf-8''136301653a9f61a31437caa2e9e798592dd34\r\ncontent-md5: x/NqDZ5TdOxjf5dMQaySFw==\r\ncontent-transfer-encoding: binary\r\netag: \"Fkb-mJsrBPjn8-WRJZgdZL1elD5M\"\r\nlast-modified: Wed, 06 Jul 2022 13:06:24 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-2;QNM:fn194;SRCPROXY:fn270;SRC_***:13/304;SRCPROXY:13/304;QNM3:16/304;QNM3:27\r\nx-m-reqid: Hcy36tcbd\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Validate,Hit\r\nx-reqid: hfsAAADoQhxybWYY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24077,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"c7f36a0d9e5374ec637f974c41ac9217","sha1":"46fe989b2b04f8e7f3e59125981d64bd5e943e4c","sha256":"3385120d2437b1827779bb369bffed391917f906f5f261e41199fb2ac64f7f55","sha512":"5cf9ff7433a3c7616c92d00b3d4f642b298829058eff05a5461efa87f0a941a97afd9b312f0d5d2589689d744ab026c78fe030f545fa67ec0a5b09b136d24701","ssdeep":"384:1X7CIBQj371z4JQFhtW1fZZcQki2s8k3iJqfdd0gN90dUm8ZcTOEEqp1j0ABwJcW:1X7j2jL1ztFhtyZhki2U3aq4g70dUZ4q","tlshash":"51b2d16efd0cfac2d5f475451baab608e889a1036860cf3653ad130ab50fdd349abf15","first_seen":"2025-02-17T10:07:52.464813Z","last_seen":"2026-04-16T09:23:29.082868Z","times_seen":60,"resource_available":false,"data":null}},"time_used":2720,"timings":{"blocked":1045,"dns":0,"connect":0,"send":0,"wait":836,"receive":839,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/15217773d4772f52b4250be718e1c3de95d1e?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.586Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/15217773d4772f52b4250be718e1c3de95d1e?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 34502\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 247320\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"15217773d4772f52b4250be718e1c3de95d1e\"; filename*=utf-8''15217773d4772f52b4250be718e1c3de95d1e\r\ncontent-md5: xF/OsyqLzCH3cS+41hUctQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fj-9ZwuDFasU5X-oMlFNiNlsZOsW\"\r\nlast-modified: Wed, 06 Jul 2022 13:03:15 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-10;QNM3\r\nx-m-reqid: w1mElzE8S\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: NNcAAACacILYnWAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34502,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGBA, non-interlaced","md5":"c45fceb32a8bcc21f7712fb8d6151cb5","sha1":"3fbd670b8315ab14e57fa832514d88d96c64eb16","sha256":"0c839807cf467c13414c8ce3b4623a37888dab0a937f1578ed971b0db871f169","sha512":"c551a6f615a8416f3e8f487e23fc3112d45ffacb42fbb18eaa68c9cb7708c26fa62054560438590b33f6785ad7e15eb139cefc37fd63a56f9a3837060c66bee3","ssdeep":"768:sxE/rN/n87lAYd16xuV7WeCAQ9QLWUrU03iIraCx:sG/rd896HHT9QdwCx","tlshash":"45f2e1123ffda03b341ee25f174d998ccc6b2554e57e1bfb2144e046b2a0e642a5e9f4","first_seen":"2025-01-29T13:39:14.654878Z","last_seen":"2026-08-10T01:13:04.308133Z","times_seen":230,"resource_available":false,"data":null}},"time_used":3194,"timings":{"blocked":959,"dns":0,"connect":0,"send":0,"wait":837,"receive":1398,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/index-399e2569.1756903329400.c784c4ca.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:03.398Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/index-399e2569.1756903329400.c784c4ca.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:04 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-5b7d\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049804=h5k4oOZBnH07/tXwPIgLACWo459+P2Pabs9NtfDroPIDrNZiYSJJtMy3o1VcjQflqa1V7B/Z+Nh3eoBMUpChlR5iMn7XhWnsM406Yp37szt6I0vL5Dxr3e26J0gLTDWq4BPO2oJWrWBLw/2asm78ZGKFS0Ej8G3eFlTffCQraOfnlC5OG8KVbdcKmF+pSwvy\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 1BDFC45A-E2E5-4DB7-A04F-053894A7B100\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23421,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (23421), with no line terminators","md5":"6117cdb5accd41ccb0125c70452306f1","sha1":"80f85cd8a495c476087fa382198b2a06f5d309ae","sha256":"794e522144c7d6885ba07f4654bbf62f0b06f1b985a897645092cdf029afcfea","sha512":"1737016527bd862c7804e4dd164e109c7f3a087b5c0a751764c22f8b2fa9a10f4fddb8f98234d4da33eaf7a314648d28eed89c0750dabf2006ee105b6f8a2cc8","ssdeep":"384:EZSANHLDaxKalO7PT/Wy4QfHhwrxrjgIhK47ZyQQvXTcdw5F3oWf0Af/nqxtU8X:HYDaxKUO7LZ4QvhwVEMKUZpe5FYxAfPQ","tlshash":"c6b2c6e63392bda4c24f9276f33a58ecc53f9241c30fc4f8d265bdd47da8644a992684","first_seen":"2025-09-04T00:49:32.717031Z","last_seen":"2025-12-29T13:58:58.089613Z","times_seen":434,"resource_available":true,"data":null}},"time_used":1539,"timings":{"blocked":1320,"dns":0,"connect":0,"send":0,"wait":218,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/chunk-svg.1756903329400.5bf5ebac.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:03.390Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/chunk-svg.1756903329400.5bf5ebac.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:04 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-708ca\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049804=h5k4oOZBnH07/tXwPIgLACWo459+P2Pabs9NtfDroPIDrNZiYSJJtMy3o1VcjQflqa1V7B/Z+Nh3eoBMUpChlR5iMn7XhWnsM406Yp37szt6I0vL5Dxr3e26J0gLTDWq4BPO2oJWrWBLw/2asm78ZGKFS0Ej8G3eFlTffCQraOfnlC5OG8KVbdcKmF+pSwvy\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 1D748877-539A-4044-8E3A-E0AD50338197\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":461002,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65532), with no line terminators","md5":"7f3450cde65c4d0964dcc6d243a1656e","sha1":"ad5b362b491b71dff95398219d8e190c80650865","sha256":"924472178572d451953cbf73efcf577a697b3102176fc17d9ab8c379b6b37bee","sha512":"e8f2350a17821376b71a040626a3d5c58cf5744b22d512fbef45b3246558b0f7001ca4d48d32e34831ec7750e40008f7aef529b4e618c6770bb5e72e4c028cd2","ssdeep":"3072:38nz2uaLZSZvx6Q/sIPrekK+m36Ua94sRZI7gbpU:38nz2uasNxpXPrekK+m36UHsE4pU","tlshash":"7aa4fcb4c190f4edf704ce196e7c9e1c50321688e0a9e9e52da9fe0d9e85d6b241cdec","first_seen":"2025-09-04T00:49:32.781171Z","last_seen":"2025-12-29T13:58:58.073596Z","times_seen":441,"resource_available":true,"data":null}},"time_used":1888,"timings":{"blocked":510,"dns":1,"connect":253,"send":0,"wait":518,"receive":334,"ssl":270},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_ebfde7c7-fdc6-4b58-9f46-2e709f79d7d7.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.765Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_ebfde7c7-fdc6-4b58-9f46-2e709f79d7d7.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 443950\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=deM%2BBsF6W4bXt0wp%2FkImiG3XLYZlyCk0ub99TeayxLRuOPgcBXAgXGJl%2FRNOd2GCZgFAwoD9HLTbKU96fjd8jz%2BeqVAEQxEoIm9IcD4y00Px6F4q0NU92qAgUnk7\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"0a0b476de0285ffcf9a077b66808908a\"\r\nLast-Modified: Mon, 08 Sep 2025 20:42:36 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189694\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac984e1a0856-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049811=yfEHl6AolJP0QC5NkMkOAeL2cxw2cvQEQ0CJoyH0PwylhAu+93HbTVa2aaGzmwCJZPRlEiCkJ/Lezou0DkT7iNjC2gSEaRk5/ITYUs6HFP6vgf9C2kZ+8cKO8dprXM2S7lcJEzc2ZecPldSfp0XqpOhoW/bsw+EQEoKlKZs4TyR039jUu6QbtWk2lIQvTHt+\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 07406019-42A3-419E-A3AD-7FC98991EDF0\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":443950,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"0a0b476de0285ffcf9a077b66808908a","sha1":"c69f9c378ad5b92541d6461966f4eb1e26b5c1be","sha256":"5facd22044586932e08dd8884be7e0df1e6e6e383fa62e4a48e15588173d07e3","sha512":"2354f610c6afb2176c92d08255f091daa234022a17d7baf02641d4599b6efe2845f87b1a5435b2967f9bed66f40ed7cb968fad0cf8a52f77aa023324c110193a","ssdeep":"6144:aJG2OHBVqe8TgOuacNjojaE3MZ84Zz61zNnHeCZWDuWGthjzDrhYunDrofVLeSkD:wG2gXt8TgfKBcZV+DHeCZjWahjDh+VL0","tlshash":"f89423cf58d732c138082647369bd27a71424367682558eccfd28c4e21987ede996baf","first_seen":"2025-08-29T11:05:53.304655Z","last_seen":"2025-12-29T08:12:31.375235Z","times_seen":287,"resource_available":false,"data":null}},"time_used":4937,"timings":{"blocked":4090,"dns":0,"connect":0,"send":0,"wait":206,"receive":641,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/64369.1756903329400.27cb8135.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:03.396Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/64369.1756903329400.27cb8135.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:04 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-269de\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049804=h5k4oOZBnH07/tXwPIgLACWo459+P2Pabs9NtfDroPIDrNZiYSJJtMy3o1VcjQflqa1V7B/Z+Nh3eoBMUpChlR5iMn7XhWnsM406Yp37szt6I0vL5Dxr3e26J0gLTDWq4BPO2oJWrWBLw/2asm78ZGKFS0Ej8G3eFlTffCQraOfnlC5OG8KVbdcKmF+pSwvy\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 7AF127BB-20F2-40CB-8DE5-0AD077610CD9\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":158174,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"ce99014ab42559bc99f808a69bf596c2","sha1":"adf52a59aba8080dae7b97585e346f5aa782141f","sha256":"39076e64a0e5facd6f6f3d4db7f7fa71039c87d4a6250298dd4bd3059bfd9863","sha512":"ede23f1e36658737f40782ab61a166f1a2a6f61957524beefc283035c39337325c487d6236975bd97cf44aa91b31ed6985a3416ef561edd5b977ff02fb6b1b54","ssdeep":"3072:cHW7tB4Vgj5tNlxyU5YegxYffj7TEOiG1Zl+DJVkzEcx1nKR:cHW7tBwgttXxyUtffjAG1T+DJVkzEcxE","tlshash":"6cf31bd4f2c070f6475f45f2a22b1075b26f4d92318c98b0e15ba6597f21a48c7abeec","first_seen":"2025-09-04T00:49:32.946075Z","last_seen":"2025-12-29T13:58:58.086406Z","times_seen":434,"resource_available":true,"data":null}},"time_used":1322,"timings":{"blocked":1079,"dns":0,"connect":0,"send":0,"wait":233,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/api/tenant/domain/list","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.814Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /api/tenant/domain/list HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nx-request-source: https://u65r.xyz\r\nXign: iIwhDYlyBqZlBhqmgEMGuEXuG9d26a/tInbdFyLHDFDHQ9bgdlELqWJUeX6+0ECKqzx4xhM3owIwpQHxuj7NTOQ/77yPOGdRt/nuyOALpJcHq+505edRsKBa9GgGmBu4d5zoyXDgZNg/DbXxhZZMPVxUriSRfif483RPeaibVVQ=\r\ntimestamp: 1761049806809\r\nsign: 2k4766487p1m203r\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: htmZ44nXYhd2SnrNty4ztc2apf5FpAim\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Tue, 21 Oct 2025 12:40:06 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nVary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nX-Content-Type-Options: nosniff\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 5243D1FD-9785-4D49-A812-AEE43885D81D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1108,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5d9e96bd132a2c24281ae50f2b09efe4","sha1":"503ea18100d0f1573baa195933355a1372e93841","sha256":"7f205b18b5deaae96622989dbc8ad73999a9616e96ef26d909f19525deadb328","sha512":"ab5a589dc81944d2fe05d656777e9e490d42a2fd68c7e577387cfdd47c9b0c5276ca2f91a3868407c373e500d00bb5360a5ae035c7c0cb1addf47f20755a268b","ssdeep":"","tlshash":"fb11c6101c6f12c8d6e8d29263503345388d8b76056db91b69d6b74fae0583a32120a4","first_seen":"2025-08-29T11:05:53.144028Z","last_seen":"2026-08-10T17:58:48.488784Z","times_seen":2669,"resource_available":false,"data":null}},"time_used":227,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":226,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/1405917b7a0b082f645588803c890bec2a235?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.390Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/1405917b7a0b082f645588803c890bec2a235?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 1438666\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 605586\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1405917b7a0b082f645588803c890bec2a235\"; filename*=utf-8''1405917b7a0b082f645588803c890bec2a235\r\ncontent-md5: JjECbeW2FIsXldWNKHLerA==\r\ncontent-transfer-encoding: binary\r\netag: \"FgXb6R0oYo-p4rmuEwuA6AMDqTIR\"\r\nlast-modified: Sun, 17 Nov 2024 09:37:03 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-27;QNM3:13\r\nx-m-reqid: PYLNCw3dP\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: SxEAAACl2wqDWW4Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1438666,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 4096 x 4096, 8-bit/color RGBA, non-interlaced","md5":"bab14fe3ebc846e4ad41c2ae530c76bd","sha1":"d699209328aa9e69023fab0e6ed48aa61e8d8a60","sha256":"544e829b4f7a64e8a3c38a7738368780fc2542dd4db4edf98d323bf56f900452","sha512":"61ba1f3a5a3d5fe554175eb2613dea9965364d3a4c0e4a1ade57b984205e9c0b271dbe381f14586f6d8130866d58b18e674bd0ae846763c4aaac0c1e20442cd1","ssdeep":"24576:YbhbEqty6t3k8E9dHu95lnFJgB7XQAp0JafVX/ThGY8dwGfM:CEqtJ3k8E6PDWXQAoaNhGZdw+M","tlshash":"1f2523d98a37c1325d5f55ac6878c7de20298eb7c08a0ff0ddfd602dc688d49a19dad8","first_seen":"2025-10-16T03:42:05.742485Z","last_seen":"2025-10-23T06:32:14.316419Z","times_seen":6,"resource_available":false,"data":null}},"time_used":5116,"timings":{"blocked":1377,"dns":322,"connect":279,"send":0,"wait":617,"receive":1728,"ssl":790},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/110561a473e82e0fb43ef93a6f3fcf0cb43b1?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.468Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/110561a473e82e0fb43ef93a6f3fcf0cb43b1?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 111588\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 181120\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"110561a473e82e0fb43ef93a6f3fcf0cb43b1\"; filename*=utf-8''110561a473e82e0fb43ef93a6f3fcf0cb43b1\r\ncontent-md5: /PYiBFePW7+V0lR1l4G+9w==\r\ncontent-transfer-encoding: binary\r\netag: \"FnLuOtKWBaReXd6Be6iAkKs9sZvW\"\r\nlast-modified: Wed, 06 Jul 2022 12:49:05 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-19;QNM3\r\nx-m-reqid: mmrSWggJc\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: SyEAAAAVs6oSnG8Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":111588,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"fcf62204578f5bbf95d254759781bef7","sha1":"72ee3ad29605a45e5dde817ba88090ab3db19bd6","sha256":"5e9e23710f851cc782cd6f0f0c99130b9146e2ad0ff8a62ca1814329d00958ed","sha512":"244a0e6b0225de5ba708db76f6dde1eef1d04e8acc238d2a6f856d62b6343bcef72a9c72ee4aff63c356b4971c1d2c70baf08cf21d3b8dfe220c7ad74783a59a","ssdeep":"3072:7oIEryPq3mmVRMuQmT3Tkwiv65OB688CwA:0IxmnV2uhgwUIO488tA","tlshash":"adb31236f952973d08b5dc9d799ed3fb34ef8839eaf1520486a9703166200fa924162a","first_seen":"2023-08-17T12:39:31Z","last_seen":"2026-08-10T17:58:48.422744Z","times_seen":200,"resource_available":false,"data":null}},"time_used":3046,"timings":{"blocked":1072,"dns":0,"connect":0,"send":0,"wait":836,"receive":1138,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/100706dc1cd9e2b684a709d0f9b4f1d7c8f24?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.609Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/100706dc1cd9e2b684a709d0f9b4f1d7c8f24?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 18627\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"100706dc1cd9e2b684a709d0f9b4f1d7c8f24\"; filename*=utf-8''100706dc1cd9e2b684a709d0f9b4f1d7c8f24\r\ncontent-md5: r8yeSo/kz5nNQ7CbE2aqwQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fv0DgcnG58wz5BsUtXkHOITLiU_M\"\r\nlast-modified: Wed, 06 Jul 2022 12:49:08 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-24;QNM:yzh155;SRCPROXY:yzh149;SRC_***:51;SRCPROXY:51;QNM3:52;QNM3:80\r\nx-m-reqid: 1NtifEaD8\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: N0MAAAB1EMf3zG8Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18627,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"afcc9e4a8fe4cf99cd43b09b1366aac1","sha1":"fd0381c9c6e7cc33e41b14b579073884cb894fcc","sha256":"13bc64b5bbf85a33997e3adcee020d607c2bcdf311f7f229b3c7913acab94d95","sha512":"d5a087a3ab08941c501585665dd579894ca679e292a40258a67cda1b42deb86b9fb853333c8508b0303d27c5175ebd44205cf716705b8c955427411dda70ed28","ssdeep":"384:ild20o5psaxjws36i1a9LDtANEpjtcSJe1G6dK1Pm6UlfAI:iDaxjDfCGuWG6dKQ6GAI","tlshash":"0982d04d428da34b43ea2c1d7a2111356fb92378193e7c8004fef508a4a92de6bf971e","first_seen":"2023-06-08T21:23:36Z","last_seen":"2026-08-08T01:30:57.882035Z","times_seen":354,"resource_available":false,"data":null}},"time_used":3174,"timings":{"blocked":936,"dns":0,"connect":0,"send":0,"wait":837,"receive":1401,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/86724c0b4877b98ff4c9fbac38a4d237501e8?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.393Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/86724c0b4877b98ff4c9fbac38a4d237501e8?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 1005897\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 446546\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"86724c0b4877b98ff4c9fbac38a4d237501e8\"; filename*=utf-8''86724c0b4877b98ff4c9fbac38a4d237501e8\r\ncontent-md5: 4/DPRx6nAM/hR/kdAi0L7w==\r\ncontent-transfer-encoding: binary\r\netag: \"FjZ7E_icZfrybw5g6_sHN4OWlfpe\"\r\nlast-modified: Sun, 17 Nov 2024 09:47:04 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-18;QNM3:11\r\nx-m-reqid: LZjLcDIlP\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: Gp4AAADysWEo6m4Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1005897,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 4096 x 4096, 8-bit/color RGBA, non-interlaced","md5":"e3f0cf471ea700cfe147f91d022d0bef","sha1":"367b13f89c65faf26f0e60ebfb0737839695fa5e","sha256":"e416d2e1069d05c3b7bc6abf5c45be7640f70dde4bb1e9be53f4609ee06fa065","sha512":"423fcd8ec76c7d620bfceeaa6fc84a3e47f02c0ea6d3c76377ffd8d995aba4019fec155c42122b4f349744e28607e1ad253b04791e7de6f5d0155cb7ded23bdd","ssdeep":"24576:YH3P0sNg/Rw7X/YeqaplwA/ZcXO2ULH3NUyvVaLCOfo8T:of0sK/q7X/3qglBpj3Ew8T","tlshash":"6d2512d4d657c581cd0f11fca93a8aca2a521bf1d2a92df0abf7c02cedc126507495eb","first_seen":"2025-10-14T04:42:34.656567Z","last_seen":"2025-10-23T06:32:14.2315Z","times_seen":8,"resource_available":false,"data":null}},"time_used":4920,"timings":{"blocked":1147,"dns":310,"connect":280,"send":0,"wait":279,"receive":2340,"ssl":559},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/261532532520ed24042d0a29911d6cb7edb47?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.398Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/261532532520ed24042d0a29911d6cb7edb47?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 86427\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"261532532520ed24042d0a29911d6cb7edb47\"; filename*=utf-8''261532532520ed24042d0a29911d6cb7edb47\r\ncontent-md5: pC7Ja9Syy2AlxzQeJ3o4IQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fl1I4kzAoMU8dVHvZGcP_KqWHlSB\"\r\nlast-modified: Wed, 06 Jul 2022 12:50:39 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-21;QNM:cz19;SRCPROXY:cz13;SRC_***:33;SRCPROXY:33;QNM3:36;QNM3:171\r\nx-m-reqid: f5hFrBExn\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: UssAAADRhgQEgHAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":86427,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGB, non-interlaced","md5":"a42ec96bd4b2cb6025c7341e277a3821","sha1":"5d48e24cc0a0c53c7551ef64670ffcaa961e5481","sha256":"cf935f592831fefb5020579e432319334792f55faa5d1b48b89873e88e4880e8","sha512":"8b09c98dc52ea2693aab9da8d47b0cdf81e779350e9a3382a651d27247233b09026ac72b5d5425f627d8372c03471e0d2077a8cb43946a6d960fa2647522489e","ssdeep":"1536:5XtEadrbkxUUI4N3T/oR6piBIa/4dD5NcgcgEW1zesSuIixAE:5XtEad3SyS3T/z8yb5N9JSuIixL","tlshash":"9383013220f8394f97ae6dfa957483d240007a72894c1548af8d2764f6edff25b9818e","first_seen":"2025-10-21T12:31:20.516252Z","last_seen":"2025-10-21T12:31:43.601745Z","times_seen":2,"resource_available":false,"data":null}},"time_used":4520,"timings":{"blocked":1381,"dns":314,"connect":280,"send":0,"wait":605,"receive":1137,"ssl":795},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/8953c3b5-a3a1-4b97-a677-4b5efb3fb94a.jpg","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.825Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/8953c3b5-a3a1-4b97-a677-4b5efb3fb94a.jpg HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:12 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GalKe%2BBv7gXnBe1ebVzXXA5dqtL3Zn8xDys0IAkhuny4oGZEve88j7Wflls02Hh3cDWZtjNPzO7yL8G2QIgFZ5TAVT3g5c10LiWrFKEyZF0k8y25pmuBcNzMEd1s\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"4ba8eca994e0876f66da342a8f47763e\"\r\nLast-Modified: Mon, 25 Aug 2025 07:00:16 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 47696\r\ncf-cache-status: HIT\r\nCF-RAY: 9920c3d2be001fa4-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049812=rdeenGOu7oPbUjAiCKj7mQM/L2CZSERSb8B0wFuL8iAz8yGt/SZrwN9hzq//Jfkm2RgBtTQd0nDutTI6d6QWpAWOCgfp5dAbbfEI67TXctUIUufT2Gr4Y/EGVzH3Ds++pR5m1dg201x3t0V1APCXAY3Xdycq4n4xNiX+U+u5NzhLl7ERx+6lMbVyMrOoYSkT\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 06C532E8-32B1-4461-9BEE-FE16F6AC6BE2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":359196,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"4ba8eca994e0876f66da342a8f47763e","sha1":"5f483535de56c4253674b0a35d3877d0dd200a82","sha256":"0f95823dd45056d46accd12818e592b49ac3f5050accf68610b4371c62320ede","sha512":"6b69475dcf180cb83d799e6fce9c07ecd91df196e3821adbcd7f4eb90c3831799ba864e2c35760f72d2dc5e5e7e3b74726a83efab3f5a1c3234d965e46def7c7","ssdeep":"6144:dqJy3fkqKTt3/vdG/ZHOMjOUZgO1EjSa+6V4IG1ukzX+wPpoSLB/ON:2wstNGJZjhu6EL+sGIqJs","tlshash":"4f7412e67e777d4b86b68fb6f3d02e4811919b02dce115487854f42328eb0ece89ec59","first_seen":"2025-08-29T11:05:53.189307Z","last_seen":"2025-12-29T12:28:25.234625Z","times_seen":340,"resource_available":false,"data":null}},"time_used":5416,"timings":{"blocked":4885,"dns":0,"connect":0,"send":0,"wait":357,"receive":174,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.318Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://u65r.xyz\r\nXign: iVUmZ+NtUFPQ1GW5oxdXRcMzHkVdgeO+lIttb2i/BRwtunJ2WdV+uqv4gdrqb9Zwo+I15LO5ghSTJzmEylJELtaMeBDEBaYj8oCez1YFUzwv1qsMd5Z/JgiQf6081e9wbdiZuinroFc1opljRYA0XcHvu4l8WD83Fz8QW5i1DjU=\r\ntimestamp: 1761049806283\r\nsign: j3i7t267k2u2b2kl\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: htmZ44nXYhd2SnrNty4ztc2apf5FpAim\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Tue, 21 Oct 2025 12:40:06 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: E4F4CD01-084C-41D8-AE89-669A053CD6F2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6556,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"ba12473e8df0ea322e3305b0ae59609e","sha1":"f4b789c8cb9dc73062ac64339b0f6e87ddcbbbc7","sha256":"95863711cb727994753c0972a2c5407a430333a87166091501d34d4258844973","sha512":"b6dfc7e4afb149b9c3bdff8bfc627cb0e5ffc61a39f1aa64f4bd191674a7ccfb2798d335c5bdfb213dd700d887e397c8b5f8c34b9bd2f94c38ea29581ad026a6","ssdeep":"192:Vca8lKBA7Wqyi3BnhneHGAZrwUK8ge37LdMXA4SRJBfdJgrGfMOMg:vZ27WdwBJUNeUK8gerASqOMg","tlshash":"e012af1ad7715704b03a40eeb50bcb84b11d519bffe6bba9ca5049e518a010875fc26b","first_seen":"2025-10-21T12:31:20.522516Z","last_seen":"2025-10-21T19:10:13.010801Z","times_seen":2,"resource_available":false,"data":null}},"time_used":282,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":281,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_4d4d0270-e129-42d7-8f6f-0802c910d540.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.688Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_4d4d0270-e129-42d7-8f6f-0802c910d540.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 98652\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nEHcs7NH2MO12TSF9%2F3gKVW9fQ89TVVffJdY%2FPGRHtqj%2FI%2BOfqxYcS4oYYi0xZA4lo3yubelPnNY78R7eKVwdCctm2u6PduGqQ66Uf%2F22an4rT1Du6ooSMTLg4Fz\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"74973ccf04bec417d676dfe9f7d015d9\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:34 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189694\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac8b5d56860a-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 928420B7-6043-44BF-B32C-CAE242750588\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":98652,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"74973ccf04bec417d676dfe9f7d015d9","sha1":"e7e62ac239d28e2b8dac2d8cfd8d9615731fd3f1","sha256":"58df7978ec4544d5cb054faaaf9245726ffe8d23c90b5855c532e94c0f18d1af","sha512":"03a7edc294e891fbd39caaf37374b49c5a3442fb67818cb7c627b79fb5efa03523d58e3c05cc390b502be6343c5f893528eba6bc9ddf823dc250667cc41dc9c4","ssdeep":"1536:CFBr22t7Zt8sNmGduq1o9TFb6LSPkOUOW8lX+wm8fCT2xt7ckUz+PevOx8EE:WLJSGd69cakf6j/fK2H7ck/KKK","tlshash":"60a3023e741267f2d3e1ec8fe2d5ca4b52e5d0bb41634183326e104a4f66e219b5af47","first_seen":"2025-08-29T11:05:53.331862Z","last_seen":"2025-12-29T13:58:57.997464Z","times_seen":294,"resource_available":false,"data":null}},"time_used":1556,"timings":{"blocked":1349,"dns":0,"connect":0,"send":0,"wait":201,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_95e34ac6-aa0b-4d3f-9ae0-451b7e2983d6.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.768Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_95e34ac6-aa0b-4d3f-9ae0-451b7e2983d6.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 438063\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O9Ny8QlpUWNGxabhFhWjmACDq1B6c7Ej8qKsxSEFF38B4zHEhDK9ChTLZvHLneITA8mKsaoJgfx%2FzsnlcgvMs53rdpMiIyyfUpzLKj03xpsfBLhf0Kv2x48p5HE4\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"c6ff174b67891a7651c6946ba0093c36\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:24 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189699\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac7daeef107e-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049812=rdeenGOu7oPbUjAiCKj7mQM/L2CZSERSb8B0wFuL8iAz8yGt/SZrwN9hzq//Jfkm2RgBtTQd0nDutTI6d6QWpAWOCgfp5dAbbfEI67TXctUIUufT2Gr4Y/EGVzH3Ds++pR5m1dg201x3t0V1APCXAY3Xdycq4n4xNiX+U+u5NzhLl7ERx+6lMbVyMrOoYSkT\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: FDD934FE-4743-4A54-96C1-6F4BD7C58522\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":438063,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"c6ff174b67891a7651c6946ba0093c36","sha1":"9d06251e9b8c421726b82f55fff19b2a854cb2cd","sha256":"c04aba88088a64ef4e63d88f5502f7073bfcbe25365c8445ace5013ce2a251d3","sha512":"acac318e6335c4dfe2deabd41b9b002dc9b62c1c4bae0b51e0a493949aebc14845b2b08d9df2e0073f6b282a512283ab4432d4c41ec8dc56405803beece73010","ssdeep":"12288:NtVyoEN5CQHKmFDdTNM0mCsjVXVM+OMPMTmT:NtVyoqCnmW0mnjVX7Z","tlshash":"1a9423683441290e0074e65e8b8403535735dcfcaa3e69f1ba7c31a96c7ea3b46fa75c","first_seen":"2025-08-29T11:05:53.2152Z","last_seen":"2025-12-29T13:58:58.066851Z","times_seen":287,"resource_available":false,"data":null}},"time_used":4475,"timings":{"blocked":4249,"dns":0,"connect":0,"send":0,"wait":200,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/ecb/8f83064249b06e0660afdb30b60772fdcdfbb3036f","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.307Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /ecb/8f83064249b06e0660afdb30b60772fdcdfbb3036f HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://u65r.xyz\r\nXign: NZuf0ymYqmCxfphveI9kgxztZgr6heoruKreTJsdurqeF1GkMpRlGwvlV2G1t8ZIQson1VW6mtNPi1JaF/7kbyDfZMNtzeC2w7ySmPX9HRSEsm8wMd6cFGnuelgv6B428OK9bdEjd+l/70QxzypRrasE+4G39iQYbFzF8iop9ks=\r\ntimestamp: 1761049806283\r\nsign: 2l66323a3s3r627j\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: htmZ44nXYhd2SnrNty4ztc2apf5FpAim\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Tue, 21 Oct 2025 12:40:06 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 234C28D3-27DE-4385-8A6A-AFC02933AD63\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3821,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"12f9dea7aeade7584b9c7eb8d04cc7c5","sha1":"c2bf0b980b287bd89c9f9287c37ad83a1df3ccdd","sha256":"31c3de2fa81079ea0fa09afa4ae86d3cad695db66fe6d4d617c2b70cb5118c5c","sha512":"0428028cc5e897d6949f26b0c6b46983883c3779ad5bdb10502e50474f779ffbf32b19ea190e7b61a70eff78f5e82d104960b26e51f9ea2147d5aa03cc0bd81a","ssdeep":"96:eOG3iMFIoI1lhyVdz6XVu4y40fcMt7AoL4dhUV0mxqDOExJauHUVjE9yf9spPYb:VL0Umj+XVu401AoL4dhUV5qJx1h9qCpQ","tlshash":"17c16e4874a4e3eceda956f87402286467525b867ec36805dacec3f35dc795191ce8c2","first_seen":"2025-10-21T12:31:20.528271Z","last_seen":"2025-10-21T19:10:13.046659Z","times_seen":2,"resource_available":false,"data":null}},"time_used":528,"timings":{"blocked":265,"dns":0,"connect":0,"send":0,"wait":263,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_2cf32c0e-cd2d-4274-8e00-d67d14e5086e.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.695Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_2cf32c0e-cd2d-4274-8e00-d67d14e5086e.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 74420\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tnmEfm6DeIsfOp0Q4kkZ9Gb0I8LvGV0jIxpNDpciddMgsAOhPJoo9O6721GrzumDALxYEiQyyzwtp%2FK2L%2F94MNxCM2GcgswbEB0Yq%2FxXsAp%2B5%2F%2BjxQRQlY4T3utE\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"483193845ef29fea49d165317ef2a6a8\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:11 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189681\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacdd3a545e06-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: BEB02AC7-0524-4BAE-B4A5-26C45C9C7D19\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":74420,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"483193845ef29fea49d165317ef2a6a8","sha1":"382aac96ac623bba78227df264daa66115b46e79","sha256":"d6095539bf6cd1bba243fb281b4dd9acf6c4ef964c08f34a9975ecd505499b5f","sha512":"df72aa1d9dc0dd7d6bd87da0d8c72a43ed9dfc444f66db87015a7fb88fc0562ab41a58ca8ba7fd3022c2aa2b52bd61a06b6ec7761978ebf3bd1403bab35565d8","ssdeep":"1536:IyTkZ3JcWGau5IModpGPs+ucKQpFc6+bbyemwMUghiwcoKB0yygRE:EZ3JcWwSpCLFCbyemf1opG","tlshash":"d773f14220534128e78f7076eafabf8ed68270f5f8a527b5cc098ab515c4e1334de769","first_seen":"2025-08-29T11:05:53.093551Z","last_seen":"2025-12-29T08:12:31.398122Z","times_seen":292,"resource_available":false,"data":null}},"time_used":1733,"timings":{"blocked":1473,"dns":0,"connect":0,"send":0,"wait":257,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/home.1756903329400.bfa8c420.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.398Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/home.1756903329400.bfa8c420.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:05 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-2d959\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049805=po6D+l8dMhfLGKAdfLLnVeIRbjpxlkQDEuGKbtlEOTQWkshI6okgIymixUARr4wGybpILVpsVTfVc7k0JaAkDpC9mG+fNrxEIVp7sH1o9IEd57siolGhKy+cprba9qHT4pkoamaJpfQkaW28kwG1+DFqQQxzksZj++jdxZwG6L+cO51eyJYwemgSWglzoiWi\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 31A2F76A-8EF7-4C5A-8EE9-6EC5684C2AFD\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":186713,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64200), with no line terminators","md5":"caeef6f42deb46a855ccb60a2ed5b445","sha1":"13594059c305a13f3f001270017ab9aaa21443c2","sha256":"ede9bdf96f357afd7f61662fc1654334932bdf9d3e0ad7e9581a792bf2912530","sha512":"0f28cdf6693505cf9c674caa54a226cb16de87aead1b75244f3c6e68ee5d206b133b3e5f081aa9a1db2b285e8ac607f1a1a289401afb0b6404b3e2865d0d9d03","ssdeep":"3072:f1E8oNSIMrtwsAFJBuokQvFUqlGSBJZhxffj7TEOiGRA3:f1E8oNSIMrtwsANKUFHzffjAGa3","tlshash":"c3040880b5f0e275575fd2bbd7371024b22b1686d0ccac60e1f66b187e18799b236db8","first_seen":"2025-09-04T00:49:32.93504Z","last_seen":"2025-12-29T13:58:57.964054Z","times_seen":424,"resource_available":true,"data":null}},"time_used":302,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":296,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/kc523-1/download/download_nav.png?1756903280095","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.321Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /kc523-1/download/download_nav.png?1756903280095 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 180314\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-2c05a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nAge: 101405\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: A2DFFA03-8015-4A82-8B1D-B9AB98D25EA7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":180314,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 820 x 600, 8-bit colormap, non-interlaced","md5":"87eaffe415a7eb41b7b4b8a868bb3b32","sha1":"575618003efbf8dc8ea781379aeff463cd0cc498","sha256":"4264138e0c015e52e3efa14e34ce9c52490316935b4667756ea631b96eca64dd","sha512":"2b06fbacffed6de2fb1d4a6db2cbd0d9c5c790f9b5a10a6dceac64ff69d300f20628c465a720102da9bd857c80be886ab0a37848929741d2bdef6eddbe0de8bf","ssdeep":"3072:iWlCRQlVF5aSW/mUdJSu3405ovKFzkRKcZjF9Km/mKg/hPFsQBhXRU0K:iWM2I405oCRncZHL/mKWBhXRU0K","tlshash":"0f0412cc23773ffbf8a0865a83fbc1599c3bfd0824e56722ea1662b5186053145a59cb","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.552654Z","times_seen":2034,"resource_available":false,"data":null}},"time_used":3140,"timings":{"blocked":2627,"dns":0,"connect":0,"send":0,"wait":249,"receive":264,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/183421873b81ea0904f1f9758cb5fe7121089?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.629Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/183421873b81ea0904f1f9758cb5fe7121089?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 78265\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"183421873b81ea0904f1f9758cb5fe7121089\"; filename*=utf-8''183421873b81ea0904f1f9758cb5fe7121089\r\ncontent-md5: hirk9SlDDgUkKMvJ4CHWAg==\r\ncontent-transfer-encoding: binary\r\netag: \"FkWnI8ErMOShfiAb0RD_LH901OET\"\r\nlast-modified: Wed, 06 Jul 2022 13:04:39 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-2;QNM3\r\nx-m-reqid: Jrk1YnrMa\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: J3kAAADFgeqrgHAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":78265,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 765 x 759, 8-bit/color RGBA, non-interlaced","md5":"862ae4f529430e052428cbc9e021d602","sha1":"45a723c12b30e4a17e201bd110ff2c7f74d4e113","sha256":"ffd12a15aaae9a33b8b12382d9826550c979ef22fac01d7f3f5fe9e7af06c8cf","sha512":"0c4f7ef18ed1008ea0452f57be4b90b1025e394bb1f93e4cc557ca0dc9d5d6531014fbb248abfbc329cc6b5262ce66d7883d77cb49ef22d15f080827157fb87b","ssdeep":"1536:CG1VG9KsdypIHIEHhoslMAint/vWC0EiNTfrtOII5yeYGTJL+h:b1VMrakaAihb0EQj058","tlshash":"9f730284acd6e013f81442e2d749be4bf8ea26f465d1be0c9f9d825363ddc7282e5075","first_seen":"2025-03-16T06:48:52.200376Z","last_seen":"2025-12-10T16:04:37.909056Z","times_seen":134,"resource_available":false,"data":null}},"time_used":3431,"timings":{"blocked":916,"dns":0,"connect":0,"send":0,"wait":839,"receive":1676,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_07a2d840-d1e1-4217-9d3b-badf80b88abd.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.690Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_07a2d840-d1e1-4217-9d3b-badf80b88abd.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 486455\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D9RD3XHN5odxeCn%2BzqxVQcbT0w5I9Rn7NlJ5rZCssDFor4ew1mDGdAnANuUGsip4UEvNLyI%2FiPUxo7uEUW2ayxYvFq3TTapiRdoe1TiUpL9EZUl3SC2uAkO8yZpj\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"611135936dde834c3aaf7a7221c0c4a8\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:28 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189696\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac7b1c207eb1-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: B1C510B2-866A-4C31-939F-95667E48F855\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":486455,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"611135936dde834c3aaf7a7221c0c4a8","sha1":"bc54ddd95adc718bcccdf0606743046d161d74e9","sha256":"047e2dd38d93d1572c3871f71ae7f34e7506798853bc471d8330436de6c2e353","sha512":"b0bf93ab6e9041970ae87f14a519087735218c795f479c3107b5105d9d7dd9ab13589460fd5657cb79f1bb648e0b3ff1f02c1b9921febf635559f1ba8f426f9c","ssdeep":"12288:J8cUsxN26nlb9TH9sr2oZKpArG0jMh2dUwJRgD:lzxN24HTdcKajMbwvg","tlshash":"19a423e1f6a044efe955ee721e640738b05b65c8c36c7e4056ca943b9f6331e9d0f092","first_seen":"2025-08-29T11:05:53.277372Z","last_seen":"2025-12-29T08:12:31.331218Z","times_seen":285,"resource_available":false,"data":null}},"time_used":1810,"timings":{"blocked":1387,"dns":0,"connect":0,"send":0,"wait":206,"receive":217,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_de72e240-4300-48d6-8f6e-b9cb363e7924.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.764Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_de72e240-4300-48d6-8f6e-b9cb363e7924.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 117698\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ENqzPMCIJnLRRzPwttE19fA9bC4akMyXDigLWsfYmYzoHEk7kqNaKACAW8sQOsy1JWUM33reuw3kE4DCGXCS0RsG%2F67z1KiQFG2HFQXXsQBAjALr7h7YZ8y5Jg%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"875d51b8597a97b96daa5c4c3eaafefd\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:15 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189683\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacd919643ee9-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049811=yfEHl6AolJP0QC5NkMkOAeL2cxw2cvQEQ0CJoyH0PwylhAu+93HbTVa2aaGzmwCJZPRlEiCkJ/Lezou0DkT7iNjC2gSEaRk5/ITYUs6HFP6vgf9C2kZ+8cKO8dprXM2S7lcJEzc2ZecPldSfp0XqpOhoW/bsw+EQEoKlKZs4TyR039jUu6QbtWk2lIQvTHt+\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: D82333F0-AD80-480A-BD2C-0C6435A092DC\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":117698,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"875d51b8597a97b96daa5c4c3eaafefd","sha1":"bdbe15944aacbb25d3795a9882751bab0e25aa41","sha256":"5cd3cd5c2a9dd3c20ddbfbcdff886459c3dd0a3bede9ce34e1daf9059e375ea0","sha512":"718dbdb9f5dd7fe65fbcf893c416cf87efecd27eb6e9f8af92efb0cb0f5ed2831fa5a805b510322c7232db68a958b29d6bb9b3dc9ee1f0f811ef5579a71e0289","ssdeep":"3072:VqUdofN7Rg/0SAT7MpXyPJ1ZpIZlUij14AtAR9e:AUstSAT7vPKlUij+DR9e","tlshash":"7eb312f3e46e905be7bf016c22329c100d7905aa9b7e48d6a9d34b221cddeb2dcf4554","first_seen":"2025-08-29T11:05:53.31739Z","last_seen":"2025-12-27T06:51:48.781217Z","times_seen":291,"resource_available":false,"data":null}},"time_used":4152,"timings":{"blocked":3875,"dns":0,"connect":0,"send":0,"wait":272,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_91f2d885-8341-4928-bace-352c8c691bef.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.772Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_91f2d885-8341-4928-bace-352c8c691bef.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 21794\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uCBsP7MlFgQ3XaYi71p2vQr1dVWU9VIIHJYhEpOFDJTqFYLQNAIuDv%2BRw0J3wkVfpO3gjgQ01FJpNreQVP72lgJBnKu9%2BeclJNSSG%2BsQf8nvUUUHtZv5Z6sOzQ%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"05954182d3e76bcba1d9910b7be852aa\"\r\nLast-Modified: Mon, 08 Sep 2025 20:50:48 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189695\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac943ba78b83-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049812=rdeenGOu7oPbUjAiCKj7mQM/L2CZSERSb8B0wFuL8iAz8yGt/SZrwN9hzq//Jfkm2RgBtTQd0nDutTI6d6QWpAWOCgfp5dAbbfEI67TXctUIUufT2Gr4Y/EGVzH3Ds++pR5m1dg201x3t0V1APCXAY3Xdycq4n4xNiX+U+u5NzhLl7ERx+6lMbVyMrOoYSkT\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 51CAF6B3-25B5-4A73-98C2-B1594044680B\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21794,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"05954182d3e76bcba1d9910b7be852aa","sha1":"3617dd01f0d33d63148a64c12fa0fc800d5329d9","sha256":"74e1f25ab615997c5ccbc6b22e6f6f8ad738fc1b4f347ef2161aa7e0462fca0f","sha512":"b3979ea799e42e976794e05449f2345983d6ca8b5fa3a8aefcdd0361a6eed1ee9bf7099339cba4e814c468077d65c295028093b54b92adbe681dac638a1a47f7","ssdeep":"384:ITj2Gcb4jiuqtG/BJCcX6w849XLCXk4jaQR1SkZPKNCFDWDIzDH9M49r9b:ajk4j/yOhl7CXJ+QLSQPKNeN3v9Zb","tlshash":"c4a2d1f94f476cb8ed9f14b4a37d1360d3a85b8af12197ac12d31a6cdde04321a15aac","first_seen":"2025-08-29T11:05:53.291531Z","last_seen":"2025-12-29T13:58:58.043263Z","times_seen":299,"resource_available":false,"data":null}},"time_used":4672,"timings":{"blocked":4471,"dns":0,"connect":0,"send":0,"wait":200,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/f0600e57-43d6-4af4-8f1c-08ad10ecab8d.jpg","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.821Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/f0600e57-43d6-4af4-8f1c-08ad10ecab8d.jpg HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:12 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xO5AOAztZuNZJUFvIAlC%2Bow%2B4kDDxUXciN%2FEMQBY4WOZb76lmM7MG3zi1Y5wBGSx8olQWanwNhmZGi9vIuwHpVWiPNhtGAWBaqmG%2F8fHvoikdMFTmhzT1xzVB3Iw\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"a66ab14232d9530ba56c6b3cf1a838ce\"\r\nLast-Modified: Mon, 25 Aug 2025 07:06:16 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 26749\r\ncf-cache-status: HIT\r\nCF-RAY: 9920c3d22b760707-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049812=rdeenGOu7oPbUjAiCKj7mQM/L2CZSERSb8B0wFuL8iAz8yGt/SZrwN9hzq//Jfkm2RgBtTQd0nDutTI6d6QWpAWOCgfp5dAbbfEI67TXctUIUufT2Gr4Y/EGVzH3Ds++pR5m1dg201x3t0V1APCXAY3Xdycq4n4xNiX+U+u5NzhLl7ERx+6lMbVyMrOoYSkT\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: 33BD0AF7-272A-4BFD-94A1-7EF90BA71936\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":396057,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"a66ab14232d9530ba56c6b3cf1a838ce","sha1":"7e1bd193a64756193437d09ab24ad5d6f9c1651a","sha256":"0baad519e4642a8a4454ae51b511aa61c9619a1825d1e5e29265e1009c0dadbf","sha512":"f146ae5c96ebc25388e2a67ead2f02256a7b49452031debe3ceea88efa07a1699302508dc2480641c2283786649dbad3d619a3eda67546e2180b2fe2179fdb54","ssdeep":"6144:RnkD2g7Xp2j6ic0qwwyN3TV9rOxsiitOVWkjtA8xsf5eCnqLhAi5iZS8fVSA:JQ7p2j6rxwwyNniM+WkjtAgErq18k8fV","tlshash":"668423b2c8fac94a736bf975649d99469024fc4f36df5cf9e1249c2f7602a32690813c","first_seen":"2025-08-29T11:05:53.269151Z","last_seen":"2025-12-29T13:58:58.048972Z","times_seen":342,"resource_available":false,"data":null}},"time_used":5673,"timings":{"blocked":4832,"dns":0,"connect":0,"send":0,"wait":291,"receive":550,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/css/52388.1756903329400.023ec95e.css","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.775Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /css/52388.1756903329400.023ec95e.css HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:05 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-10ce\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049805=po6D+l8dMhfLGKAdfLLnVeIRbjpxlkQDEuGKbtlEOTQWkshI6okgIymixUARr4wGybpILVpsVTfVc7k0JaAkDpC9mG+fNrxEIVp7sH1o9IEd57siolGhKy+cprba9qHT4pkoamaJpfQkaW28kwG1+DFqQQxzksZj++jdxZwG6L+cO51eyJYwemgSWglzoiWi\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: F00D77CE-F7D5-465B-B463-93629C54918D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4302,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4302), with no line terminators","md5":"4efa3b550af4fa3ebee130f514631a7c","sha1":"52f29a161a644ebd6eb64fdc07b98e62115eec6e","sha256":"9b87a918545ad75490c79272f4c435c319793820eef518ca60893ba92fbbc8cf","sha512":"096e5f166461728d63ce720dec1310e40390420bfd76d5d13406ad6f2720a55ef6131fcc40f021c6029eec962a1315614a0c7cae55717e6d3466bbabd48dfa43","ssdeep":"96:k8WL6Lfl5F3fPFqNu9h0ShU1ulYUsH270RHeO5k0IWlLBUWl1dLIrEjWm//:k0Lfl5F3fPFqNu96ShU1ullsH270RHe4","tlshash":"2c91124bf89ca23f58bab7ac59c7a55da45644059b270aade31c35e0438b4e0c133eec","first_seen":"2025-08-05T06:40:24.237782Z","last_seen":"2026-04-26T06:01:09.995598Z","times_seen":1255,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":254,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/11343ecd21d66f89e49a7939dda5757bec66f?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.526Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/11343ecd21d66f89e49a7939dda5757bec66f?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 53002\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"11343ecd21d66f89e49a7939dda5757bec66f\"; filename*=utf-8''11343ecd21d66f89e49a7939dda5757bec66f\r\ncontent-md5: KdGDfCGb8ejr4hyA5kt68A==\r\ncontent-transfer-encoding: binary\r\netag: \"FvnFlmOYQKbgCaa-sI-_4nF8qc6d\"\r\nlast-modified: Wed, 06 Jul 2022 12:52:44 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-23;QNM3\r\nx-m-reqid: jfen34zr0\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: a08AAACqvuctSHAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":53002,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 251 x 246, 8-bit/color RGBA, non-interlaced","md5":"29d1837c219bf1e8ebe21c80e64b7af0","sha1":"f9c596639840a6e009a6beb08fbfe2717ca9ce9d","sha256":"26f8463ef7e9a742592e62bb923ddc3da7c191863f9dd02235dfc81a07a3f952","sha512":"77aeae6c99e51967fcfb353b7ead91d14571ad8e99ad4f53e2146582b17bab5e627187dc7960cb9632c7266947c0b335c96cf5c6e5d2a572123f8185c68fc517","ssdeep":"768:cISAY/AhUVixCSAohAGWsTdOKHVOf1C2zeJ5hzSrfcvqzoTn+6cgNcmzI4kfObpC:HS0xRsGWsTA8SteJv4GnLlc6cu5aOsP","tlshash":"1c3301307cf537bfbe9756304e098bccdbb3ce992abd9a121a6062124592f74a7c0d51","first_seen":"2025-09-27T19:21:32.378247Z","last_seen":"2026-05-24T17:56:38.693609Z","times_seen":223,"resource_available":false,"data":null}},"time_used":2971,"timings":{"blocked":1016,"dns":0,"connect":0,"send":0,"wait":837,"receive":1118,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_e9ecc337-e18a-4722-9eda-2e27fa32dae5.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_e9ecc337-e18a-4722-9eda-2e27fa32dae5.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 132257\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7xZbenIr4q2UKLFYV46wnp4QsfvEXRvRw3vm%2FjF2tNJNgy5gPXq5h6WwLTVcZfYix6nZbaIFcO9CCoL%2BO4y%2BNBmQsq473cCSr0CAFIkoZY08YAnZkgcabI2IDA%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"5cdbeb01fd724f1bb7cab656a7f26600\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:21 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189686\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacbf1c05cf4c-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049810=8XOhqPYzNvtuGG/4OcysAi/9c1Ix5YgXavBiBH6qc9bjm9WqeG2yII9Rd1CIWAUKAG0FxykRuvJXzDnxMKqk+rS68KDMASNbTzkdswwt4XDucm6b5py1vQ6G35la3BMmWsZTXXT6A4L15Kx99KWkHMnTvjv0qUeu4ZUmFH0QFz5BQ+0r3VTY4mBrhnaqQbQB\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: DB66657B-BB67-4F53-8D22-1D5FF77D3836\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":132257,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"5cdbeb01fd724f1bb7cab656a7f26600","sha1":"cda5b8d10d40b3644d7338a4954bb2aacfd9ea42","sha256":"94ab7c32c0b1b4b526b394c0e9ef60da57601f69a4e57c155f689b5e8c7d2aed","sha512":"275c1f05f6dcb147ba73a5c089de897e605f4a4b758097024690aac3bcd9d8883bccadac6b8e02abe24673147fe431159f9eb0b1f77b0b556e42c6fd302bbf52","ssdeep":"3072:t3HnneSTvjcHceoD9xTo8pDbH6n1apXCp6f3nO5xe/VKUS:h3r289NDbHw1Ppq3PxS","tlshash":"e4d31286f50f3842f0f507f7ee699bbc8132b8185a76a08c2521faadcfdd1591b5c095","first_seen":"2025-08-29T11:05:53.29294Z","last_seen":"2025-12-04T08:51:36.794732Z","times_seen":238,"resource_available":false,"data":null}},"time_used":2445,"timings":{"blocked":2232,"dns":0,"connect":0,"send":0,"wait":207,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/EGAME.d289cd48.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.933Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/EGAME.d289cd48.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 59546\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-e89a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049808=sBeSKsiafNlkKsLs4C/dAiFvvIebGS1CCiZrVBTiq6N2BrMHJO/A06D5FyfgjgTxmm65szHCxvbeWCjEoLhX52ZT+6aWyh2Ly2dWJuSrJO8MDlgQ2vONi+MIwEavNqtGmMx1nEqf7c6BCaib745OKSMBePL4GHCI7LEl0G2xpUJD22vca5uX8ey/KW8PlWax\r\nAge: 117968\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 23B89C2C-59E0-4D3A-9CCB-0BAF265A5322\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59546,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"eb8991eb9e0db175522c914343f0a10a","sha1":"ce2d41b154df64421d46bceaeb9878da455592dd","sha256":"b837b4e9fc693e5c65eb049c56547caefe1cf73ea31ae59f95ae46d052fd36b2","sha512":"7d2a886e3ac412f6ea1b1ba290064373e1d07a0751bdd7f546af3116ad057d1f17bbe4847179cdf87297a967c0290280ec0c51ab9bfdeb1da0b881e366eb19a8","ssdeep":"1536:hvA9R/SReJczzaRBd6s3DhCDnQcvyFVWGDnmhKYNa67:hIPVczevUIhCDnQc21C7Na67","tlshash":"dd430276882a8fcd499304944bf9afe164eaf19097b3cf91f24c5fe0423d184d881b6b","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.515029Z","times_seen":2344,"resource_available":false,"data":null}},"time_used":1204,"timings":{"blocked":971,"dns":0,"connect":0,"send":0,"wait":229,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/1315053a555eb57df40c7bfbbdbd85ff85cbf?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.490Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/1315053a555eb57df40c7bfbbdbd85ff85cbf?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 137572\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1315053a555eb57df40c7bfbbdbd85ff85cbf\"; filename*=utf-8''1315053a555eb57df40c7bfbbdbd85ff85cbf\r\ncontent-md5: 7DEy0rJdlso6Z48rxbuyWA==\r\ncontent-transfer-encoding: binary\r\netag: \"FgGGmmspj0_g-hJL5oDcEVCvih_q\"\r\nlast-modified: Wed, 06 Jul 2022 13:02:25 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-23;QNM3\r\nx-m-reqid: jeyVNQBsa\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: oIgAAAARIiC4RXAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":137572,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 356, 8-bit/color RGBA, non-interlaced","md5":"ec3132d2b25d96ca3a678f2bc5bbb258","sha1":"01869a6b298f4fe0fa124be680dc1150af8a1fea","sha256":"d1e6d43a87b913f620b7f4f5736dc7f7c226249c8ef8a2ef11ca52d425850b49","sha512":"bfd1ac05a2256d14d1e5ca00c12e223bb1c0792e5a0ae8e478e9616ee09dfe539bfb6aa23fd8e3360bd086bfe236e9d43685ceb2799113385c581645f7962e4f","ssdeep":"3072:WEHXoPeWmlOgX12r8DYgTuGRXziCbWuCgbceSbDlhKqi/:WMYGzAO12r2uIUgIHDlhC/","tlshash":"e2d3128c7e6407431cc8fb05b3fa94384989c292d6fc7d29668d9ee81a54ec714da377","first_seen":"2025-02-04T17:13:01.177963Z","last_seen":"2026-08-03T16:03:42.336035Z","times_seen":51,"resource_available":false,"data":null}},"time_used":3300,"timings":{"blocked":1051,"dns":0,"connect":0,"send":0,"wait":836,"receive":1413,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/103386948423d31364664970bc01e5608f534?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.559Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/103386948423d31364664970bc01e5608f534?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 7999\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"103386948423d31364664970bc01e5608f534\"; filename*=utf-8''103386948423d31364664970bc01e5608f534\r\ncontent-md5: ciewsEiuEHWMc4nKANm1iQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fs7O26c2kU2t5U-RZdntC79K79_i\"\r\nlast-modified: Wed, 06 Jul 2022 12:54:47 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-29;QNM:cz20;SRCPROXY:cz17;SRC_***:34/304;SRCPROXY:34/304;QNM3:36/304;QNM3:67\r\nx-m-reqid: eXwpedFRb\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Validate,Hit\r\nx-reqid: WgIAAAC8NLrPUnAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7999,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"7227b0b048ae10758c7389ca00d9b589","sha1":"cecedba736914dade54f9165d9ed0bbf4aefdfe2","sha256":"93eedeb04a32485f62e54e834b9d7366ebebef7fc60768667c10f1719f486a81","sha512":"3fd262e80ffa2e2d9a0202b9aadcb42da194960c11e86e7aa71c5a5689a391e99bf08c026d9206c8fc38c69d3fc715b419b9298958e03488bc996379fcc3f108","ssdeep":"192:8VMp7xAH3+agBlJGT/daomf1IwunGLgCIu5Bng/:GMpNy3+agGT/d5Y1f1UDqng/","tlshash":"4df18d04b1de05598ecbdb663ca460e58dbb5c8a6582059c2e47e7f0cb0757d3833b89","first_seen":"2023-06-18T16:15:32Z","last_seen":"2026-08-09T22:07:20.177628Z","times_seen":208,"resource_available":false,"data":null}},"time_used":3214,"timings":{"blocked":983,"dns":0,"connect":0,"send":0,"wait":838,"receive":1393,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/10223b0f2e458ba4044aaa027a6ed25d1cf59?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.623Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/10223b0f2e458ba4044aaa027a6ed25d1cf59?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 7372\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"10223b0f2e458ba4044aaa027a6ed25d1cf59\"; filename*=utf-8''10223b0f2e458ba4044aaa027a6ed25d1cf59\r\ncontent-md5: D5+qzvoU4Tb/NNFugwe/2A==\r\ncontent-transfer-encoding: binary\r\netag: \"FmOEizvP6U_T7KWDYzQ6v6JiOImr\"\r\nlast-modified: Wed, 06 Jul 2022 12:51:51 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-21;QNM:yzh160;SRCPROXY:yzh150;SRC_***:36/304;SRCPROXY:36/304;QNM3:67/304;QNM3:83\r\nx-m-reqid: yS69FCy2B\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Validate,Hit\r\nx-reqid: ycAAAAAlE5yG1m8Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7372,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0f9faacefa14e136ff34d16e8307bfd8","sha1":"63848b3bcfe94fd3eca58363343abfa2623889ab","sha256":"8b4ec2d512e9af06c22ad78e16d73ee47111d15e6b14b0f2e862ecf371dd3e66","sha512":"217a0933d5329ffe3131c69f72a85d09bfd151a70891455929f15b23e8c8d9e73a4eaf616f7a4b5f8b37a72723bf1af67c2df8337ace2713c0b6b86b06831ad0","ssdeep":"96:UWTtBbfUj+kVnoLiPvHGt5jtflUYRWBdxEE9CqqxJpvUTzFK2lNJiPTu98Q1K:dA9GcvmftfPOxK9vU1bNUTUPK","tlshash":"07e1b0925322f67c6d0fbbb6c8360c4808e5097c3f5ced06692b86192a1516c897e5fa","first_seen":"2023-06-26T22:05:03Z","last_seen":"2026-08-08T12:58:53.344449Z","times_seen":199,"resource_available":false,"data":null}},"time_used":3161,"timings":{"blocked":921,"dns":0,"connect":0,"send":0,"wait":838,"receive":1402,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/kc523-1/sponsor/sponsor.json?1756903280095","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.937Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor.json?1756903280095 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: application/json\r\nContent-Length: 646\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-286\"\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: EC281491-1AEA-439D-BE8F-326C31871AB3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":646,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"10d2161de8cf99c474812f4c43645a26","sha1":"71884ef7281cdcb5084088f16d4550ce8790e634","sha256":"bb02fd7438bb49dd4decb6f76a71f11e93355332fd9f965d6f9f13bb8175aeca","sha512":"bf0fd1232309fcc5582d5c42644e1c7b4b8d235b1066e988ff55e0dd94a956f89742401f00c2d904359041c8e0c2bac8e9316252fab60db5eb0a3b4c935172f0","ssdeep":"","tlshash":"d8f0f44ad8b25b93211fb57c58cd050470294a8f0eccaac4baac987c4f598ddd1e839e","first_seen":"2023-06-16T04:51:50Z","last_seen":"2026-08-10T17:58:48.246933Z","times_seen":2852,"resource_available":false,"data":null}},"time_used":218,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/106929d9f505b304344cb8ddd8ba5467ed8d4?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.533Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/106929d9f505b304344cb8ddd8ba5467ed8d4?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 38051\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"106929d9f505b304344cb8ddd8ba5467ed8d4\"; filename*=utf-8''106929d9f505b304344cb8ddd8ba5467ed8d4\r\ncontent-md5: qiJFcCxA93eZpa1LEZWBqA==\r\ncontent-transfer-encoding: binary\r\netag: \"Fg9x5QVaTZ_PdES4ZfTaB75mnbh8\"\r\nlast-modified: Wed, 06 Jul 2022 13:03:33 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-10;QNM:fn195;SRCPROXY:fn275;SRC_***:7/304;SRCPROXY:7/304;QNM3:26;QNM3:54\r\nx-m-reqid: ZATJxWw0K\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss, Validate,MissFg\r\nx-reqid: uRsAAADP4NstSHAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38051,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"aa2245702c40f77799a5ad4b119581a8","sha1":"0f71e5055a4d9fcf7444b865f4da07be669db87c","sha256":"2e5561af9330304c902ebd32b795b030ad3861bdf27efe7f61e811294a6d0161","sha512":"c65f44562e36c101f0df08339a305d99c00d42976d1301117d7546e2fa3a3118b9c503d473e1633171374be4b4f1e02e537cda7c3dbf343e85f086e6796a385d","ssdeep":"768:AdDrEvs2+haN2ZSwaFeacmeL8RAUTYS5emIlcHDMGPpxkgmq34GwrvFojQ8N/c:KDIU2R2ZTq3qAAUTYSslAHbgz8pc","tlshash":"8803f27afa5c4924aa7c03873f16d5ea1493399336a3b335ac4253c795a81347bcbc8d","first_seen":"2023-05-27T18:34:14Z","last_seen":"2026-08-08T12:59:39.062434Z","times_seen":495,"resource_available":false,"data":null}},"time_used":2967,"timings":{"blocked":1010,"dns":0,"connect":0,"send":0,"wait":837,"receive":1120,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_5fc25f60-3127-4e8e-9be1-8ad76b69dd66.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.769Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_5fc25f60-3127-4e8e-9be1-8ad76b69dd66.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 418923\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XUEb4EYUMvm2GCnMo8r99NRopScE6AKD9E3dk4UEa76tFcpz5mKWe0VLqcQOqhdjccS25VKTJFYo9LPDdWVJII1SLRln%2Fd9pFDVCWWTVVhMXIqo41Ijd8iKj%2BOYn\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"837176dcc1058ac78d510f029483fa3e\"\r\nLast-Modified: Mon, 08 Sep 2025 20:42:32 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189691\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacad8ec711cf-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049812=rdeenGOu7oPbUjAiCKj7mQM/L2CZSERSb8B0wFuL8iAz8yGt/SZrwN9hzq//Jfkm2RgBtTQd0nDutTI6d6QWpAWOCgfp5dAbbfEI67TXctUIUufT2Gr4Y/EGVzH3Ds++pR5m1dg201x3t0V1APCXAY3Xdycq4n4xNiX+U+u5NzhLl7ERx+6lMbVyMrOoYSkT\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: E537B16D-B616-4505-9CB1-B7C9B6E87CE1\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":418923,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"837176dcc1058ac78d510f029483fa3e","sha1":"d617a49b9b5e2bef4e3632c48273ea963c1afb27","sha256":"fe6a93389f6128d138574a0ae85491948e4cd6398eabf0986a43a622f804fc99","sha512":"721f4e1dc0a96c6da1b6cab85bd46d765f604f5121e98fcd66cf305045241f6eae051b6d1aae7d95612c1d271edb3eeb503de6448d429fd85bca3f2d13ca57c4","ssdeep":"12288:3WYSWVgywdxAtVAbf5tti0FEUkIZqvxekZ:3b6ywsvwb7/kIIvxekZ","tlshash":"a89423c0be00f730ad616f55caa462a11d5225bfd4b062f11239a2e5aad34df3b07ed7","first_seen":"2025-08-29T11:05:53.088316Z","last_seen":"2025-10-27T01:14:48.439083Z","times_seen":202,"resource_available":false,"data":null}},"time_used":5324,"timings":{"blocked":4286,"dns":0,"connect":0,"send":0,"wait":246,"receive":792,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_bdd30f19-a4d8-4eb3-b2d5-d24180d2e353.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.719Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_bdd30f19-a4d8-4eb3-b2d5-d24180d2e353.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 26169\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jVGMt84u852vtAAICS1pqP71OSSGZrfDAenOsZuUhAYfAhsA8YQbN7%2FYn98pE2fidgMXCXVGZzkFtIu4xlC5tOUIvLnOLDpMhPPRhq%2BnabrQKRLwuyZVIC2eKUol\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"8e4798de63b7a1ed460a9dceb8477da0\"\r\nLast-Modified: Thu, 18 Sep 2025 11:00:21 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189689\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacaf0cc802c2-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049810=8XOhqPYzNvtuGG/4OcysAi/9c1Ix5YgXavBiBH6qc9bjm9WqeG2yII9Rd1CIWAUKAG0FxykRuvJXzDnxMKqk+rS68KDMASNbTzkdswwt4XDucm6b5py1vQ6G35la3BMmWsZTXXT6A4L15Kx99KWkHMnTvjv0qUeu4ZUmFH0QFz5BQ+0r3VTY4mBrhnaqQbQB\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: F8257A9D-4D14-46D2-B8F5-AAEBE6C77FAB\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26169,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"8e4798de63b7a1ed460a9dceb8477da0","sha1":"63fe754ff17c8577556ed86c83fb71d48741aa86","sha256":"cbbb80241f900ee2edd463b57c36b50acdaf20321e3b134aa03670231f3894dd","sha512":"998c6cad3e6c77429ae6f521b1747c47d9285cf28c06418178afd2fdba96f12e57981580a0acbc7995a618b87d81f90caf4d550da0abd637ac3b8016887d1814","ssdeep":"768:PU86xxR89xObVIibTCjG7U+6tFMAHgNDtn6Jnan4bYPT7:PUfk2VQG4LFMAahOna40PT7","tlshash":"6ec2e12706d74fd99c67667ec399c4e833b013347334e2908777cd26c4d968a88a0eca","first_seen":"2025-08-29T11:05:53.252109Z","last_seen":"2025-12-29T13:58:58.031108Z","times_seen":302,"resource_available":false,"data":null}},"time_used":2687,"timings":{"blocked":2453,"dns":0,"connect":0,"send":0,"wait":233,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/45540.1756903329400.c33043f4.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:03.394Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/45540.1756903329400.c33043f4.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:04 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-37fe8\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049804=h5k4oOZBnH07/tXwPIgLACWo459+P2Pabs9NtfDroPIDrNZiYSJJtMy3o1VcjQflqa1V7B/Z+Nh3eoBMUpChlR5iMn7XhWnsM406Yp37szt6I0vL5Dxr3e26J0gLTDWq4BPO2oJWrWBLw/2asm78ZGKFS0Ej8G3eFlTffCQraOfnlC5OG8KVbdcKmF+pSwvy\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: 611A0C94-72C0-4CE6-AF77-53663E0B5D10\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":229352,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"000be9e193b9b0e7a8e7e2fc6a908605","sha1":"1f04ee0d0816dcb4a310f1bf9053f36c15561922","sha256":"0968ff07195a9aad5c3f080a919c803c162ccb3bb176330b762c1e4e884e75d0","sha512":"d05ca2e4dbd262beab20be9f7872c1faf4d88129b59234fb2009c9ecc7114341558d7813d701cc5aa54dfa4ec028ab007eeff864ac6bed87a4ed8d42499954cf","ssdeep":"6144:rYD4wFsYiSGfKnCKPP6Xm9sm3MCln1OSgpozfEe5a:rYD4wFsYiSAKNH3TY5","tlshash":"2b24e894f294f1be075fc1f1d23b501af35b5e6120cc9ca0d296e6942e20b49da77eac","first_seen":"2025-09-04T00:49:32.837166Z","last_seen":"2025-12-29T13:58:58.015173Z","times_seen":439,"resource_available":true,"data":null}},"time_used":1492,"timings":{"blocked":788,"dns":0,"connect":0,"send":0,"wait":460,"receive":244,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_9986c108-3fd7-4f35-9443-f78ce32e1660.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.770Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_9986c108-3fd7-4f35-9443-f78ce32e1660.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 20774\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F99v9tGu9lHDC9PMSZja76BV4KKvaekb4R%2BLmU81mrwE7cJ5vBpChVZPPbHlP51q4diWZB4%2BlMPPKbV8u9P77hxPNDfrixqOzGbfG84PSPE1bGqyotWj%2F8Pk49NL\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nETag: \"b4734010f7828ca2c22c389ee510755e\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:03 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189686\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacccf86c08a2-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049812=rdeenGOu7oPbUjAiCKj7mQM/L2CZSERSb8B0wFuL8iAz8yGt/SZrwN9hzq//Jfkm2RgBtTQd0nDutTI6d6QWpAWOCgfp5dAbbfEI67TXctUIUufT2Gr4Y/EGVzH3Ds++pR5m1dg201x3t0V1APCXAY3Xdycq4n4xNiX+U+u5NzhLl7ERx+6lMbVyMrOoYSkT\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 89E56215-429B-44F5-A103-130151AC5380\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20774,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"b4734010f7828ca2c22c389ee510755e","sha1":"757202b8e2a145b911c7d7693bbf5fd753ede9e6","sha256":"7baac8631e3b6377f2aff7262dae5a82e2e5f5ce14edf950e64e6426e674cff4","sha512":"fa9b53fe2c82ab0fcdd8f6d004083cb25c718eca270b6866a760de7df1775ec06b8be572baa3dbf90e5da20f0a9d807ee10df13b31e397b2ac35ffb78d5070e1","ssdeep":"384:7MUqGTUfqNN66k60ie1NIgiVG+V+DhwuNJ7SOEOsWM7RKjFQ8ZrG++eR:7YwUfg6I0b1N9S+DmQJ7SLOIAji8Z6g","tlshash":"e692d0d3168a6abbe615da79c15e10879ad2a00155f8f9038db7c74bc7324cc0979bc3","first_seen":"2025-08-29T11:05:53.157247Z","last_seen":"2025-12-29T13:58:58.067607Z","times_seen":293,"resource_available":false,"data":null}},"time_used":4671,"timings":{"blocked":4393,"dns":0,"connect":0,"send":0,"wait":276,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/help.4e3cf897.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.982Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/help.4e3cf897.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://u65r.xyz/css/index-399e2569.1756903329400.f2d3fd45.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 10322\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-2852\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 117975\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 9B3D8279-64F8-4309-86A0-3471221C2DC7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10322,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"6dd52a6a4d07f2786b1926fac1b4b06a","sha1":"9c9908204401fbe65d33cf7df8881639d6aea37d","sha256":"e02471f47b506ab510d0e0dc4224cffc03c34f950b649ce347ccd71af0bcf0ab","sha512":"fdd52f532e5c2e2c182db20e2053eee0ca8c26cec51ff75e1bc341b01911461ac72fa75887fa3114188ba32aa6341c0974d81d071fc42b605e72f73dfb87ab9c","ssdeep":"192:x0C+pMwjX2XZ456BAJu+1KzdjCfDrRq6wUPlJyh2h4PAmWP5yQSkHxfYX32H5TRm:EjGXZau+1MjCrrRLlqGOnWcQSkRQX3IG","tlshash":"3822c054370836084f737a4362ac4e837a06040ffdf9b7919a6372659a5b94e44cfb66","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-08-10T17:58:48.367491Z","times_seen":2605,"resource_available":false,"data":null}},"time_used":1664,"timings":{"blocked":1419,"dns":0,"connect":0,"send":0,"wait":244,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/1049300a92cbfe3ab436883b4fa5d2f1af2fb?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.538Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/1049300a92cbfe3ab436883b4fa5d2f1af2fb?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 64433\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1049300a92cbfe3ab436883b4fa5d2f1af2fb\"; filename*=utf-8''1049300a92cbfe3ab436883b4fa5d2f1af2fb\r\ncontent-md5: ruYq+WqVZ1bMKf5IMShjVw==\r\ncontent-transfer-encoding: binary\r\netag: \"Fq0YIokT0lEaO54nVZjE9qOUhC9p\"\r\nlast-modified: Wed, 06 Jul 2022 12:58:49 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-26;QNM:yzh165;SRCPROXY:yzh151;SRC_***:35/304;SRCPROXY:35/304;QNM3:42/304;QNM3:57\r\nx-m-reqid: hsq0DdqAO\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Validate,Hit\r\nx-reqid: hdIAAACM0-YtSHAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":64433,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"aee62af96a956756cc29fe4831286357","sha1":"ad18228913d2511a3b9e275598c4f6a394842f69","sha256":"7337cc7e87837aa5355540eb9423a2fe71f9eb272374eeae905cc76677170b3e","sha512":"9e351c7adda72c984131b7b7c578543672c9f80826fe73fa77ce1bee7b6e469e898e50000af98b35e559203918c0403028491cc68dae66db5a4ee202ab34383d","ssdeep":"1536:VOXeer69ZhyANzm41JZoDvAAelB8fpoRgI8:VseSgFzm4JIquis","tlshash":"e25302481cc1ca5aaf3c8abd8f0f14bf2805dc4409ca4195395e89cd44ababfad45fb9","first_seen":"2025-03-30T02:59:21.221388Z","last_seen":"2026-05-24T17:56:38.680283Z","times_seen":350,"resource_available":false,"data":null}},"time_used":3232,"timings":{"blocked":1004,"dns":0,"connect":0,"send":0,"wait":837,"receive":1391,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/e51bede47ce3cb2e3c10a78e95e8bd2f.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.588Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Sep 2025 14:31:39 GMT","end":"Sat, 20 Dec 2025 15:31:26 GMT"},"fingerprint":{"sha1":"17:3D:A0:9F:DE:47:81:66:EA:33:3D:E8:54:E5:E5:AC:9E:D3:7C:A0","sha256":"22:D9:7A:16:0F:64:68:7D:00:46:B8:BF:15:6C:E8:BE:57:96:C2:BA:12:A5:4B:90:48:16:F4:58:C4:DA:9D:36"}}},"request":{"raw":"GET /202/1/e51bede47ce3cb2e3c10a78e95e8bd2f.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 1548\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"6ca3494e31febbae618279415bf4c870\"\r\nlast-modified: Tue, 08 Jul 2025 07:30:26 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, accept-encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 18707459B7E85E14\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: max-age=2678400\r\ncf-cache-status: REVALIDATED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KjG%2BVTevTqfDcyvzQ1UFRa8pkd7RHX69x7QEt3lk6sdjIm%2FgGAacriaOj2kSDIIPPnuMlEesryYYBownqD9vPzmXyBQeONoUfukO3Bg8ALig\"}]}\r\ncf-ray: 9920c3b1ee225fac-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":1548,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"6ca3494e31febbae618279415bf4c870","sha1":"1576f461a56821c58f10b3e3de5d07bf00a9af46","sha256":"2097cacfede8eab66319a7400e6d797be68aaec1494df1e1a75aa1db38a49994","sha512":"f9ddf05dac5bb987804821e9c6cf90b15a0508e852d2ea155b52302601bbc6b815bd2349ce1a90b4594548571162134416bd22c3f107d40df447999b47f5735e","ssdeep":"","tlshash":"3131d7ee21dfbca41e32dcd3d1b632a4ba084024495835ade5e5ecb1343798394b098e","first_seen":"2025-09-11T04:13:01.801992Z","last_seen":"2025-10-21T12:48:58.444924Z","times_seen":18,"resource_available":false,"data":null}},"time_used":982,"timings":{"blocked":-1,"dns":38,"connect":1,"send":0,"wait":839,"receive":0,"ssl":77},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_ce6f5a12-ce60-4931-b7a7-3cfa94c956bf.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.710Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_ce6f5a12-ce60-4931-b7a7-3cfa94c956bf.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 112081\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lR%2BkKA%2BYGxNbjsli7PQzvE7I2MUAwpkv9Ul%2FD0u4fmHRKiE27roMb%2BpyJsSsEzqVgKw%2Blk9bnOu9IEGHYBxAH4bg9pJ4QoEclKYaoDn0Ao5tZ%2BWToOrruPcxTA%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"e400b1ce694e9efbda2b9479c60f4115\"\r\nLast-Modified: Mon, 08 Sep 2025 20:50:51 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189692\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac94dc816682-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 53295637-962A-4A02-8703-45C1A955EDC8\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":112081,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"e400b1ce694e9efbda2b9479c60f4115","sha1":"7dea27eee3238d11200801bc44d1bfdf6c2a561b","sha256":"155e9244c0749d2c6891d3b541a8c081104c180e6c9308ef87eb4755ebce213d","sha512":"681dc38636b2420c7e4731f6cd2b11d483e848a64d5c19706465dfa373613c791b8caaf7b8cec746e624c00e6582e7923bf74f0d1d05dad8646f6bcabf267d64","ssdeep":"1536:CaONt1WZ4PaW32QGG8HJRfa9bjz2mt/XO8wLQmI2GOcj2B1Kudk1UaMEcS9dd0f7:B4P5eIbjz2mt/MLQj7j2B1LiUkR9dpe","tlshash":"cdb30201aed3bc913942658841e1d296350f78b2e5ba83c7edffcb0ae5911afc9d4462","first_seen":"2025-08-29T11:05:53.339263Z","last_seen":"2025-12-29T13:58:58.050834Z","times_seen":290,"resource_available":false,"data":null}},"time_used":2237,"timings":{"blocked":2024,"dns":0,"connect":0,"send":0,"wait":207,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_04beb05f-bdcc-4bf4-a35f-b560e45e45b0.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.723Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_04beb05f-bdcc-4bf4-a35f-b560e45e45b0.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 108004\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F8xKZHkCUhCxeeF%2FKZH349Z5l1pj1bwu%2BeVKJW36Xab2aPsECTTLoQEws3mUTorwViHsW4ywhZVb%2FgLZiFl5gxGZMilPXAb2vsD%2BbzXxk5I8k3GtE8Ylnpjqhg%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"a3775875c9308eaccad9d436837da5ce\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:24 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189688\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacba3a41d4b4-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049811=yfEHl6AolJP0QC5NkMkOAeL2cxw2cvQEQ0CJoyH0PwylhAu+93HbTVa2aaGzmwCJZPRlEiCkJ/Lezou0DkT7iNjC2gSEaRk5/ITYUs6HFP6vgf9C2kZ+8cKO8dprXM2S7lcJEzc2ZecPldSfp0XqpOhoW/bsw+EQEoKlKZs4TyR039jUu6QbtWk2lIQvTHt+\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 239DB2C3-14B8-4452-8CB5-92ACE904F777\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":108004,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"a3775875c9308eaccad9d436837da5ce","sha1":"f2cb91db0d4dfcaa7edcca96a05c75a001a37946","sha256":"de09df318c409253c016871cf0e9980c44b5cea2e4cfa6317d143a5a555953e5","sha512":"b3d098e269124f5eccfed2bbb054509c497cae3137f7883ee1cd11a4ef1aafd69cc14d1f7c832d9c02b702c0a7977263bd9b579158d64ac115fdbf1b7395accc","ssdeep":"1536:ybmCxBbtKe/h/N267ElA+7YePfJ1LrToGovotEpjB2G5zrk7mJWfz5b49rCqp:yXxHt/X26Ir7Y41rpPWkGiPfNbErCK","tlshash":"b1b31205563a0cfee4eb2531451db7c3dfcf9925a60328b57052ba4a31f9b83a6b7c18","first_seen":"2025-08-29T11:05:53.200832Z","last_seen":"2025-12-29T08:12:31.315831Z","times_seen":300,"resource_available":false,"data":null}},"time_used":3441,"timings":{"blocked":3194,"dns":0,"connect":0,"send":0,"wait":243,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/index-a3dad144.1756903329400.268893b8.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:03.397Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/index-a3dad144.1756903329400.268893b8.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:04 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-551ed\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049804=h5k4oOZBnH07/tXwPIgLACWo459+P2Pabs9NtfDroPIDrNZiYSJJtMy3o1VcjQflqa1V7B/Z+Nh3eoBMUpChlR5iMn7XhWnsM406Yp37szt6I0vL5Dxr3e26J0gLTDWq4BPO2oJWrWBLw/2asm78ZGKFS0Ej8G3eFlTffCQraOfnlC5OG8KVbdcKmF+pSwvy\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 8D441B38-45FF-4BBE-B579-EB0E573D9A7C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":348653,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64496), with no line terminators","md5":"e70d98f5d06556fb2df3ec9ecd519e37","sha1":"f15f33973e2498e949a62791b8fa6c7ff03c7a98","sha256":"7c6448354a71dab7081c1a9083e1ef15f7c59ff568fb924930620b4758169df2","sha512":"d225d0cca1709f789e457dd14df16ceda4bf4118d6c8f9db25bb9cbd5f30151e6b23d497ba51761a0eba97686323b0393dcfe43652e832dbaecc97b69bccf802","ssdeep":"6144:G4InKyBbhFOuyKO0VPoJBR58n3inyHpZolRlY1z9f7ZwTl0A+:izc90VPoJBR58n3inyHpH1z9ftM+","tlshash":"d7743b94f76cf1bd874e55be793290a4902c1b41b0c89d58d29e2944ff6b385eeb08bc","first_seen":"2025-09-04T00:49:32.964012Z","last_seen":"2025-12-29T13:58:57.98751Z","times_seen":435,"resource_available":true,"data":null}},"time_used":1611,"timings":{"blocked":1185,"dns":0,"connect":0,"send":0,"wait":220,"receive":206,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/16524b4cad0291c9b4e509da07a83fb85a710?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.558Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/16524b4cad0291c9b4e509da07a83fb85a710?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 98476\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"16524b4cad0291c9b4e509da07a83fb85a710\"; filename*=utf-8''16524b4cad0291c9b4e509da07a83fb85a710\r\ncontent-md5: hHEh09ibJUfpRxwwCZqH7w==\r\ncontent-transfer-encoding: binary\r\netag: \"Fn_tJpm_Inyov3NaAjtgZZ8Kx53D\"\r\nlast-modified: Wed, 06 Jul 2022 13:06:10 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-2;QNM:fn267;SRCPROXY:fn275;SRC_***:34;SRCPROXY:34;QNM3:36;QNM3:73\r\nx-m-reqid: iYVp0v6w4\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: tZgAAAA_gLDPUnAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":98476,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 1375, 8-bit/color RGBA, non-interlaced","md5":"847121d3d89b2547e9471c30099a87ef","sha1":"7fed2699bf227ca8bf735a023b60659f0ac79dc3","sha256":"22a48288e217cc8364a647e45da910bedbed06303c47c7b40fb085c486355665","sha512":"afdf72ef73ad59d8a0183c8b19db8967d504d4bbbf46ac3608333d4443be7cc173c0a1e57e1251e28c163abd3f7f2d890cc245880328070bd608d4031bfe2eec","ssdeep":"1536:emZY4ZcMG+DGDcxvCJtKOhMhkgA36aSjGuED4eoNeEMFelE5Vc8wfGokLxwtsums:eIcMGu3FhA36TGVDEkQMVc8wfGjLWmud","tlshash":"4ca3cfc277dc84d1e5dc3933aea4c70d5ca9c7eb7b904d1859909043a65bef4fa688c2","first_seen":"2025-01-29T13:39:14.864552Z","last_seen":"2026-08-10T17:58:48.345262Z","times_seen":141,"resource_available":false,"data":null}},"time_used":3492,"timings":{"blocked":984,"dns":0,"connect":0,"send":0,"wait":837,"receive":1671,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/19331a6b365cb3b7841fb8981c38f38603ec4?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.620Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/19331a6b365cb3b7841fb8981c38f38603ec4?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 19320\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"19331a6b365cb3b7841fb8981c38f38603ec4\"; filename*=utf-8''19331a6b365cb3b7841fb8981c38f38603ec4\r\ncontent-md5: tNz3wJoVR7pnJpgOE4K3BA==\r\ncontent-transfer-encoding: binary\r\netag: \"FtJjBJVhN8tGsM8PvVqC7Gm_ACC9\"\r\nlast-modified: Wed, 06 Jul 2022 13:04:32 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-22;QNM:yzh163;SRCPROXY:yzh151;SRC_***:60;SRCPROXY:60;QNM3:85;QNM3:115\r\nx-m-reqid: CktWG4NBU\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: VY0AAADDHkpLeXAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19320,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 139 x 181, 8-bit/color RGBA, non-interlaced","md5":"b4dcf7c09a1547ba6726980e1382b704","sha1":"d26304956137cb46b0cf0fbd5a82ec69bf0020bd","sha256":"de3c93c167ee16144fc26ed1b8a8aeeea93dffe550d27cdd30d1aef45331b963","sha512":"81ff90771d99f239ea94de459e762f1abfc35340a95cb7d979ed69af7201fd74f21eb76ffc09385d227a9c8215c77b4f320291aec78cb8edae76d30d5c350be9","ssdeep":"384:NN3oIdaWNZvK6YSnOQu++tstcuOEU8MHZl7OgtqyPYGtUPK:NVzdaeMjybtcuOHJtqywGmC","tlshash":"9182d171e5430a96cd574736815b21c6df2c7a33b768f28cf52426a178d2bb2f066371","first_seen":"2025-02-04T17:13:01.263807Z","last_seen":"2026-05-31T12:35:53.534957Z","times_seen":135,"resource_available":false,"data":null}},"time_used":3165,"timings":{"blocked":925,"dns":0,"connect":0,"send":0,"wait":838,"receive":1402,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/e927cd33a6ee6dd57c628c6eb168f57f.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.599Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Sep 2025 14:31:39 GMT","end":"Sat, 20 Dec 2025 15:31:26 GMT"},"fingerprint":{"sha1":"17:3D:A0:9F:DE:47:81:66:EA:33:3D:E8:54:E5:E5:AC:9E:D3:7C:A0","sha256":"22:D9:7A:16:0F:64:68:7D:00:46:B8:BF:15:6C:E8:BE:57:96:C2:BA:12:A5:4B:90:48:16:F4:58:C4:DA:9D:36"}}},"request":{"raw":"GET /202/1/e927cd33a6ee6dd57c628c6eb168f57f.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 2088\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"fb7c8509e59a9e0b4b73ef0cff9c6498\"\r\nlast-modified: Thu, 10 Jul 2025 04:16:56 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, accept-encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 18707459B87423E4\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: max-age=2678400\r\ncf-cache-status: REVALIDATED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hzLyp2zZ3T7dXZl0iBWMi3KwCuK%2BKzIb6bF%2BJf8NJ8%2BrhDUxyz4MjNrSSX1dqxzp2YwLj3Hi5ZqjSw8Uh8QgxPzVX007uYlO2yt9lobLeDPl\"}]}\r\ncf-ray: 9920c3b1fe3b5fac-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2088,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"fb7c8509e59a9e0b4b73ef0cff9c6498","sha1":"4392b30e60f6d82f8e7d8770367a156af6e54dfc","sha256":"eef1e9368954a0ad3b9dc116a7cd2f7f00d5880ba008231da7eb9ca4a85f4217","sha512":"c2ca4a3b910372ce10f97ad75772bdcb44c6548f2f66b4245b4d8396877b8b55a40910204627681c46ccf3669250474a336a902b27bf1e5507f11035067acfea","ssdeep":"","tlshash":"83414caa33d48b51d7d8325b8ad95036c2bcfe3d73ff79a158136465ce1350950406b2","first_seen":"2025-08-05T06:40:24.008617Z","last_seen":"2025-10-21T12:48:58.466091Z","times_seen":126,"resource_available":false,"data":null}},"time_used":1006,"timings":{"blocked":-1,"dns":24,"connect":10,"send":0,"wait":867,"receive":0,"ssl":91},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/64906.1756903329400.e9e9ec75.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.751Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/64906.1756903329400.e9e9ec75.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:05 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-35295\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049805=po6D+l8dMhfLGKAdfLLnVeIRbjpxlkQDEuGKbtlEOTQWkshI6okgIymixUARr4wGybpILVpsVTfVc7k0JaAkDpC9mG+fNrxEIVp7sH1o9IEd57siolGhKy+cprba9qHT4pkoamaJpfQkaW28kwG1+DFqQQxzksZj++jdxZwG6L+cO51eyJYwemgSWglzoiWi\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 50828285-E2AD-4231-BAD8-807804FF387C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":217749,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64884), with no line terminators","md5":"18789db02e1943b9b6e2a4bc1db4cc9e","sha1":"ab3db8b123be3580e4d5198c5ca7b99e0cd00d4a","sha256":"381bb6518856ad825c2e3fa1ec233fefa0ef52a11dd2a2dbca840381687dedb3","sha512":"6895a97c1c487d492779c4d0166bcdf0599a8634c8af8c051b573d84f001b730738eb8194f5edb5ca5eebff733289c293cd9889ea0b373330a3d9860cea872ca","ssdeep":"6144:9MhEyLkbLniyyeBHlBfb08rzZAncbtiTisXuLCoSltnIwb/mmtMDj0Rts:9MhEyLk3niyy0HlBfb08rFAncbtiTisY","tlshash":"3b241b94b690b17883bf85ff7224a164e24e1f9860cc9de4d26e2b407f12706b8775ed","first_seen":"2025-09-04T00:49:32.707517Z","last_seen":"2025-12-29T13:58:58.048456Z","times_seen":418,"resource_available":true,"data":null}},"time_used":534,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":273,"receive":261,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/kc523-1/sponsor/sponsor_web_1.png?1756903280095","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.830Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_1.png?1756903280095 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 42326\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-a556\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nAge: 189700\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 951DDA5A-9900-4CFA-8145-764F0D70275F\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42326,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"e0ecbe5a9349aaa328ffd6f9515f9007","sha1":"79ebc30d345c812a3e3a122f152829d161b00a52","sha256":"452d27839b3f3f35d11c9a26f06d6cc9db56dc8c61261ee43e0512f69abf71f4","sha512":"fd322bf3ca925ce2eb45317adae1dee0f1c2e4f30035738052a97ccc054ffb576a92a46758559c8d13cff6be549caca5541d14c5692cbec2758ab2b3c7f3324a","ssdeep":"768:2o9mjFjepo5h5jLasrCO57PIrvmMOSf4t7q5bo6Wruv9CSMsfRLMD7XZ0:2ogpymTxRrwmDSM7mbo6WrutR60","tlshash":"8713f2ebe1075d80bb946c9b3925eec61da50f047bc78d68c5e055f921290bb0fa33a7","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.261573Z","times_seen":2371,"resource_available":false,"data":null}},"time_used":715,"timings":{"blocked":452,"dns":0,"connect":0,"send":0,"wait":261,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/sports.60212fd6.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.976Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/sports.60212fd6.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 116532\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-1c734\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 117976\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: 138E760F-965A-480E-A3EF-4890A4393429\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":116532,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 666 x 541, 8-bit colormap, non-interlaced","md5":"fc82aa907334f929011fc2a6ec906f55","sha1":"f76bd75b9d1235807c70c7d763a1865d7c3f8d4e","sha256":"2ae1d61176960d7ddfddcb30a69d22b9da893687370d8cd26f4917d129a1bf3b","sha512":"12ef7a828d7d4228596b0db0ad77b200e8ffcfe2457d12821a4e9778b62668ebeef075c2bc79076e36291e3015afbfe276a2ca230ead018b38e2d3fd803dd31f","ssdeep":"3072:/ZEgiWqpGRwEyiwX0wgOZzbKoSxNiSvrUeO4h:/ZLf/R2iVwgAKoSPiSvVOy","tlshash":"76b3021c79775a2083c6bcb40b583aeae09b3dc19d169808d68b7791993df43c970bed","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.454762Z","times_seen":2722,"resource_available":false,"data":null}},"time_used":1140,"timings":{"blocked":888,"dns":0,"connect":0,"send":0,"wait":248,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/partner.dca3fc6e.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.986Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/partner.dca3fc6e.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 28969\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-7129\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049808=sBeSKsiafNlkKsLs4C/dAiFvvIebGS1CCiZrVBTiq6N2BrMHJO/A06D5FyfgjgTxmm65szHCxvbeWCjEoLhX52ZT+6aWyh2Ly2dWJuSrJO8MDlgQ2vONi+MIwEavNqtGmMx1nEqf7c6BCaib745OKSMBePL4GHCI7LEl0G2xpUJD22vca5uX8ey/KW8PlWax\r\nAge: 101404\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 164CEE32-8D5F-480C-872E-1D947FF4693A\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28969,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 480 x 151, 8-bit/color RGBA, non-interlaced","md5":"7374b72d05130af2d77119eb0eb4ba10","sha1":"5b3e5e621329685de250121b2fd9c798f46f7d65","sha256":"059a622a7f1f0f1f239d624f19b0f5531c0f0aedadb8ccd40d2570a76dd56752","sha512":"c2d0f744838a882c8ac15de6bb0bfbeb3dd2f31550cc7a259b9890ea38eddf835902171c1346ed7e1d2005ba18b929d598002d60b7355df72073d955521b18b0","ssdeep":"768:tAAoY1X4ITISUWhiqmMiuCaUENwHoacq8zqWx6:abaX4SIYIdMMow8zqi6","tlshash":"a2d2e0ecdc3058f1f533894dc979813a6f3886ba05e359817a36f92bddc3e8506491e6","first_seen":"2025-08-29T11:05:53.287538Z","last_seen":"2026-08-10T17:58:48.502963Z","times_seen":2456,"resource_available":false,"data":null}},"time_used":3090,"timings":{"blocked":2878,"dns":0,"connect":0,"send":0,"wait":211,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/323879232905ce2d24f5fa3ac4bf1bf40f500?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.416Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/323879232905ce2d24f5fa3ac4bf1bf40f500?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 6546\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"323879232905ce2d24f5fa3ac4bf1bf40f500\"; filename*=utf-8''323879232905ce2d24f5fa3ac4bf1bf40f500\r\ncontent-md5: /QPgW2H/7Cfydw6bj6Sucw==\r\ncontent-transfer-encoding: binary\r\netag: \"FmXpvAei5ehNfNWmXdVsgChdQ4YA\"\r\nlast-modified: Wed, 06 Jul 2022 12:54:18 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-1;QNM:fn269;SRCPROXY:fn275;SRC_***:18;SRCPROXY:18;QNM3:19;QNM3:55\r\nx-m-reqid: TJxCODk3P\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: 2xcAAABqXJzI728Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6546,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced","md5":"fd03e05b61ffec27f2770e9b8fa4ae73","sha1":"65e9bc07a2e5e84d7cd5a65dd56c80285d438600","sha256":"fb7b8a37862fea4bf822849ff2211dd5d7f5ce68839a5ed1cccddbadccef754a","sha512":"887032d35077bbd42de208c365eab35994a0291a132fc33ee10d387843875fbebce7304ca6e44e3bc47a699dd507122abb7030fbfcaaed3365b8e441a47d5ff9","ssdeep":"96:GmfYx+NWmZQx61OBNLSrdCA4J4VFM1FzudmLtTxVzw61lT2FGg/xh2a5yka:GxxjAOBordX4W0zlLhxVb12FGg/Dva","tlshash":"46d18f2acb4fd641c7720e421ed9eb80da11900e5b943aaffe197a804b472ddcb3951e","first_seen":"2025-09-29T18:58:28.213194Z","last_seen":"2025-12-23T00:15:28.908172Z","times_seen":13,"resource_available":false,"data":null}},"time_used":2247,"timings":{"blocked":1125,"dns":0,"connect":0,"send":0,"wait":836,"receive":286,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_0fa85f10-2205-44f2-82c2-66bd141c7d57.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.712Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_0fa85f10-2205-44f2-82c2-66bd141c7d57.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 98966\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O9IahJBOgIkGVTpAhWMdyiKgg%2BPwz10I5Tiep%2BrN1NQruDMFBg8cN0q7L%2B4PLdmmB%2FzA1k3ZzGEh4jfzDXpsqcpXUEH6soewOayIn6%2FZfI18vxwhsy5FOS%2BsXz%2Fg\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"e3794a26da2fd77c7af0c0428df5c184\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:42 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189683\r\ncf-cache-status: HIT\r\nCF-RAY: 990eaccbeb3b09b8-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 0D393C7E-A97E-45F2-8C8A-DABA7F04A4FB\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":98966,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"e3794a26da2fd77c7af0c0428df5c184","sha1":"5d29a91430da448ff8667bfec530c5b46f344ab6","sha256":"acd5357de808116b14225d259667f948557549868bf6a3689737f99462c19adb","sha512":"d97a7b18d9201cb3c481efcf5a18032fb5b433974be0d076560c09e94a2643476a96ac08793866cb98b1ff61e47453a9006851f64b2a2a6b50acec94c6f1e43a","ssdeep":"1536:Vvz41FTye8ysQW30ZMmB7mKkblC6U5Jm1vOxP1vRNR+vv7Q+IgyLQmvFGQgRudOr:S1F9K3a0wbJmMvRLyv7ijfgRudOr","tlshash":"d2a302208b697423cfdf04ae550674b8e56cf67fb5ba1d1248be318c219bd82d6fc852","first_seen":"2025-08-29T11:05:53.224762Z","last_seen":"2025-12-29T13:58:58.034703Z","times_seen":288,"resource_available":false,"data":null}},"time_used":3025,"timings":{"blocked":2028,"dns":0,"connect":0,"send":0,"wait":243,"receive":754,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/kc523-1/sponsor/sponsor_web_2.png?1756903280095","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.831Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_2.png?1756903280095 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 41033\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-a049\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nAge: 189700\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: C988316F-219A-4AD5-BEA7-51A12034B755\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41033,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"66036fddf71ff69f45c146ca63883070","sha1":"4b3076a271d5042ef1b6cffc2ff49f421a819f08","sha256":"93c59a52fe04b0050dd4552a135177533afbe2dec54f10c516610b0dee857e0c","sha512":"29c2fc65e144e5d13c011e4897e0bdf771c7b4c249875eca4fa25589625696c71ec015e7e8ef3a5ee45f2a6ae9df3663da0bb736a6fb13c9628f0d0957827c71","ssdeep":"768:6eyNeN9huVfPKv0KhazApErcA6cFKSkS+pbTCx81TxUqIUgYWxDHc9wZGbYGniRl:6eXXh8KcQakywKK++tTCi6xD89HbxiD","tlshash":"b003f15c4c413e7777f19baae00ac84224d11fd4fdd5e3e61a8bc659a843a68bc2540e","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.36254Z","times_seen":2361,"resource_available":false,"data":null}},"time_used":1132,"timings":{"blocked":920,"dns":0,"connect":0,"send":0,"wait":210,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/ecb/8f8306425cb6740e78b2802ff5047afa96a8ae096bee393c421cac4924db741c4a080b3f3ed2f2822673f3118bd3bae081df46a59bfce8","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.311Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /ecb/8f8306425cb6740e78b2802ff5047afa96a8ae096bee393c421cac4924db741c4a080b3f3ed2f2822673f3118bd3bae081df46a59bfce8 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://u65r.xyz\r\nXign: VGd1d9sJieQ5zAtM/QAcq9qKzo+xCYssfse1/mcbpNOrQVK1+/lvtbgRbxBekcjCfFEKGuYkB1GmsRlDSzqnjZXJ/S4t3jmKUMFsgaz9kK3n9I0i+ZaUPkX2qSWwFiJrRYSeZT4MSZ/8kw9EaNBjWJzml7GuaiZBVPfPmSyx3JE=\r\ntimestamp: 1761049806283\r\nsign: 55691b3k4b2l7k6u\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: htmZ44nXYhd2SnrNty4ztc2apf5FpAim\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Tue, 21 Oct 2025 12:33:06 GMT\r\nCache-Control: public, max-age=180, s-maxage=180, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: 961F75A1-20DE-4A69-93EE-618470E79F99\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"aa1fe36cc499baa3fbdc7ab9bda7432f","sha1":"201b0fc1c4c699f3538c8e3992ec08ecd2f3acb3","sha256":"d509d9e26b3c3a371856286d14bcdd4f17125a10d8ee40e119fdecaf964fb478","sha512":"2dff3b34740cc9d3690f596673675516493472f5ad4bbd3536b5b1b18922543771be73e01051874bc7039aef9461cedb841f0cbe4945118bdea5773a4b3f7a55","ssdeep":"","tlshash":"03b012a2d5a309ed9644713104305c414be022ccc9bcf858c7bc4d2b45650210494105","first_seen":"2025-08-09T20:01:46.169117Z","last_seen":"2026-08-02T09:02:15.066072Z","times_seen":1564,"resource_available":false,"data":null}},"time_used":552,"timings":{"blocked":284,"dns":0,"connect":0,"send":0,"wait":267,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/1003092599f1700564cbeb79d52dec707db37?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.513Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/1003092599f1700564cbeb79d52dec707db37?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 34986\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1003092599f1700564cbeb79d52dec707db37\"; filename*=utf-8''1003092599f1700564cbeb79d52dec707db37\r\ncontent-md5: u/rL2+Z3BRcsZBTX6cIbWA==\r\ncontent-transfer-encoding: binary\r\netag: \"Froy1sVf6WjDdFu5dMcQjzSGKlX_\"\r\nlast-modified: Wed, 06 Jul 2022 12:49:02 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-1;QNM:fn268;SRCPROXY:fn271;SRC_***:20;SRCPROXY:20;QNM3:21;QNM3:44\r\nx-m-reqid: FjwHzvGS8\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: qiMAAAAdz8stSHAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34986,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"bbfacbdbe67705172c6414d7e9c21b58","sha1":"ba32d6c55fe968c3745bb974c7108f34862a55ff","sha256":"eca09c086a79bfb31d303e16285588d809251717faaa0d6667b1bc0c7ed9d74e","sha512":"a4d051178607e028816bbb3dc325bc68a62111bcc86978d2763278c90b6d58dbcee5425e153372fdbb36ae0917fe2b60cae80eb611276a62d9c2c867d4056fd2","ssdeep":"768:2Q6IQkdpz8VshR34jnSx8VyzNsURLw43M67GA1+16uRYlhs:hIkdp8VshR34jnSxyuNr3ZKyxu8+","tlshash":"63f2e055f5ca15f31b0b823c6aef462ec40894367378b36116e68031db9896f0eca2b7","first_seen":"2024-12-22T16:23:43.98021Z","last_seen":"2026-08-09T14:01:03.895407Z","times_seen":456,"resource_available":false,"data":null}},"time_used":2708,"timings":{"blocked":1029,"dns":0,"connect":0,"send":0,"wait":836,"receive":843,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_aa2a4724-288d-4252-82c6-453d0458d8c1.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_aa2a4724-288d-4252-82c6-453d0458d8c1.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 117319\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FjwtH85ttMeLgPnNVmfiNi9vUGbMIZk%2FBs8rDNgY7OzoGoDdIrft3rsFmzf%2BZBF97Tnb044cafPV3Jy9OExwSxjE8eiUEWZzmShGh%2BoVxvg65fL5sgQbkNrHgdq2\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"e77591741af3e68e5fe71d23ae4370ff\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:17 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189683\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacd73dfe855a-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049810=8XOhqPYzNvtuGG/4OcysAi/9c1Ix5YgXavBiBH6qc9bjm9WqeG2yII9Rd1CIWAUKAG0FxykRuvJXzDnxMKqk+rS68KDMASNbTzkdswwt4XDucm6b5py1vQ6G35la3BMmWsZTXXT6A4L15Kx99KWkHMnTvjv0qUeu4ZUmFH0QFz5BQ+0r3VTY4mBrhnaqQbQB\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: 0BCDFA2E-2009-43E9-89C9-05943016FB85\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":117319,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"e77591741af3e68e5fe71d23ae4370ff","sha1":"ac4d530b4ad25b0dc275d4a16d0a93c649aa5822","sha256":"b2c2bd6de89142477d0cc668277e5a8dc737a7b09e85a8ea98dd59e3879154e1","sha512":"20daacb87078c7f45478e325e17d9d824653899ff15e004f41a73dcabd668cc011617bfa0526b8e00020a79cd0928b6837531f0333bdf942afb74e923e6dc51a","ssdeep":"3072:A+kUtq3tYWiGRJMf+5rzUZpd3F/WKDT7PPrJdd1fExWh:AeqmjiJG+5iF/W0/nrJdfQq","tlshash":"5db31280331968a5c586b83636766d969cb5ec36b347060ff96cd0a814428cf6f9fce9","first_seen":"2025-08-29T11:05:53.117443Z","last_seen":"2025-12-29T13:58:58.08881Z","times_seen":295,"resource_available":false,"data":null}},"time_used":2457,"timings":{"blocked":2212,"dns":0,"connect":0,"send":0,"wait":234,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_50b16c20-cbfb-4c4c-ba8a-249055c85af3.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.702Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_50b16c20-cbfb-4c4c-ba8a-249055c85af3.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 133257\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wB5qaWQxlF62qiYj6I8x0UScXAfdBF4IOw84K3ReMd9l8qLzOc6Wf21pFh%2BOLx39saNg7MHLtk5qE8Yws8MlwTzvFwfI28pqMxSo957o1DAY4dFWHCPNvcWAV7Cr\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"e932d01be4f46b30fb7820d0a6ecaa8e\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:27 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189693\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac8e8d620f0c-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 28CC40FE-DCF7-4000-8B2F-ECFFF7539231\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":133257,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"e932d01be4f46b30fb7820d0a6ecaa8e","sha1":"8ed805238342c4428630a620898688c541d49d8c","sha256":"237a03a4d6554209676acd0d140a2194419ce3672b849cfaa99df1bd8a31fcac","sha512":"fe1dbf59bfd451cf5c9080af7c932b8d8cde5eb25cb58568d7cdaf3c1a4015d1e858201775291bd74872d7e0444746def52d068c58fdeeabffcf8d21acd2a493","ssdeep":"3072:IDJzDKb/eNOyrjQyTU0mZn12vOjQiSWT+UPNeaHp1nvDeEUiu0GGXf2quOn9:wPKbE5rkyTUDTVQdWT+UP/H3n6EneqP9","tlshash":"09d3123a7053df65d92ff2a8e11ef8caa5722729cbab1945c80dc98615220789c83d73","first_seen":"2025-08-29T11:05:53.12363Z","last_seen":"2025-12-28T02:09:46.269424Z","times_seen":297,"resource_available":false,"data":null}},"time_used":1958,"timings":{"blocked":1746,"dns":0,"connect":0,"send":0,"wait":201,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_79864bfb-d71a-4513-a524-8823b86ee01d.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.756Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_79864bfb-d71a-4513-a524-8823b86ee01d.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 87818\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5kJU8WTQvbipU91%2FM5CKwdPw1Rskqpop1LqBdqil8Ru1QUm2lyxzqWC2MLS3Ym3y%2BBIkSaCkTC2ZDNywpVPqBwCWdjiwZcarqrPrd8FTEBIE5x%2BYjDhJsy%2B2qWFX\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"aa6fecf1d92393ed340d8ecf5eb30180\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:10 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189683\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacd83e1e09cc-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049811=yfEHl6AolJP0QC5NkMkOAeL2cxw2cvQEQ0CJoyH0PwylhAu+93HbTVa2aaGzmwCJZPRlEiCkJ/Lezou0DkT7iNjC2gSEaRk5/ITYUs6HFP6vgf9C2kZ+8cKO8dprXM2S7lcJEzc2ZecPldSfp0XqpOhoW/bsw+EQEoKlKZs4TyR039jUu6QbtWk2lIQvTHt+\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: 104B093B-9AE2-4051-A5DD-DA9F5A8FE7C9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":87818,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"aa6fecf1d92393ed340d8ecf5eb30180","sha1":"c253c4066e99708b3af4c91c8cb87f5500b9e14a","sha256":"802eb202e21b02b88c529fcfab0745795ed573a9d1a623f06c64730ef1424bec","sha512":"a2bf6e88728516abb6b6bc3c7b8475ffad41d7f8a1a3420bd00a853256faab18f42b8e358feb7194a7d5f4e327753943edd2d784ad489a3f6464ba3dfaaf8a7d","ssdeep":"1536:kBPumsnGpw4JOOR/fiF4kRtopUtzjHjt/UEqVo0xrQiGkw88TpGwB3EVchMbYi+D:k9AmJOyHOqUt/XWoErQi/wywB3miDz1d","tlshash":"bd83121fd6c96f65d8d871fd28e8734298add1835ed12e43a001a7e88f498f0a027ee5","first_seen":"2025-08-29T11:05:53.090923Z","last_seen":"2025-12-29T12:28:25.260601Z","times_seen":296,"resource_available":false,"data":null}},"time_used":3882,"timings":{"blocked":3618,"dns":0,"connect":0,"send":0,"wait":257,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/10215a4936ca5621c4a2ba1cc568461c7cd00?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.501Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/10215a4936ca5621c4a2ba1cc568461c7cd00?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 52403\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"10215a4936ca5621c4a2ba1cc568461c7cd00\"; filename*=utf-8''10215a4936ca5621c4a2ba1cc568461c7cd00\r\ncontent-md5: ISJEUTPw7u7Lth/kn7aQIg==\r\ncontent-transfer-encoding: binary\r\netag: \"FoVZk9bJsZuRy8SEGoW2jSfEMgIa\"\r\nlast-modified: Wed, 06 Jul 2022 12:51:33 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-5;QNM:fn193;SRCPROXY:fn271;SRC_***:2/304;SRCPROXY:2/304;QNM3:3/304;QNM3:44\r\nx-m-reqid: 70uCeUlw4\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Validate,Hit\r\nx-reqid: GiMAAACv3rstSHAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52403,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"2122445133f0eeeecbb61fe49fb69022","sha1":"855993d6c9b19b91cbc4841a85b68d27c432021a","sha256":"e7a9df9e1b37258176ea04bb06ce47833e8c270bb8a431f37b9c26ed17d0e04c","sha512":"673d423aa700211ea9f977ea8e2192804aa394ee410d472238029161db048243dbfd93ea00946d5eb63e2cd58fcd32bfa79baddb0834a66b6ccb48d3917c40b4","ssdeep":"768:aa4fQiypBZOVjdTjtsRamnEXK/kL8nkQNI1+O3f+3FApXZUogLYPLEYYLo4ljvCA:R4YzetdH6gmEpwZjd3FAXRULNljvCA","tlshash":"bc33015ce15b5f9b3b52b089c2d0e3e9d5e02ba78b4653a810789e2d77902fe0f0c59d","first_seen":"2023-08-06T17:52:17Z","last_seen":"2026-08-09T14:01:03.992491Z","times_seen":367,"resource_available":false,"data":null}},"time_used":2717,"timings":{"blocked":1041,"dns":0,"connect":0,"send":0,"wait":836,"receive":840,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202502/_raw_size328x442_27f7b303-88a3-4b2c-aaf9-2bc0106b5d62.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.767Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202502/_raw_size328x442_27f7b303-88a3-4b2c-aaf9-2bc0106b5d62.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 142348\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bPpnpo2706eDQ6U66S%2BF8kKLynXUGk15hElTY1KGs1Ut8XyatYKxBh3pu1MduY%2B2R3Jrj37dm6lfyOcxv5S%2B9HLXau87P2qU7nGcsswz2iidJatCX2dtoUBthw%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"1aba814fc168b414bb58dc6134274d81\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:26 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189691\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac914c611c66-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 103F57DD-FF5D-4CD5-96AC-F72C166CC727\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":142348,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"1aba814fc168b414bb58dc6134274d81","sha1":"2c4644e685cf8666032b9109d6cd0330db2695a2","sha256":"4e5f7a80e67fce0d6655ade909560ba442ded2b9b5f29b3b61118bdda5e36957","sha512":"44fd53c792e7d2ce5de8f0514c8dc5ab2528ea2940754369a8814e92d3144cc9d2bf43f23f74b97c6258ec040d846ad46fad481de5b92cb316e17fafdac5cb1e","ssdeep":"3072:OXLmVOrvZSrXI1/wWyNVfUWwjKyRHSnB+ymBJ+N+S87dyP:cGEvZSOYRN1/LDB+ymBARFP","tlshash":"f7d312dd571a0a9c225f2a1e2eb4c97ad87a150f3132d33883e8f2b5f5e358a4735618","first_seen":"2025-08-29T11:05:53.236617Z","last_seen":"2025-12-29T13:58:58.057583Z","times_seen":291,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/chunk-init.1756903329400.f53cb96a.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:03.391Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/chunk-init.1756903329400.f53cb96a.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:03 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-42aa8\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049803=N2Mzwq8fLWQhe5PvbYJKnT1J9Jk9QgjpDkS98sT0zMkxLwtxh6uDYKsuHHgZ92HdOrvsCoOXZCeUHdYDG4WOFi8shXZ1ri+iElYDeZ1akQ3cSi8Vkg1DM7B53M3dJgpaHf6bli/J85KwiwvgYpuXBz3LFDvFlDARwGqtVF2qyuwPxvG8f0dCKPXCjzO5DnCS\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: 91EFA337-65CB-4760-8457-96AF256379C7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":273064,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (44101)","md5":"daffbf99400a4f119f452d48a10ea62a","sha1":"0ae2d45d2befd0f11ae9373195c409f491a511d9","sha256":"1dcfbbb596d333e200aa1b0e4e282c296f29bfafdee19ff4014fad30a394ae45","sha512":"8e39ce35d7f18deb579cf03330a935e18308541617b1a265e4d7f88480b4d29608598e6d2be86328106fa64c4d707e608f333319bd1e7627df53a0170de079fa","ssdeep":"3072:etwqhOIKENB85doKa/x5wc0dB5/J+UUknCqdnr4QMA/C:HENm5ox2Br+2nCjXz","tlshash":"ea441b98b3d171b846cb53e5622b1035f6ba1ca33098e4f0d219ea547f3168dd52eeec","first_seen":"2025-09-04T00:49:32.986263Z","last_seen":"2025-12-29T13:58:58.044472Z","times_seen":443,"resource_available":true,"data":null}},"time_used":790,"timings":{"blocked":298,"dns":0,"connect":0,"send":0,"wait":259,"receive":233,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/52388.1756903329400.521cb32f.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.778Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/52388.1756903329400.521cb32f.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:05 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-6b1a\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049805=po6D+l8dMhfLGKAdfLLnVeIRbjpxlkQDEuGKbtlEOTQWkshI6okgIymixUARr4wGybpILVpsVTfVc7k0JaAkDpC9mG+fNrxEIVp7sH1o9IEd57siolGhKy+cprba9qHT4pkoamaJpfQkaW28kwG1+DFqQQxzksZj++jdxZwG6L+cO51eyJYwemgSWglzoiWi\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: F66CFED2-44BE-4F8C-8F8A-C49584C93ADA\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27418,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (27172), with no line terminators","md5":"cdd31eb0b7ccfc1eafcead314123dfda","sha1":"2bd4708c1e30cebc08cdada8ef890baec6ef8622","sha256":"669b207d5cf11b0e229699f6e54104836b252c5398e20c4bb564b89b2525f0a2","sha512":"9c48059df23c4a9632eed22a28d883786e40c593fe3ffddb9144fbca21a45322121e36580084fc642e9058f086d3657d819f5d2b9528a91633aeb2085cd5ff06","ssdeep":"768:f9Vl3u/ffsp3aNWchZ4IIATAJ016fkmD19mprq2xd7QjDv1gyT8CpYCVc5WsNiU:8308O1cq2TlW0","tlshash":"84c20a80d6b4f5fd636ec9ab8a3a8464602637c5b0c8ace095ec6e8c3d4475774788fc","first_seen":"2025-08-29T11:05:53.257205Z","last_seen":"2025-12-29T13:58:57.988641Z","times_seen":422,"resource_available":true,"data":null}},"time_used":234,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":233,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/2541334d36960d9124b49adfcfa0826251934?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.413Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/2541334d36960d9124b49adfcfa0826251934?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 14644\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 2424318\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"2541334d36960d9124b49adfcfa0826251934\"; filename*=utf-8''2541334d36960d9124b49adfcfa0826251934\r\ncontent-md5: 4FAIWpI4/t8xpB4bELJhrQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FgaXLaN_g-B7yN0JIMv3pIng9PAX\"\r\nlast-modified: Wed, 06 Jul 2022 12:54:17 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-29;QNM3\r\nx-m-reqid: ZuaGUjEWK\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: 5eUAAAA-BKVzkmcY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14644,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"e050085a9238fedf31a41e1b10b261ad","sha1":"06972da37f83e07bc8dd0920cbf7a489e0f4f017","sha256":"a047e69a7a37376e53c2f9f3fa3f118917b2d98a79d461b1799c7b6f3feb9fc4","sha512":"28d3c373ba26ddf7630e3abe7d0d71a1c1b926a0fe8c2b8d69e03d05d29921e30a3d83b03b0d05efc8ae45220e3145bca431b8c2ab74743d27b0f80e6ed51294","ssdeep":"384:Hndt5uC/CyN7xrmJOVg8YYxJ56ZqkA6qbNXodqZS3F4PrW:9t5uC/CExrmkVUY18qkGbNXoF4PrW","tlshash":"2062b0f87d606d8f79bcbcf50a10daa06e61f6e6ea0aa74c9c435336de113285945d20","first_seen":"2023-09-23T06:35:08Z","last_seen":"2026-08-08T01:30:57.902688Z","times_seen":203,"resource_available":false,"data":null}},"time_used":2249,"timings":{"blocked":1127,"dns":0,"connect":0,"send":0,"wait":836,"receive":286,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/bj3.a7dbd558.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/bj3.a7dbd558.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://u65r.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 5835\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-16cb\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 94907\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: E2C3BF38-DEC9-4BC7-82E8-519DCD763DB9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5835,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1003 x 171, 8-bit/color RGBA, non-interlaced","md5":"b79234bcd23ce7e063481b3605bcdd45","sha1":"eace4c48cc352cfb10fb6fcffed50748f18aa78d","sha256":"2dbca2ee9a515b178cb6a5ce670a5dafa30941ad8c753fa3e94642f8dacca13d","sha512":"40fa685181391f1ca805440f53683045d1fbd5c0f36cf471f53641c6f289481f42fefc4d1f2b2fdfe8a20d7488ef0537f10352492e46af76770b49fe8876def7","ssdeep":"96:brOIaX7VK+RUSrZ3rnZ1L++y+hsVoK4CBVVikox3n0muoE7Nqh7zwGto:K7VK+RBZ3l1i+y+3peikr3oEJqh7MCo","tlshash":"91c18f03f313ed339b875f190abe4dc3498b2f9a4725a7d6285b5aa89654819c062e82","first_seen":"2025-08-29T11:05:53.328141Z","last_seen":"2026-08-10T17:58:48.467139Z","times_seen":2614,"resource_available":false,"data":null}},"time_used":1459,"timings":{"blocked":1199,"dns":0,"connect":0,"send":0,"wait":259,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x422_936e6f39-c72d-42ec-ab51-2bd5a806c902.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.700Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x422_936e6f39-c72d-42ec-ab51-2bd5a806c902.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 88572\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=G14zsgPfujDcPxsDBIn84tyZh2XyOAWDqvqBSSJMZ6a5xa%2FZlivRzHJL9e6XcLsqz1WBKLLzPUsiWrhWxBf9zShkCcxaoq0NyyF3%2Bu4Cs05WzuQKJ8oZcIirn6Ym\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"06a585f41fc826b5347e04ee59ff56b7\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:06 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189681\r\ncf-cache-status: HIT\r\nCF-RAY: 990eaccd2f7703ad-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: F1DD5516-C891-4987-AD27-93F6C55DBC40\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":88572,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 422, 8-bit/color RGBA, non-interlaced","md5":"06a585f41fc826b5347e04ee59ff56b7","sha1":"1357eea1219b34aeda8b3ff0643b01f75264656b","sha256":"0fee4da04a467bded4cef5fd0200fe14d5f81cd79a42d95e2cfcf48591335822","sha512":"b06f99d758a92961e244aa05e7857e352935deef71d7478a6e7732f663822cc33b68139a539355c400bc641bcf3a8f48c147903416d1f941999f1c02f76e69c5","ssdeep":"1536:i8UehXCmLCRQjvGvRyM06zzwtzB3tDxwjdPsvEPDWX0I+WHr3:iOB0Ryudk3tDonDx7mr3","tlshash":"598302ec999d325ef0cb9232409a310a7435e01b1fe4d721a5c5aea581dbca5ff2ce09","first_seen":"2025-08-29T11:05:53.264183Z","last_seen":"2025-12-29T13:58:58.052124Z","times_seen":299,"resource_available":false,"data":null}},"time_used":235,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":232,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/103752d7ed68f2dcd4887b7833ee1897af3b1?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.524Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/103752d7ed68f2dcd4887b7833ee1897af3b1?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 23801\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 180725\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"103752d7ed68f2dcd4887b7833ee1897af3b1\"; filename*=utf-8''103752d7ed68f2dcd4887b7833ee1897af3b1\r\ncontent-md5: v3/5G4MPDyXFQitQ/P7GuQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fj_GG_uuMBOkriQaHx_yFVAeLOvS\"\r\nlast-modified: Wed, 06 Jul 2022 12:55:49 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-22;QNM3\r\nx-m-reqid: jDRhKBrNI\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: qe4AAABUq1XPo28Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23801,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"bf7ff91b830f0f25c5422b50fcfec6b9","sha1":"3fc61bfbae3013a4ae241a1f1ff215501e2cebd2","sha256":"95db1982962aac48aa4c88e6fcf773a6281328a7e6438cde1db0f0abff34e55f","sha512":"5ce7f92109a8ad60ebffbde39f324d5409f1e7f8fd48e83189e3fff01dcebb023b438885165c5cc8e75c8647433d94f9c3dedde8160b00442720eb020e0b3ab0","ssdeep":"384:I3CyVA+kl1k1/RbUvgZ3rfGUI6A+8zuw/qvEF3meEfYWYxZw6kEIif4lA4/iUgCc:yk7IbUvgclqvBfYWzPL7o9","tlshash":"01b2e108d5b8c755c54e9bb150190973637af10fa7b2f83848abfb49ed2732680770b2","first_seen":"2023-08-30T20:30:43Z","last_seen":"2026-08-08T00:56:42.201267Z","times_seen":180,"resource_available":false,"data":null}},"time_used":2971,"timings":{"blocked":1018,"dns":0,"connect":0,"send":0,"wait":837,"receive":1116,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_1d28b817-0c00-4339-b666-213943a7b1d3.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.707Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_1d28b817-0c00-4339-b666-213943a7b1d3.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 169448\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4JNLWtbrZrT0NZMYRU7c%2BIsvziMrytnP%2BZ2ibxmWRhcTPsb8mcHwTRji0zapIBD2T74Ga2Sfdwynmj0YGrPYV70P1XogONzTZU1JMgjAtHEIxH5hMXzHQGB5lTI5\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"8bdfc70c7f82ce44daf0fa05ad3eeaa4\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:08 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189687\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacb63e44055c-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 20EE733A-10BF-4233-9B01-5E3261D586EE\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":169448,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"8bdfc70c7f82ce44daf0fa05ad3eeaa4","sha1":"28324ebfd2786e353a9d8fcaccc4f0ac799d7298","sha256":"4a6a0f4743ce7322265461bcf5513b75300ee02a0e0fa99c6ed52504257ab386","sha512":"c42e0688880255c76f533517731cf5e26c7804903f62d67dd3bde71534051930144edd77cf3cd25bac6c7b5ccca482a824f3e949b75d7e1ef933673b39bfa9eb","ssdeep":"3072:vWQAl+XOeoZ6HUR1uhhITVjmrDOukWh0CX6zcAds080pWiCOM2aWLS:OYOeoZTR8UTutkVCX6zddVzMFWO","tlshash":"73f312c591b38ed687632d78cb44a2860133ef127968d9ed412c84bdc9ed2127cf48fa","first_seen":"2025-08-29T11:05:53.114202Z","last_seen":"2025-12-29T13:58:57.992421Z","times_seen":294,"resource_available":false,"data":null}},"time_used":2012,"timings":{"blocked":1794,"dns":0,"connect":0,"send":0,"wait":207,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_392325e1-efd7-4953-83f1-410dea55a03c.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.696Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_392325e1-efd7-4953-83f1-410dea55a03c.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 80779\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3HFX3BE7qGIeB7JLZtI09H%2B34MjE86D9f4MOhfC5pRsDI%2FNMJGybiZ0Zwf4jI0RF3bYjfgdEa%2BTUUgh31smJxLb2JI0rqpqr61WDegrrFF%2BXTPMuqL1GBX93r%2BZB\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"4c5942d2ff7143f561ab601251f4fd8a\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:25 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189694\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac8b7db9e2f1-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 6C046347-B601-4C84-8818-2571B164A961\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":80779,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"4c5942d2ff7143f561ab601251f4fd8a","sha1":"33992d6c0f6b7cfd15c10b89cc21d6e61b388b9e","sha256":"930520faaba7720398434d06b0cdc67819d0bfb174db13978ea1df7f95fe2c19","sha512":"a8fd398b0dce4c041f2570df3a1be5d46766e8206a82c53c78ea7bf19fb22bddbf465acc1df277200236b58168149cf7101698f416ab9f763406d09d5e0b343b","ssdeep":"1536:THVzFXmHVHAZWTzvtRHxFyUBlN+f3LkQ33zIVxWDmI3Ay3/ntH8:TDWg4TzXHxPS3L9zIVxWCob/tH8","tlshash":"20831231929bf246f092a3b6fe3a5165181cdd60dfbcf58b8d5e4e281d6b2c1820dc97","first_seen":"2025-08-29T11:05:53.231567Z","last_seen":"2025-12-29T12:28:25.243317Z","times_seen":307,"resource_available":false,"data":null}},"time_used":1751,"timings":{"blocked":1548,"dns":0,"connect":0,"send":0,"wait":200,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_b0506ddf-52e0-4b2d-8f59-16f795505312.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.716Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_b0506ddf-52e0-4b2d-8f59-16f795505312.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 473762\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yYY%2BsqwyteKTQLStn%2FxqtA7ozXz70ccSAykylUqYLBpL8mRtTk%2FQHE68v5H7T3WDarF4DVhh5QvdSHeEcsSfC5edRBAOA3XHuiq%2BWy0HKUKzkO%2FSbtI01sJ4FLbm\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"cc5f88340212cac674500954aead1456\"\r\nLast-Modified: Mon, 08 Sep 2025 20:42:18 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189692\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac9ac8618550-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049810=8XOhqPYzNvtuGG/4OcysAi/9c1Ix5YgXavBiBH6qc9bjm9WqeG2yII9Rd1CIWAUKAG0FxykRuvJXzDnxMKqk+rS68KDMASNbTzkdswwt4XDucm6b5py1vQ6G35la3BMmWsZTXXT6A4L15Kx99KWkHMnTvjv0qUeu4ZUmFH0QFz5BQ+0r3VTY4mBrhnaqQbQB\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 0F38D52B-B847-4E5C-A010-041B04D6C947\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":473762,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"cc5f88340212cac674500954aead1456","sha1":"f90402519324070fe5387747aa568406615353b9","sha256":"eddd66a7205f52d67435b916c2fffea6024a6ecffdf74627cec55c7e4aa9f1fc","sha512":"fd5276c4c317e70b7c660edc9b4f71fb45c690d159a5ecaef28f9f9bb077225eda071915b2a5a6bdd28a525517e6ef38881b1d76201fecfe84f2093dce47a7dc","ssdeep":"12288:eY/dfPbc6XDpHO8KH4+h1+CNA93hMXHov7REUn+cBw5n+HtH:93b1SHQZhM3NABBw5GH","tlshash":"75a433612695f7273775ebf0cd7311ea3181e500a3ea64a7df6bc11a41e68a0b4ec31a","first_seen":"2025-08-29T11:05:53.308158Z","last_seen":"2025-12-29T08:12:31.3923Z","times_seen":284,"resource_available":false,"data":null}},"time_used":3636,"timings":{"blocked":2289,"dns":0,"connect":0,"send":0,"wait":230,"receive":1117,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_ca5ef219-cb88-4c5a-b68c-c85984b21465.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.759Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_ca5ef219-cb88-4c5a-b68c-c85984b21465.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 516108\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ctsHt5qbkJvOFNoduPTNauuNL5Kt0NoLKAK62GcmoEmpokOIx%2F94GRKnv9Y3JziwesUhSb%2BgSO2Zg4FFd14f6JcwdZ%2FEies%2BbzEd34gLwq9SlMoX%2FcpnYPUB03rn\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"d4d5aca2713343207ffbc99596a6f753\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:20 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189700\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac6e1c3208d9-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049811=yfEHl6AolJP0QC5NkMkOAeL2cxw2cvQEQ0CJoyH0PwylhAu+93HbTVa2aaGzmwCJZPRlEiCkJ/Lezou0DkT7iNjC2gSEaRk5/ITYUs6HFP6vgf9C2kZ+8cKO8dprXM2S7lcJEzc2ZecPldSfp0XqpOhoW/bsw+EQEoKlKZs4TyR039jUu6QbtWk2lIQvTHt+\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: D43D3F0D-9BE3-4593-BB6B-84C71C04A45C\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":516108,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"d4d5aca2713343207ffbc99596a6f753","sha1":"931979c1e821d667ae318f26cbe7c7aaf7da6912","sha256":"f6b9d3f3612c0f2a397af6b94b94a38f4a2dcf82721ba9854ad7fccb9e568135","sha512":"57bf6b1df3237f5309de2aa4701d7ed5033dd815ad39d275d714c38e9e583b1264bbe89007422128be8e3987ee97e01d439752b61e61a13fba439e2bb8e6c8f2","ssdeep":"12288:h3QBwTSe071RExxzDaLj3xyfVG4LZ8hWt:tQBwTwexV8jH41j","tlshash":"3cb4239c8495886887b8e519da4f999c33c7dcec3d4cf29312e867950d0ffc80ab99d9","first_seen":"2025-08-29T11:05:53.138924Z","last_seen":"2025-12-29T13:58:58.057106Z","times_seen":287,"resource_available":false,"data":null}},"time_used":4296,"timings":{"blocked":3761,"dns":0,"connect":0,"send":0,"wait":265,"receive":270,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/a7e49dbc-140a-4c02-81cf-e55cd0108e5d.jpg","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.783Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/a7e49dbc-140a-4c02-81cf-e55cd0108e5d.jpg HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:08 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1KNHrVMzDzGmOcwkMCWO3Azbt5y7gv5MQ2j7pmHRd2Ed5ANkp3OqjEKgeKH0H1bF%2Bw6vg0S5oJAPmfhV5sLRUKcKdHH2tk3ooUisvVAppI0BaZmnOUkidZYTdj8k\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"f42e0fcaaf4b3dd132c5b52a7fa29773\"\r\nLast-Modified: Mon, 25 Aug 2025 10:01:09 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 46552\r\ncf-cache-status: HIT\r\nCF-RAY: 9920c3b86993848d-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049808=sBeSKsiafNlkKsLs4C/dAiFvvIebGS1CCiZrVBTiq6N2BrMHJO/A06D5FyfgjgTxmm65szHCxvbeWCjEoLhX52ZT+6aWyh2Ly2dWJuSrJO8MDlgQ2vONi+MIwEavNqtGmMx1nEqf7c6BCaib745OKSMBePL4GHCI7LEl0G2xpUJD22vca5uX8ey/KW8PlWax\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 2FD03585-E975-4286-B4AF-6A95A9BE3B09\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":221858,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 540x650, components 3","md5":"f42e0fcaaf4b3dd132c5b52a7fa29773","sha1":"23412150020e5af9888e58038f823dba9073027d","sha256":"1f0221df43cc57f4baa91484c6d4d1eb8374623bb21dafd74c526f95942153f5","sha512":"716a4b79708b5efc807da4f3f4554531c044db894cab68e14b5854fdf342d363fa588fa4fbb045b3b729b06e7f8df9a1619183277f6f90228c2419ab7f48c9a8","ssdeep":"6144:DtRn09SU2N018YMl2/LwukXqlZU06QX3H0x:D09SXN01XN+ql+0pUx","tlshash":"8a24129423536cd1fcaedae079d87a0b3a5626fc90fff44386144a81635ebbc618171e","first_seen":"2025-08-29T11:05:53.340749Z","last_seen":"2026-03-18T12:35:39.054225Z","times_seen":1134,"resource_available":false,"data":null}},"time_used":1310,"timings":{"blocked":772,"dns":0,"connect":0,"send":0,"wait":274,"receive":264,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ssl.gfw301.top:3600/?u=https://u64p.xyz/\u0026p=/","fqdn":"ssl.gfw301.top","domain":"gfw301.top","tld":"top"},"ip":{"addr":"23.224.132.157","port":3600,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-21T12:30:01.817Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"cloud.hw301.top","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Thu, 29 May 2025 00:00:00 GMT","end":"Mon, 08 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:4E:24:3A:D8:36:35:C8:D0:C1:C1:A1:1F:7B:D9:0D:EC:CE:62:BC","sha256":"67:2E:AD:FA:0B:E2:35:70:C6:CA:33:A6:37:89:7B:60:02:EB:53:E8:1A:BA:DA:2C:70:AE:4E:BD:D0:A3:11:0D"}}},"request":{"raw":"GET /?u=https://u64p.xyz/\u0026p=/ HTTP/1.1\r\nHost: ssl.gfw301.top:3600\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://u64p.xyz/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx\r\nDate: Tue, 21 Oct 2025 12:30:01 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: keep-alive\r\nLocation: https://u65r.xyz\r\nX-Frame-Options: DENY\r\nVary: Origin\r\nReferrer-Policy: same-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23624,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T02:51:57.151416Z","times_seen":17879698,"resource_available":true,"data":null}},"time_used":181,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":181,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"ssl.gfw301.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/45734.1756903329400.46beea1c.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:03.395Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/45734.1756903329400.46beea1c.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:04 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-43a22\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049804=h5k4oOZBnH07/tXwPIgLACWo459+P2Pabs9NtfDroPIDrNZiYSJJtMy3o1VcjQflqa1V7B/Z+Nh3eoBMUpChlR5iMn7XhWnsM406Yp37szt6I0vL5Dxr3e26J0gLTDWq4BPO2oJWrWBLw/2asm78ZGKFS0Ej8G3eFlTffCQraOfnlC5OG8KVbdcKmF+pSwvy\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: CF536553-3E2F-41D2-9E22-4B81E28855B3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":277026,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"e5f34b5441b6b582d6d469c537f6f97a","sha1":"defd5aad4e0d066131c97173b21b7b3442cdb951","sha256":"44db08eec9e6d649f62d7d208bce223e33424ebc58c21098181a90ae5a1c6437","sha512":"4096ae8bc07709597c8411157950bea75aba46cee36964fe1e280a31a2c2c9d4a8d5821c3e8a4cca552919511930bc9f834e2054580c452acc17c1011d1e6168","ssdeep":"6144:F/EFTU8Ra90Jjytg7DiQPkcsz1h84faSDWidmVHrqZL:9y/jytgPJP484fa5VHryL","tlshash":"2a441c84b291f0b4879b42f7922b4055a17f48a130ccacb4e2a5ed90be7555c927fbfc","first_seen":"2025-09-04T00:49:32.926111Z","last_seen":"2025-12-29T13:58:58.062377Z","times_seen":438,"resource_available":true,"data":null}},"time_used":1552,"timings":{"blocked":1023,"dns":0,"connect":0,"send":0,"wait":269,"receive":260,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/kc523-1/noData/cms_noimg.png?1756903280095","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.293Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /kc523-1/noData/cms_noimg.png?1756903280095 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 9882\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-269a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 101401\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 5673E8FC-70BD-48FD-ACEE-8DE6EC9C20D4\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9882,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 700, 8-bit/color RGBA, non-interlaced","md5":"85e60fd8767b18839ffb552a5d543f8a","sha1":"341cfd68a5b39cb246af6ade1e3171c857d2df5a","sha256":"4b7ad68306ffac25830d1016ba86154890deef8bd77a03257b767b37de1c8338","sha512":"785f028aab80d3f96794431f84025483f490d7d642022404a7b14ccb4785aa52fe4a21048d44acda3bd160eedeaccfb4959a677986dfe47ef038d80724f2acb2","ssdeep":"96:74iGykVWI7TGvGJUgTFSebsBzYofEC16+TqBK7R7LWKaR8a8D7uZNgAMXFL73:74iyHunEFSebsvP1nTP7IF2uAAMX5","tlshash":"141259118573d43cd82ce57926df6fb93b709f996890476e8328e7342f2a2f78d60848","first_seen":"2023-05-01T09:33:58Z","last_seen":"2026-08-10T17:58:48.364752Z","times_seen":3146,"resource_available":false,"data":null}},"time_used":259,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":258,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/15945bb514602b3c4444aab085beccc681ef4?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.567Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/15945bb514602b3c4444aab085beccc681ef4?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 10107\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"15945bb514602b3c4444aab085beccc681ef4\"; filename*=utf-8''15945bb514602b3c4444aab085beccc681ef4\r\ncontent-md5: 3BfB47xSYF7T6fX7l9J4qA==\r\ncontent-transfer-encoding: binary\r\netag: \"FuD9D4TzUv_FGQn_IqA-DFtOx--W\"\r\nlast-modified: Wed, 06 Jul 2022 13:08:25 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-22;QNM:yzh161;SRCPROXY:yzh171;SRC_***:53;SRCPROXY:53;QNM3:54;QNM3:72\r\nx-m-reqid: QNdtazaC3\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: _DsAAACvLftaL3AY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10107,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"dc17c1e3bc52605ed3e9f5fb97d278a8","sha1":"e0fd0f84f352ffc51909ff22a03e0c5b4ec7ef96","sha256":"1ca7173d3a9a5cffb3336abe3312ffd8edc77d55ae171c38bf5872ab912658ec","sha512":"a16cf6132bc129004a6207ccbee91a2fa451b8dd0b31707d702d94210941ff6c9fcea587e0be06b18f8cebaffe61918f8652cb979f42e8c6e1c183c9ea1980d5","ssdeep":"192:D/zPN9P2YI7Ob2oFqDEVTyOHyS8aag1cUdjkVyoSc9gvAUAi9Y5KIp:D/DP2YYOjFzL78aa8djvWgsio","tlshash":"4622bf5d5bbae0b48ee78ffc41001ad49adb9bf753182663511b982dad0934d1d24782","first_seen":"2023-11-10T19:11:58Z","last_seen":"2026-08-10T01:11:53.627078Z","times_seen":227,"resource_available":false,"data":null}},"time_used":3207,"timings":{"blocked":977,"dns":0,"connect":0,"send":0,"wait":837,"receive":1393,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/f0f83841-a720-4f18-8acd-c726f4c1e685.jpg","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.823Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/f0f83841-a720-4f18-8acd-c726f4c1e685.jpg HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:12 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UKclD6sSXBXIdgLc6FVZjm4RxnxIE1b%2BVcu%2FqAIwdzzm9Vqjw9USOVBTOE%2B%2BblDvlG0R34hsOHO8lcktjEMIt5Xv2QCh83zwqYXI64VkrTc45JooSV6HzztBqqge\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"9a51e62132d61aed9329d3365be2ebe0\"\r\nLast-Modified: Mon, 25 Aug 2025 10:17:44 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 39603\r\ncf-cache-status: HIT\r\nCF-RAY: 9920c3d1e89308f1-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049812=rdeenGOu7oPbUjAiCKj7mQM/L2CZSERSb8B0wFuL8iAz8yGt/SZrwN9hzq//Jfkm2RgBtTQd0nDutTI6d6QWpAWOCgfp5dAbbfEI67TXctUIUufT2Gr4Y/EGVzH3Ds++pR5m1dg201x3t0V1APCXAY3Xdycq4n4xNiX+U+u5NzhLl7ERx+6lMbVyMrOoYSkT\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: FB41CE40-91C5-4386-9B86-DFDECE3E6024\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":363024,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"9a51e62132d61aed9329d3365be2ebe0","sha1":"ba931e82f0a0d6918ce044f0f615558efe8be66c","sha256":"71597c4dfe22a7312b692b0cd0a2f44582566617510a23883a44e84045882362","sha512":"9d94dc049160f5dae8daa5ac6038b90087c0093987feac83bee54a97063ee0b46a60f8ee5172d1726662db7c938489fb08f99a98df4020ab2756be9f83751339","ssdeep":"6144:QQgiqnqSjhCWWT0HqPrWJehmhH6rFITZWJEkA0DmfsskR7s+kQXpNhd3:QYiqSFMT/jWJehyaJLEFssE7O+3","tlshash":"e37423928e8f8c8257bf9f7114027c4e9048dbc6b9d107e05238de998efe508d6ac68d","first_seen":"2025-08-29T11:05:53.128791Z","last_seen":"2025-12-29T13:58:58.049671Z","times_seen":343,"resource_available":false,"data":null}},"time_used":5196,"timings":{"blocked":4852,"dns":0,"connect":0,"send":0,"wait":235,"receive":109,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/21062bc9cd638d1f84ad9a7e6b594e9c58c9f?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.593Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/21062bc9cd638d1f84ad9a7e6b594e9c58c9f?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 24746\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 247320\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"21062bc9cd638d1f84ad9a7e6b594e9c58c9f\"; filename*=utf-8''21062bc9cd638d1f84ad9a7e6b594e9c58c9f\r\ncontent-md5: 4OD7D55ygQVWlDcI6b+d0w==\r\ncontent-transfer-encoding: binary\r\netag: \"FrdPNkW0-4V02AE7pdbfQcVLQm0l\"\r\nlast-modified: Wed, 06 Jul 2022 13:02:24 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-2;QNM3\r\nx-m-reqid: m5mMr628h\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: mO0AAADtZ-qLaW8Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24746,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"e0e0fb0f9e72810556943708e9bf9dd3","sha1":"b74f3645b4fb8574d8013ba5d6df41c54b426d25","sha256":"3bcaf3a6065beb35d5b34f22e43cda91d41628b0e1bab83bd2202cab5ac33c0c","sha512":"c0567b764dbc230f52423fda49e09f62615933114b826c639206c1f25aca36dc28e6654486c2021aabc957f932a488be6d9bf2dd853bd2d8a2084084e5517798","ssdeep":"384:HdHpyjsEPTiZhR+y3LnjLL3mUFid9pQonCLdwvFgS7fiHNBfwCkECSm4qkWTs:byj4ZvXFidgoCLPSqjwCxX5qkWTs","tlshash":"dab2f19e616e085b8887950e952623d23c13cbfb47bb0d4f739c1657813617f8c9898a","first_seen":"2025-01-29T13:39:14.654006Z","last_seen":"2026-07-31T12:41:47.033369Z","times_seen":158,"resource_available":false,"data":null}},"time_used":3189,"timings":{"blocked":952,"dns":0,"connect":0,"send":0,"wait":837,"receive":1400,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_f26e0b0b-19a9-470f-90cf-ab38984671ab.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.718Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_f26e0b0b-19a9-470f-90cf-ab38984671ab.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 163087\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ESdu3fwMRmRc4CT2gFgO1WcZ7bTpFDIW%2BSdcy05TtTQOT65ABSMsBZfv1cwiMmdBsmxosYjWe6cblRTfSlcp6Kz6DcJt9eFHfR5P7cZaxbIhGuhG3EcTzfwqR%2FWY\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"665f9e6ae0a86d0eae47cb8dff17bae3\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:05 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189688\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacb80db0d13f-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049810=8XOhqPYzNvtuGG/4OcysAi/9c1Ix5YgXavBiBH6qc9bjm9WqeG2yII9Rd1CIWAUKAG0FxykRuvJXzDnxMKqk+rS68KDMASNbTzkdswwt4XDucm6b5py1vQ6G35la3BMmWsZTXXT6A4L15Kx99KWkHMnTvjv0qUeu4ZUmFH0QFz5BQ+0r3VTY4mBrhnaqQbQB\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: E9BA57AE-3952-49AB-9BC6-1C626EC693DF\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":163087,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"665f9e6ae0a86d0eae47cb8dff17bae3","sha1":"dd7600af4c65b5bda644140616ee4d76ac1795da","sha256":"caf741c67c08cd0c8291a16caf42ea1d9830283434a62be24fe1396f1bd21dc4","sha512":"3a8ed0a038a0089a590a989397da4b147781ca6aa99daef06344686e38bd3987772fce673345007dd6bab344d3719ecce0d75649355eeb8f3474cdc8aa78f5a7","ssdeep":"3072:f2ERsjJw8K6/iWw8B6ssU9m4QkMyu6IDLWuDboEfXO464gl3omZ1AU/eoIOff4e:f2EeFZ/aW6c9bszDCuPo+XO461YmnAiX","tlshash":"21f313d848400afcd04349fa6fa09931c3b17bcf53d9869afe8c63ae5d49964bc1568e","first_seen":"2025-08-29T11:05:53.303219Z","last_seen":"2025-12-28T07:17:25.238253Z","times_seen":289,"resource_available":false,"data":null}},"time_used":3902,"timings":{"blocked":2442,"dns":0,"connect":0,"send":0,"wait":209,"receive":1251,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u64p.xyz/","fqdn":"u64p.xyz","domain":"u64p.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-21T12:29:57.722Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: u64p.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T02:51:57.151416Z","times_seen":17879698,"resource_available":true,"data":null}},"time_used":1554,"timings":{"blocked":0,"dns":683,"connect":282,"send":0,"wait":0,"receive":0,"ssl":587},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u64p.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u64p.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/8fe89870-1081-42db-97b7-f8272ac29ae0.jpg","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.824Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/8fe89870-1081-42db-97b7-f8272ac29ae0.jpg HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:12 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KRPTZUNybdRoy4FdGwnVdw%2BpCnLEv0pGVCqLT9adZW9ViceUnzzG%2BaZhE4fY2%2Fk77dcuavF7QoJyTuG0TVoJuGgY0IIx5GWUKqvYqzXnF8PjaBMGKfZThmdpthJN\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"d04176a6c26e72c117b0f85d0eba80c1\"\r\nLast-Modified: Mon, 25 Aug 2025 06:53:37 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 49770\r\ncf-cache-status: HIT\r\nCF-RAY: 9920c3d26aac9fe0-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049812=rdeenGOu7oPbUjAiCKj7mQM/L2CZSERSb8B0wFuL8iAz8yGt/SZrwN9hzq//Jfkm2RgBtTQd0nDutTI6d6QWpAWOCgfp5dAbbfEI67TXctUIUufT2Gr4Y/EGVzH3Ds++pR5m1dg201x3t0V1APCXAY3Xdycq4n4xNiX+U+u5NzhLl7ERx+6lMbVyMrOoYSkT\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 7E19DC24-DD07-49BC-89AE-338FE3147532\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":344312,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"d04176a6c26e72c117b0f85d0eba80c1","sha1":"7d91bf688b4db4aa7840e7363e4b6477af75a7be","sha256":"e9229d385904201a79e88ec20831ab928bb126770dbb4cfcb1869d0d086083d0","sha512":"7f2d4db766ad2cd9f7b56750aff6bc621d478e79004b13e6c9dd41672d2215f2a817c43ec2ffe7cf46227d92c8b73fc94319be24edc93433c7ccac535e6295d2","ssdeep":"6144:QLznFRjZ8DkK4VAJw9ZFDPGVuiuRpBK9ZnAEpTLpzuJt1wfb1iaPH2kUM:g3Wo3PYuz3q/zqwzdHdb","tlshash":"6b7422e83513ca884b2f8f7b14c42a4d6a8d2e10dceeb5e9b479bd475ec280c867d494","first_seen":"2025-08-29T11:05:53.255926Z","last_seen":"2025-12-29T12:28:25.270141Z","times_seen":343,"resource_available":false,"data":null}},"time_used":5334,"timings":{"blocked":4879,"dns":0,"connect":0,"send":0,"wait":307,"receive":148,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_96811f47-5a2c-446d-a8ca-696df160de09.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.774Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_96811f47-5a2c-446d-a8ca-696df160de09.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 421125\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dV7xYHNCK2eVZXqqm4OopAxTO4pIO9N4cYLRnPkfnjkKYrIt%2BMn2K%2BbREXZpPmaZXhOMxiYUqV7xa%2F1oDtoTreq6Z3MU7OHjNIFxi3h6ZiX7byZx2l9pES2oNRRJ\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"ca2c40875930e080728d0dcff80c9acd\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:49 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189686\r\ncf-cache-status: HIT\r\nCF-RAY: 990eaccf0ba60791-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049812=rdeenGOu7oPbUjAiCKj7mQM/L2CZSERSb8B0wFuL8iAz8yGt/SZrwN9hzq//Jfkm2RgBtTQd0nDutTI6d6QWpAWOCgfp5dAbbfEI67TXctUIUufT2Gr4Y/EGVzH3Ds++pR5m1dg201x3t0V1APCXAY3Xdycq4n4xNiX+U+u5NzhLl7ERx+6lMbVyMrOoYSkT\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: D2E77C8F-94B5-48A0-AFE1-AA06C86ABD53\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":421125,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"ca2c40875930e080728d0dcff80c9acd","sha1":"029e9c2c8d28e246f170ee8c9e33dc0f56a90b88","sha256":"b940b7d79710788c425d36499d1d1f7cdd4b9683a003c482779009645dfaa41a","sha512":"e066766d55727f5e1831ea21e4e7539bb5a94159970a4c28d347c9403cd9fad8d5e3f7bbcb39b6a5d83c6c218f3f573644ed721ef1094a8d94ff67419da3bd12","ssdeep":"12288:HqkhMCNWKKgyxl4qXoC37KL/w2MpMw8PI:JXQoqYkKL/EM3g","tlshash":"61942398a9fad4579ce902f8e4900f4af6b351408cd201effc261295e533eed326d4b6","first_seen":"2025-08-29T11:05:53.309659Z","last_seen":"2025-12-29T08:12:31.348874Z","times_seen":279,"resource_available":false,"data":null}},"time_used":4900,"timings":{"blocked":4671,"dns":0,"connect":0,"send":0,"wait":200,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/theme.config.a0ea1565.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:03.389Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /theme.config.a0ea1565.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:04 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-19ee5\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049804=h5k4oOZBnH07/tXwPIgLACWo459+P2Pabs9NtfDroPIDrNZiYSJJtMy3o1VcjQflqa1V7B/Z+Nh3eoBMUpChlR5iMn7XhWnsM406Yp37szt6I0vL5Dxr3e26J0gLTDWq4BPO2oJWrWBLw/2asm78ZGKFS0Ej8G3eFlTffCQraOfnlC5OG8KVbdcKmF+pSwvy\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 1832FFD1-4DDA-4907-9CD6-113F3FD0BFD3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":106213,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (38260)","md5":"81c0ad2c8936f5f90cc4ba2b2e53366e","sha1":"8abbe251b908b7d81c73d8537d9d144d3ded3ff7","sha256":"61e7b259016e16c5f842da901c3b2f8202b73db878acb4366eccc217a4dc0b58","sha512":"f295e613097c68b8cb8d0a2530d07c3e883ffc75fdf6d0cd35c23040f1bb182401671c0f70781b64c97db7a37fe9d6d8163de658aef95ce9327ae0068afec7f8","ssdeep":"1536:D2JREob3mtlIRM4Sb2mc42mnzyJog9Cc0hM:qStlGu1pnz45HX","tlshash":"a1a3bb7ee20c963a6177a9bfb46ce111c12e9c0cab1d5fdef13e10a25710669c831de9","first_seen":"2025-09-04T00:49:32.985127Z","last_seen":"2025-12-29T13:58:58.024831Z","times_seen":440,"resource_available":true,"data":null}},"time_used":1559,"timings":{"blocked":513,"dns":0,"connect":252,"send":0,"wait":515,"receive":2,"ssl":274},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/zeren.c0aa584f.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.988Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/zeren.c0aa584f.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 3322\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-cfa\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nAge: 92156\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: 7857C99E-B2B4-4FB9-AE9A-8F1B8CC7885D\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3322,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 414 x 130, 4-bit colormap, non-interlaced","md5":"217588cbcd6216a09cac17953ae710b1","sha1":"de250755d284bb75dcee38ee45f2fc839987dcba","sha256":"24c2821b322d0c9087bcb0727dc0307311f6cfbb52af9f8a93308e48705f706e","sha512":"da190054ec0862c9927bb3bd928481459d53d4d778e9b2928c2507f2a34df5791d43adda750fcf184b767c1ba3a3f92e45dc57242a80869e253a9b37639abb4a","ssdeep":"","tlshash":"50616c01eb9130b8129c286701bd3fcda4c64d993d203d798d87b29bd6f970d288b123","first_seen":"2025-08-29T11:05:53.326961Z","last_seen":"2026-08-10T17:58:48.470892Z","times_seen":2434,"resource_available":false,"data":null}},"time_used":3179,"timings":{"blocked":2921,"dns":0,"connect":0,"send":0,"wait":258,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_b1b5acd8-3851-4b06-8e10-d549f7f09d1b.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.755Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_b1b5acd8-3851-4b06-8e10-d549f7f09d1b.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 24809\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k2Af0Z5D8AMHvQv0PV5jgz0O6TrfRgugzD3M5EIUH6bNfGu5O%2BID0MukOUWg%2BgsXuVQOHxtt%2BMgX9YABiA97u0g05DOMZ0FLEFsqS%2F8FAaH2RlZtKy2QaYJ0ZTrr\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"2b3edde7d1ee1537bcd21108631e215c\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:40 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189685\r\ncf-cache-status: HIT\r\nCF-RAY: 990eaccd4f45e2e3-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049811=yfEHl6AolJP0QC5NkMkOAeL2cxw2cvQEQ0CJoyH0PwylhAu+93HbTVa2aaGzmwCJZPRlEiCkJ/Lezou0DkT7iNjC2gSEaRk5/ITYUs6HFP6vgf9C2kZ+8cKO8dprXM2S7lcJEzc2ZecPldSfp0XqpOhoW/bsw+EQEoKlKZs4TyR039jUu6QbtWk2lIQvTHt+\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 4480239E-FE6C-4776-94C0-D0120192CE66\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24809,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"2b3edde7d1ee1537bcd21108631e215c","sha1":"508e10bba0af8a922c6b1dc55839f2b4e590bfe4","sha256":"a1dc3fc36a388e88c88e99bb41f92d5788ab004390b06623899ef890cd1937c9","sha512":"972baf5313b036ed8e4c8a948873700a01f7d811488c26a36d85fc084bb20046c2f801dbe96f92b1136c864599bdfa0fc78026e124273e6ca30c31e7d1733034","ssdeep":"768:ZihR2n5VYKYE3FXL9jWZCKlXw224GKbQZuBw:ZEnKYkjWZtF6K5Bw","tlshash":"f4b2f1796b7f0d31e24a4ef3a350b9c36b67986bcecd2996e001a5c00ab3d3e414d083","first_seen":"2025-08-29T11:05:53.246096Z","last_seen":"2025-12-29T13:58:58.059579Z","times_seen":294,"resource_available":false,"data":null}},"time_used":3875,"timings":{"blocked":3597,"dns":0,"connect":0,"send":0,"wait":277,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/left.34013cd8.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.978Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/left.34013cd8.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://u65r.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 237\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nETag: \"68b83893-ed\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 101404\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 7AFA820F-BE23-4A47-AE05-FE7E7A79315C\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":237,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 14 x 44, 8-bit colormap, non-interlaced","md5":"5ecca260da6fc5e2843405c20ac69817","sha1":"3918cfad7493b6860ded9e259ba90bc6a853f1b1","sha256":"078a4aac39c49a33cbabf23cda7579fa7b76e875e6b6d24d16cfcbf9f8b250df","sha512":"b76a870a79a87a450e5d30a218d75093b57415c563e64a8ffd6839a31b36379dbc08398698b9c1368ecda671d65045d5cfebe3363b98d746d89dcaad15bcd8ce","ssdeep":"","tlshash":"6dd0a99be2076faed1c70bb3732e0ca18a8124e892944b088042c622ca663a1dd82042","first_seen":"2025-08-29T11:05:53.221032Z","last_seen":"2026-08-10T17:58:48.26878Z","times_seen":2635,"resource_available":false,"data":null}},"time_used":1263,"timings":{"blocked":1063,"dns":0,"connect":0,"send":0,"wait":200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/api/sport/match/list?sportId=1\u0026client=web","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.305Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nx-request-source: https://u65r.xyz\r\nXign: L10mSpkTC9mTTXwNyd3NxvmLppk9e7sTgkbocfdVZEqxAGe9a2+W99YGz+sX37GI7Q8Nk2jGFSAmtosxUlf7Y8qH6iSHsM7Z+2VLhlfbM7hGo0NfmLNaMi//BIWHcCg5cAFUfwtFy5c+F3zLEcR7/vXGe9UaChgMwHtKybopdOk=\r\ntimestamp: 1761049806279\r\nsign: b3u1f6g10q6t794m\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: htmZ44nXYhd2SnrNty4ztc2apf5FpAim\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 155719E1-0A98-4ED3-8B1C-D906564E55AD\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15550,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"afce39d49a219939611179f37969008e","sha1":"2993f2f6c9c77406e6a56ac94c1617dd5352bfc7","sha256":"69110a9fb38b57a1e260ba8657973cafcc029970fe5727e4d461ba753df86443","sha512":"16c30322285cd9a93b5360b7d3ca2d3d23e757f37c1c126c3ea79bcbedd087abd3d0822b5d882dd83d5d7eabc7d5277abf29be60dcbc9a9eceeb87a0e168ca05","ssdeep":"384:ehyeu9d/BwJ2Gfh8PQEM0ZX4o6G1xxGOZ5gIenUX4bZnSik8qi5gsA2zqxDFP0dk:ehyeu9d/BwJ2GJ8jMSX4o6G1xxGo5gIJ","tlshash":"76621316c3ec68aa2b4d52d5290d374cdc3e6a1b0e9ef5d5ed0adf1c20e83f39209965","first_seen":"2025-10-21T12:31:20.616792Z","last_seen":"2025-10-21T12:31:43.508995Z","times_seen":2,"resource_available":false,"data":null}},"time_used":524,"timings":{"blocked":239,"dns":0,"connect":0,"send":0,"wait":285,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/5d633daad2a0e103f0cab251cf4a6d93.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.605Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Sep 2025 14:31:39 GMT","end":"Sat, 20 Dec 2025 15:31:26 GMT"},"fingerprint":{"sha1":"17:3D:A0:9F:DE:47:81:66:EA:33:3D:E8:54:E5:E5:AC:9E:D3:7C:A0","sha256":"22:D9:7A:16:0F:64:68:7D:00:46:B8:BF:15:6C:E8:BE:57:96:C2:BA:12:A5:4B:90:48:16:F4:58:C4:DA:9D:36"}}},"request":{"raw":"GET /202/1/5d633daad2a0e103f0cab251cf4a6d93.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 1673\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"16c8f085f45fb406cf1808e19c96b5ac\"\r\nlast-modified: Mon, 14 Jul 2025 04:30:27 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, accept-encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 18707459B9311B4A\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: max-age=2678400\r\ncf-cache-status: REVALIDATED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U%2FgvZQzVr2ci7y1w21ntPGjl4ZAROc96fGzTo7MP2hCqGJZoE%2FSkThr0oC6U2wBIqZDtDuYrzWEiyLZa7aOQnenpO2AoNVy5AIcJ2imln2sf\"}]}\r\ncf-ray: 9920c3b1fe375fac-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1673,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 4-bit colormap, non-interlaced","md5":"16c8f085f45fb406cf1808e19c96b5ac","sha1":"b577bf61f667332d8b0945583eca5c4e7b434180","sha256":"e15a20b657b4eaad216421cfbb89e1e73889592a96aaa18ed41cb7dc3bd5f6d2","sha512":"1421cfada4c9167907db19372301d16a320c162f96a679b84f1fae45a72817a0ad8fd1edc4037eecb2ef8b8e76dd4c208ebd3ec5c8ae9b65a744fecb9c4c7e2c","ssdeep":"","tlshash":"463118f748879e131e748f9c5c064988c50109d8e746fcfd81bb42722d28d1afa88bc9","first_seen":"2025-09-01T05:05:19.814295Z","last_seen":"2025-10-21T12:48:58.411151Z","times_seen":81,"resource_available":false,"data":null}},"time_used":947,"timings":{"blocked":-1,"dns":18,"connect":10,"send":0,"wait":815,"receive":0,"ssl":94},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/api/sport/match/list?sportId=1\u0026client=web","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:12.372Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nx-request-source: https://u65r.xyz\r\nXign: h/Oi2g+G9cNKBnIVmws8AgRjK/Dz2UmeeAqTdu78oI64gBLJafcqdMcCT0kGPWwiczLFHt55QvVtKa44SIPSfn78OHWfGQUcykyYKstd6l0qrJf8IP86QBf8o/IvSgR3K97ctKgobWgHtzD9TF74jr1GdMlDEyUnvIDdHPYoCs8=\r\ntimestamp: 1761049812365\r\nsign: 6m2g646d5n4bso7v\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: htmZ44nXYhd2SnrNty4ztc2apf5FpAim\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:12 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049812=rdeenGOu7oPbUjAiCKj7mQM/L2CZSERSb8B0wFuL8iAz8yGt/SZrwN9hzq//Jfkm2RgBtTQd0nDutTI6d6QWpAWOCgfp5dAbbfEI67TXctUIUufT2Gr4Y/EGVzH3Ds++pR5m1dg201x3t0V1APCXAY3Xdycq4n4xNiX+U+u5NzhLl7ERx+6lMbVyMrOoYSkT\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 6DC6A597-86F6-42EE-9B52-1C70A99BBCBC\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15550,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"afce39d49a219939611179f37969008e","sha1":"2993f2f6c9c77406e6a56ac94c1617dd5352bfc7","sha256":"69110a9fb38b57a1e260ba8657973cafcc029970fe5727e4d461ba753df86443","sha512":"16c30322285cd9a93b5360b7d3ca2d3d23e757f37c1c126c3ea79bcbedd087abd3d0822b5d882dd83d5d7eabc7d5277abf29be60dcbc9a9eceeb87a0e168ca05","ssdeep":"384:ehyeu9d/BwJ2Gfh8PQEM0ZX4o6G1xxGOZ5gIenUX4bZnSik8qi5gsA2zqxDFP0dk:ehyeu9d/BwJ2GJ8jMSX4o6G1xxGo5gIJ","tlshash":"76621316c3ec68aa2b4d52d5290d374cdc3e6a1b0e9ef5d5ed0adf1c20e83f39209965","first_seen":"2025-10-21T12:31:20.616792Z","last_seen":"2025-10-21T12:31:43.508995Z","times_seen":2,"resource_available":false,"data":null}},"time_used":280,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":278,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/ecb/8f8306425fb46e096ba9db3ab31b67b681fbb31575ff397b0117","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.302Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /ecb/8f8306425fb46e096ba9db3ab31b67b681fbb31575ff397b0117 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://u65r.xyz\r\nXign: bNojXLAbnx8/GxPO4QlOXXI/5FeXbyP1ShBjRK1oUET5A5DMbL/b/jHZ8XIN3BpehdCWqBZyG8cfHRPCKF+wHGoAEH1Rx6x6WeLeDn1rdAteJQK3vFMy5eJSdC5aviNTiPI0PrnFVAfqw7VxaVQsWbLOdtho0HNNipQjyteNifo=\r\ntimestamp: 1761049806283\r\nsign: j296r6b6e4m74j4d\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: htmZ44nXYhd2SnrNty4ztc2apf5FpAim\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Tue, 21 Oct 2025 12:40:06 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 83E5A60A-FDD0-4BF7-BC22-71C9F3FB134F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1937,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"09876f699b1ad94e1c95dc686f52a777","sha1":"1ce447ca2a3b2e37c9ef23b9db361e49a9bf86e4","sha256":"0a3965b08115af1080c0380e079461091fd110e1b07fa89506786666cbb798c6","sha512":"f5b533b4045a9603199fb4823be26069bded75eedd11eb61bfbe5bfb309e0917f6523aa49ce59e9366cf34c668e403d99021263c7df7843cea992d27eac90855","ssdeep":"","tlshash":"f2513a42056497c8f4dafaea041b29e18f32a00df7652f14cd14c317cf69e10165f16c","first_seen":"2025-10-21T12:31:20.619929Z","last_seen":"2025-10-21T19:10:12.989471Z","times_seen":2,"resource_available":false,"data":null}},"time_used":449,"timings":{"blocked":223,"dns":0,"connect":0,"send":0,"wait":225,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/102515b44caf9d14e4f7c95e53346496b4f6e?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.503Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/102515b44caf9d14e4f7c95e53346496b4f6e?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 57959\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"102515b44caf9d14e4f7c95e53346496b4f6e\"; filename*=utf-8''102515b44caf9d14e4f7c95e53346496b4f6e\r\ncontent-md5: Ffcw9IHRrnx1wdKO4oYq3A==\r\ncontent-transfer-encoding: binary\r\netag: \"FkKPbj1u-_-EXHjVqRFr0PZkq4mz\"\r\nlast-modified: Wed, 06 Jul 2022 12:52:39 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-23;QNM:yzh157;SRCPROXY:yzh152;SRC_***:49;SRCPROXY:49;QNM3:60;QNM3:92\r\nx-m-reqid: EYhiKKYxJ\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: l1oAAAC7f8otSHAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":57959,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"15f730f481d1ae7c75c1d28ee2862adc","sha1":"428f6e3d6efbff845c78d5a9116bd0f664ab89b3","sha256":"7121f34e14c8f3c9c43f33b1cad7bb1ad04265d083fca4a89e8d8128430e1713","sha512":"91da916aaba0814c503d09c8649b0e1d10b70660df7c67d4b7d20c08dfea0212a03f191fa735a4c97dc0a1ec0e6f293af96141084fc614ce3e06e0535e2ff9b1","ssdeep":"1536:S93iikfq4Rhiw19QekEBP8XU0BG0cAdkl19U6RzYyHJ91x5RJdt2:S95k1Mw19nBP6U0BbGFUabVB2","tlshash":"a84302d97b41f90cddd20761746c9cf62fcc1c02b2d4216669683e18c68a3ba9bfc1e6","first_seen":"2023-05-27T18:34:14Z","last_seen":"2026-05-24T17:56:38.701671Z","times_seen":322,"resource_available":false,"data":null}},"time_used":2717,"timings":{"blocked":1039,"dns":0,"connect":0,"send":0,"wait":836,"receive":842,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size704x442_7f760e34-ebbd-4cfc-bc28-666cc8a6234f.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.762Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size704x442_7f760e34-ebbd-4cfc-bc28-666cc8a6234f.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 242762\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5UyVY%2FliiBJ0Z%2FUCnmVvZ5BblDYlLP7T%2FohxQlU2dnWUUtKyQiaMpv7sKBfnWd7ukgG9mIVJMFb5j3UwOw%2F38fmgHgmuV9nFgMlFe9mT8E7E60BCrNYT%2BG7nsuWs\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"8d6414b9a03ebecda6026e71db5c722b\"\r\nLast-Modified: Thu, 18 Sep 2025 11:12:00 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189684\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacd6989285f8-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049811=yfEHl6AolJP0QC5NkMkOAeL2cxw2cvQEQ0CJoyH0PwylhAu+93HbTVa2aaGzmwCJZPRlEiCkJ/Lezou0DkT7iNjC2gSEaRk5/ITYUs6HFP6vgf9C2kZ+8cKO8dprXM2S7lcJEzc2ZecPldSfp0XqpOhoW/bsw+EQEoKlKZs4TyR039jUu6QbtWk2lIQvTHt+\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 3FFE00C2-3693-4BAE-940A-80ED27BEF6E4\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":242762,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 704 x 442, 8-bit/color RGBA, non-interlaced","md5":"8d6414b9a03ebecda6026e71db5c722b","sha1":"3afa8517807eaa556541da8bfa2a85cd64543e25","sha256":"f8c741596d8b7a6849030ab73cf98cca0b3aa37fc8696845b2ac8e31d52ffb21","sha512":"0375d4b767373b491dc0030a0ce6390e2a772c58bbfb55d54d75e6efb45287b5929b2bdbbae6a5f2eb889136f09ba6cb5441eb9e340d3cf811b90ede739fb84f","ssdeep":"6144:EDtODfBnbPbUu8ZWsJnBVoLx/hO8RakAdAZDdO0:EhOLBnbR89JnBiyLd0O0","tlshash":"1b3412bd2c1f1b8375ff5dd94ec555ebbb2431abc8a94280a556892e70701e3b837283","first_seen":"2025-08-29T11:05:53.168348Z","last_seen":"2025-12-29T13:58:58.073143Z","times_seen":290,"resource_available":false,"data":null}},"time_used":5064,"timings":{"blocked":3874,"dns":0,"connect":0,"send":0,"wait":220,"receive":970,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/away-bg.00d4ba2a.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.639Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/away-bg.00d4ba2a.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://u65r.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 3883\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-f2b\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049808=sBeSKsiafNlkKsLs4C/dAiFvvIebGS1CCiZrVBTiq6N2BrMHJO/A06D5FyfgjgTxmm65szHCxvbeWCjEoLhX52ZT+6aWyh2Ly2dWJuSrJO8MDlgQ2vONi+MIwEavNqtGmMx1nEqf7c6BCaib745OKSMBePL4GHCI7LEl0G2xpUJD22vca5uX8ey/KW8PlWax\r\nAge: 117973\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 4A8F4B01-6778-47E1-B21E-FB3EACB6F37F\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3883,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 277 x 80, 8-bit colormap, non-interlaced","md5":"ce3e5a71ef5dcf15c030882243e12315","sha1":"d4fdd1329ecac30941a67bd5108bad525c791c12","sha256":"3c2aad01ce2fce6463d6ed3bde348515922dd019d8a670b07b53d66b39c68d3d","sha512":"f6a55d8c079529988760a1c22541c097af159a3653f5ffe89c5c31ee20371f2c879c64797319f4176be77c821294f0f72d83ad77f2a0141203c857c8f987966c","ssdeep":"","tlshash":"6f815cf693e66bd0d5675106a3a14c89624d69d925a325530923f45ec3bb1ac02fe381","first_seen":"2025-08-29T11:05:53.10673Z","last_seen":"2026-08-10T17:58:48.509666Z","times_seen":2337,"resource_available":false,"data":null}},"time_used":539,"timings":{"blocked":332,"dns":0,"connect":0,"send":0,"wait":206,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_b82399e1-d771-428f-9811-f7e15cda0f21.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.685Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_b82399e1-d771-428f-9811-f7e15cda0f21.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 629518\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xG0uZ8zC3hZQVkj5hnwFk2IvsPDou28liZ8HWHmYsLDTbfEgylcxaJOvzRTP%2Fr6uBnEgfAxvLhzSy6ppr4DL4Bh3evsLugF5zoGQV%2FgVHjs1CU3Y%2B5il5dqYUA%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"aa55c486b79391c1941b56cb91877917\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:46 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189683\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacd0ebd01f2b-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: FD10F353-156D-424C-A242-BC596FF9B3F7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":629518,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"aa55c486b79391c1941b56cb91877917","sha1":"1631920c0376407ec024a2d73ecd232133eacd6e","sha256":"90492990a14abfb00e0f80a0dc410438868da9f50a1fa1375c5b8a0d22fe4579","sha512":"c35b5cbe89015905fa5ebcd3e57ecb40caa4bb411df88e24750604cda84f81e9772af3d0d5a46d06bc94c08b5eb561a951c5ddf2334a6e5e280f88a71d6cf91b","ssdeep":"12288:qJvko6vExt9aRTprkNOfDDUgXbZk9oGKbPCiAV9w/qvNU:q2b69gZC84oBIbwqU","tlshash":"4fd433a4ea76d7e1fb432618031c6b1a13a0537a27d0e291c28fcf7c9a41db65379352","first_seen":"2025-08-29T11:05:53.132796Z","last_seen":"2025-12-29T13:58:58.080419Z","times_seen":278,"resource_available":false,"data":null}},"time_used":2049,"timings":{"blocked":1278,"dns":0,"connect":0,"send":0,"wait":245,"receive":526,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.u52j.xyz/","fqdn":"www.u52j.xyz","domain":"u52j.xyz","tld":"xyz"},"ip":{"addr":"110.42.43.240","port":80,"asn":136188,"as":"NINGBO, ZHEJIANG Province, P.R.China.","country":"China","country_code":"CN"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-21T12:29:56.375Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: www.u52j.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.0 200 OK\r\nConnection: close\r\nCache-Control: max-age=259200\r\nContent-Type: text/html;charset=utf-8\r\nContent-Length: 427\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":427,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (427), with no line terminators","md5":"224190670a75430d7d5c9025464f15a4","sha1":"b4d212e3270c2a427d2ef83b8e015bcf6a64d1e8","sha256":"ededf9ad6a0ef9b6643f3abbda005a448c4487992fa06c0ef178828f137a86ab","sha512":"92445a701c6a7c9514d56066729bbf21a08cb717a5e075861b0c7b6e973da1a884d4976bef989a5eb6217ef66b2907d32638c635795699b8af320541c17745f1","ssdeep":"","tlshash":"34e0ecf7285185746af93287ea63bb552c1261c73f41b40140445c62a51cf8aca39e99","first_seen":"2025-05-07T23:01:39.784623Z","last_seen":"2026-03-07T17:37:03.949301Z","times_seen":2334,"resource_available":false,"data":null}},"time_used":769,"timings":{"blocked":255,"dns":1,"connect":257,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"www.u52j.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"www.u52j.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/undefined","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.945Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /undefined HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: public, s-maxage=600, max-age=0\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: 5DCBCCDE-55E2-4F5B-861C-9BB480A371E6\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23624,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5777)","md5":"87588e90bb24e209460bdbf1bcbcc074","sha1":"f3c57be16a0eaf6879f3469c6a2db7720a699832","sha256":"61ed38427305a473065294efb15ef101340cf9d3e19be35a6c6c86083698c328","sha512":"160c240e67f56096c7c519eeb5b11bd9fcac971ffbdaecd231be6aaba4f98a1dbf5f44a22c0edfbe64860e3039a11eba5be0eb13802c82e7033543d7891a8e51","ssdeep":"384:kR7B3v2VwiYwJvSoVXsp+pa/iZcVk97g6nMusplliz:kRdviNYiKop/E6wkpcu2lUz","tlshash":"9eb2292e8df349762523703a2bbfb208797180134309ed803e4de7584fd59aa46e7bd6","first_seen":"2025-09-04T00:49:32.720758Z","last_seen":"2025-12-29T13:58:58.052747Z","times_seen":445,"resource_available":false,"data":null}},"time_used":368,"timings":{"blocked":85,"dns":0,"connect":0,"send":0,"wait":282,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/kc523-1/sponsor/sponsor_nav_web_3.png?1756903280095","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.965Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_3.png?1756903280095 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 7412\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1cf4\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049808=sBeSKsiafNlkKsLs4C/dAiFvvIebGS1CCiZrVBTiq6N2BrMHJO/A06D5FyfgjgTxmm65szHCxvbeWCjEoLhX52ZT+6aWyh2Ly2dWJuSrJO8MDlgQ2vONi+MIwEavNqtGmMx1nEqf7c6BCaib745OKSMBePL4GHCI7LEl0G2xpUJD22vca5uX8ey/KW8PlWax\r\nAge: 101405\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: F3C005ED-1069-4005-9793-63DF9C2EB1C0\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7412,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"eb94a297c215863d5d2232eaa67f4779","sha1":"d006f382f63ada4e4ef65d124a75eac2e4e72dd0","sha256":"6bd46b617bf27cb28fb798d50b2d6daa2aaed1a278ed50e9aa549b6e4fac48c3","sha512":"dc7759393acb5e7d1a635b4d91d73e84abc41fe6afde99a85a8e4ed6f4f8b1b5819bbcaa80b1c213c00c89df8b81db512a7bff142b24c50565ff1e6289f1a30c","ssdeep":"192:Sfq39wgHGYB1fcUWobKUUR6IHaDmzDxfbTow:uQ9gCEUWoWUe6DeJQw","tlshash":"94e1ad76a7f6d695a6b7908cfece94050fbba2722c6352762b7b8c02170c339525b411","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.505323Z","times_seen":2233,"resource_available":false,"data":null}},"time_used":2998,"timings":{"blocked":2730,"dns":0,"connect":0,"send":0,"wait":268,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/kc523-1/noData/cms_moren.png?1756903280095","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.047Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /kc523-1/noData/cms_moren.png?1756903280095 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 19732\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-4d14\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nAge: 101403\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 891BAF7A-0A4C-4A3B-9170-78CF17E6952F\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19732,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 215 x 214, 8-bit/color RGBA, non-interlaced","md5":"f3c825751a70d4aad8da2ce57f76acf6","sha1":"732da443668abb03a79a70df2d0ea8d801158655","sha256":"c395f4c1941459ef620f6df95fabd39f9ac98e03f6a389886bf224157557ce41","sha512":"a3b3fa2a216c10d331fea4771b916825d0605b94e21ac242d152d7c5e4b984cf3baad7a3fd071dde3432162037514d756cce1a0f699baf3dc98eaf75483c91b0","ssdeep":"384:64pTwcIHFqFpIlD8SqhwFLW/na2PvyQXSOKvOi58KUezsTT5ZOon:67XlROe8WvOAPHQv","tlshash":"a592d0d8abcb6705bb132b43b941a3558e0dfd6a130b9bb131782805ee16151e8d7e3f","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.464564Z","times_seen":2274,"resource_available":false,"data":null}},"time_used":226,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":225,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/10136c7cad5f6cb3a4114ab6bee3da23c79ce?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.518Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/10136c7cad5f6cb3a4114ab6bee3da23c79ce?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 96611\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"10136c7cad5f6cb3a4114ab6bee3da23c79ce\"; filename*=utf-8''10136c7cad5f6cb3a4114ab6bee3da23c79ce\r\ncontent-md5: Xb4yCFXjunctvOVPlAxvpQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FkxVClyyFmvuIyxXL3ATOcm--Uz6\"\r\nlast-modified: Wed, 06 Jul 2022 12:49:22 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-25;QNM:yzh168;SRCPROXY:yzh171;SRC_***:44;SRCPROXY:45;QNM3:74;QNM3:101\r\nx-m-reqid: Rxkr5HEgz\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: jzAAAADrN9MtSHAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96611,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"5dbe320855e3ba772dbce54f940c6fa5","sha1":"4c550a5cb2166bee232c572f701339c9bef94cfa","sha256":"4d54dfdaf41ae36f3eab417bc2a6032abd81e6462e7058cbdbacda9554ff9a11","sha512":"c13c63d288f58fb5280a6f6f176ff936378b55789698412a37a243efc361a45d7f1073afc2fae6769f3be3b31a4810493152071a54eef49006369e7d956b59b2","ssdeep":"1536:iRHNNDu0oVeTTLcpOkYuC0ljr8bfoXGfli/KxJ3Yo6AcAB1GftrQYi3Xu97jT3qY:iRvDfoYTnLkDC0lfdXGflIKxJ76A1Gf/","tlshash":"fd93025002754f6f048d729bb82ed09d9c427598d1a0bfa478e5b58470e4b8e7afcece","first_seen":"2024-12-26T20:26:09.843276Z","last_seen":"2026-06-05T22:09:33.476463Z","times_seen":307,"resource_available":false,"data":null}},"time_used":2999,"timings":{"blocked":1024,"dns":0,"connect":0,"send":0,"wait":836,"receive":1139,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/8d6b83760d32404ee7d2a19b88ed67ff.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.587Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 21 Sep 2025 14:31:39 GMT","end":"Sat, 20 Dec 2025 15:31:26 GMT"},"fingerprint":{"sha1":"17:3D:A0:9F:DE:47:81:66:EA:33:3D:E8:54:E5:E5:AC:9E:D3:7C:A0","sha256":"22:D9:7A:16:0F:64:68:7D:00:46:B8:BF:15:6C:E8:BE:57:96:C2:BA:12:A5:4B:90:48:16:F4:58:C4:DA:9D:36"}}},"request":{"raw":"GET /202/1/8d6b83760d32404ee7d2a19b88ed67ff.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 2021\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"0c32c84713eb5437c893ba962d5eeed8\"\r\nlast-modified: Tue, 08 Jul 2025 07:30:26 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, accept-encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 18707459B6BAD593\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: max-age=2678400\r\ncf-cache-status: REVALIDATED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IpnV5nZihSOuSeA2mJRxwqQuuEqX3unLVnAl%2F%2FalivHUilsNEBKFiu5%2F3Y4NNDGcC0X6i%2F1SyROPh7if0P6EKX3p6VbKEUJ%2FzNRV2p%2BD0XQE\"}]}\r\ncf-ray: 9920c3b1cdf25fac-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":2021,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit colormap, non-interlaced","md5":"0c32c84713eb5437c893ba962d5eeed8","sha1":"f46799757d7565109dbaee63e14c44d348fc7336","sha256":"0c72de78e19f5eeaa8ff7d256884c6f1f15ee79e1cdf39439244a841b31474cb","sha512":"516aaa01b2ad9950cb12379d92ac448f05bca19182ee471c6ef275d09b48cbcd95fa7eb06fdaf8fda9abd21e9fe5444a41329080e7a66e2c0835f68ebc78c367","ssdeep":"","tlshash":"c7410a1343098df98d3911e7953504b9b87c6d6d280e203892427ee955347d8f4b58ed","first_seen":"2025-09-11T04:13:01.796091Z","last_seen":"2025-10-21T12:48:58.437768Z","times_seen":21,"resource_available":false,"data":null}},"time_used":965,"timings":{"blocked":-1,"dns":40,"connect":1,"send":0,"wait":837,"receive":1,"ssl":73},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/bj1.17ef2db8.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.966Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/bj1.17ef2db8.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://u65r.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 58859\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-e5eb\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nAge: 117974\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: E86547BE-7B98-4B6C-9A91-B81A1AD0B04D\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58859,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 1299, 1-bit colormap, non-interlaced","md5":"59f1176bd542d042d8ddecbe4ab2cbdf","sha1":"7251e6f8bc0bf8bf3e62e892b34540f8259dcf9d","sha256":"b3bc2f14721d5f84900af66179eb6ad69a9c8d5a89eae36f877cf09fc9872603","sha512":"c4e7f1491686b72482ba26e34fd94496fc71bec2a35ba1d7cf67391e1f47f859465ad9f0c7d286bd35f9a26132fd80012a2cd2f8133cf1c6013db4f4d27a85d7","ssdeep":"1536:jlJ0Z4kwI3cG0YXIPf/OWcFOtk2bnIlfyMcw68vTbD8:gxbsGvYXd8OtTbIsgTbD8","tlshash":"004302d3b5e9f610dd38c157a3d1c9da504483be3e938d0bebbe402629fd56840a6f16","first_seen":"2023-08-17T12:39:32Z","last_seen":"2026-08-10T17:58:48.525616Z","times_seen":2676,"resource_available":false,"data":null}},"time_used":559,"timings":{"blocked":295,"dns":0,"connect":0,"send":0,"wait":260,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/SPORT.aab253e7.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.927Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/SPORT.aab253e7.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 55380\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-d854\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 101397\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: D09F4773-EBA4-4AF2-9144-94581F78CDDC\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55380,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"3990a0dcf110f100c97ab413079e969e","sha1":"8087b72a149b71f4f5fc43b0f8bc07b89b621583","sha256":"6ddc189e7780b1313933d4903be9fbf6644b6a590e9aba83a6e4e50fdafb170e","sha512":"6b092584d42ec1423ecb94383907f29571e93308944813286d6e74b10f6eccb27536924220780f9a080dc259a095718a33f0757fc0adb04d737c83a6fa1647e5","ssdeep":"768:aEivx5zbZ4L0zze87wWbuKu4YIsZdCPX4ueh17yEs7NsGJSLsBQ1MDAaYHKJTbYC:aEi3eL0za8xbw4UmXI1VfJIRDYqz6W","tlshash":"bc43022944944c242384f1a6ac778dbc6dffa348a5f38f639a842bec7dcd84d95f4811","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.444325Z","times_seen":2398,"resource_available":false,"data":null}},"time_used":768,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":259,"receive":509,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/ESPORT.4f4b51d4.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.931Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/ESPORT.4f4b51d4.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 65968\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-101b0\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 101397\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 34E0EC80-EE0F-4DEE-901B-14A4AFABB538\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65968,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"29610094acb703084f79c42c17547a7c","sha1":"3c824ba387e36bcce1a5f1d0d14b513fb278db9d","sha256":"8c3dc9ee49224eff4a37ec488ff0a413f3150ec7a62640a466a802750a573146","sha512":"db986acc62bb0d35583a1c298b468e1fa7869269c738eadc82b944b1a8f9b2c0723087db8a065d60495938e834337e72e3c438089d1d02ff90f4983e0d6461fb","ssdeep":"1536:ObUUUNbT8bJcHe4DyC8KLT/KKeRfm4AH7XAlzS7M2Z:rbgNcHwE/eshbE/2Z","tlshash":"b25302e1df60cb022efe65ca89acf12ae204a0a61476453f7a231d6f3744016af973c4","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.445069Z","times_seen":2364,"resource_available":false,"data":null}},"time_used":1161,"timings":{"blocked":908,"dns":0,"connect":0,"send":0,"wait":249,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/10181abdc3c2fd25d4892963fda9005dbbffb?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.547Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/10181abdc3c2fd25d4892963fda9005dbbffb?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 88074\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1395003\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"10181abdc3c2fd25d4892963fda9005dbbffb\"; filename*=utf-8''10181abdc3c2fd25d4892963fda9005dbbffb\r\ncontent-md5: xKZSii7hR7mcmIXvJDhaTg==\r\ncontent-transfer-encoding: binary\r\netag: \"Futc7GbUHdaLTk9DXTcr1ES4e9m1\"\r\nlast-modified: Wed, 06 Jul 2022 12:50:31 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-10;QNM3\r\nx-m-reqid: lx7ThOPIu\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: hqcAAABupmhuU2sY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":88074,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"c4a6528a2ee147b99c9885ef24385a4e","sha1":"eb5cec66d41dd68b4e4f435d372bd444b87bd9b5","sha256":"e8111ed917172505f3c61bec2cefc0920e02c557cbfb587ab694545d3ede1e3a","sha512":"017f52153011e1e68c1fa47bc017f54789a78cedcd922d7376d98bb59081559b3541adbe5cad192796d8bbc74bc881e6e915b640e5486731fd0d2663cbb5df39","ssdeep":"1536:WmlDudvPFEbf8thcMRpOXFCPBs89hKkowwYRmRmsjP4UL92ILB77tVC:Wmlsv9Ebf8thcM/OXUBs89kk9wNRB9L8","tlshash":"8b831264ecd8f2857dbf9c471ab0d722e05231d34f2372449b789443fe2aa0a1ad67c5","first_seen":"2024-12-26T20:26:09.835412Z","last_seen":"2026-06-05T22:09:33.511645Z","times_seen":544,"resource_available":false,"data":null}},"time_used":3501,"timings":{"blocked":995,"dns":0,"connect":0,"send":0,"wait":837,"receive":1669,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/assets/logo/favicon.ico","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.707Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /assets/logo/favicon.ico HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:05 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 58278\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-e3a6\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1761049805=po6D+l8dMhfLGKAdfLLnVeIRbjpxlkQDEuGKbtlEOTQWkshI6okgIymixUARr4wGybpILVpsVTfVc7k0JaAkDpC9mG+fNrxEIVp7sH1o9IEd57siolGhKy+cprba9qHT4pkoamaJpfQkaW28kwG1+DFqQQxzksZj++jdxZwG6L+cO51eyJYwemgSWglzoiWi\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: E22FCE22-E8CF-4A08-88D9-E105F9612D59\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58278,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"7fb9203f2701deec1371d2fd0ddd079a","sha1":"a7d4ea5f1c3d103aaa3c078bf540b56404aec0e1","sha256":"2a342dd0f9977afb12227889cf13ff008d4cf1e9a4ca07fb4131d14af05978d0","sha512":"964cf7794a7b72bb9515927efe748563b6d46fe122b35baa4c7f57fafb09ea759e5e759a3000d385872218cdd08383a58a2b66feb9a712e6f3e9a06cc87e43b5","ssdeep":"1536:e7V6OVB39Hdm34GeF4KERayBlZ3WgaOlblY4+:e7V6OV7034GeFERd3WgaOlbGN","tlshash":"af43f10a258e86c73047c3921b2dc09b70d12c776b8daef9e6bc4a5816d54731bbd1ae","first_seen":"2025-08-29T11:05:53.165834Z","last_seen":"2026-03-18T12:35:38.966648Z","times_seen":1201,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":214,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/17600.1756903329400.89772027.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.747Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/17600.1756903329400.89772027.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:05 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-2526b\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049805=po6D+l8dMhfLGKAdfLLnVeIRbjpxlkQDEuGKbtlEOTQWkshI6okgIymixUARr4wGybpILVpsVTfVc7k0JaAkDpC9mG+fNrxEIVp7sH1o9IEd57siolGhKy+cprba9qHT4pkoamaJpfQkaW28kwG1+DFqQQxzksZj++jdxZwG6L+cO51eyJYwemgSWglzoiWi\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 4EDAC2E5-3450-4661-BAE3-E15710D1EAFB\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":152171,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (33789)","md5":"537a1190cc025f0707bbb2a736630283","sha1":"1ac2e221c5e4e26737c6e1b7fddf2d363e4b65c3","sha256":"296f9d35557dc9588e8c6bed7134ca0e3055473306531756660582a6886bfedb","sha512":"3202114c8afb764ea0c4cd32bd78e7ad51295face85601b71b7316535d8fc29ecfb314bc1ace4ff0f54ef46a2016d09e764078ea1d7bd08ae75077ad6eab2341","ssdeep":"1536:+D5AxGst7xILpT0iiRs1vE/yKLJdLI065veGiHjLFIEfma5/xY8SbF9JiNp/QQbU:+DqxNfns1v4yKMpBesDz7+I1ou","tlshash":"d8e32a94b380717887a743b5b21f5196d22a08601098bca4f26eed94bf749ddf63ecdc","first_seen":"2025-09-04T00:49:32.979776Z","last_seen":"2025-12-29T13:58:58.065817Z","times_seen":421,"resource_available":true,"data":null}},"time_used":311,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":303,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/kc523-1/sponsor/sponsor_nav_web_1.png?1756903280095","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.959Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_1.png?1756903280095 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 7821\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1e8d\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049808=sBeSKsiafNlkKsLs4C/dAiFvvIebGS1CCiZrVBTiq6N2BrMHJO/A06D5FyfgjgTxmm65szHCxvbeWCjEoLhX52ZT+6aWyh2Ly2dWJuSrJO8MDlgQ2vONi+MIwEavNqtGmMx1nEqf7c6BCaib745OKSMBePL4GHCI7LEl0G2xpUJD22vca5uX8ey/KW8PlWax\r\nAge: 101405\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: EB406F1B-5B28-4EB2-BAFD-16C0212835ED\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7821,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"0eb441aa3c30cc3c92da984283938f90","sha1":"74a769808afa9b87ea483a82d47958bf05ab9b87","sha256":"146f45de163728bb850c9a8e6c1693dd4c82caf7b6e1f58728395003b84f286c","sha512":"d1c9c8824c4f42f71db8ce2b62955647aa55bb590305765cd931000d0fc6023f7d57cd3daf6992094365ca6ecb42f02f93d606d79f6643a2f89d52f71200461e","ssdeep":"192:AnUYZGCj89cpWsWKE+hAqF7k4Pk7KJw7OjF57HUNuvs7alaUd:AFEijWKE+hHF7kt7857HU/eRd","tlshash":"20f19f3eececd52cd1a745f68caf47a6142c5031ee9d7929b82fdc728649a409d403c5","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.351444Z","times_seen":2244,"resource_available":false,"data":null}},"time_used":2905,"timings":{"blocked":2684,"dns":0,"connect":0,"send":0,"wait":220,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/bj.ada43481.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.981Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/bj.ada43481.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://u65r.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 439504\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-6b4d0\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 101405\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 95228038-D058-44CA-A0D5-F5B60EB53E36\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":439504,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 927, 8-bit colormap, non-interlaced","md5":"2c55f8fcc8edb773be5014d8deb72c4e","sha1":"e7e55505bf22de833ec6b82a229e70bdba93b58f","sha256":"21c44535cffd825752bf9a535001b4b605147e3434cf2906fc2c8fcdcd992c1a","sha512":"bab93e8eb191df623bd7e238ae8d5cf7feae73e2a768d7b591d4dd8b7aafc199fce7c34066a272fc9137959a78a6bcd9fb388f39d4a0938f5674aaee815a3cf7","ssdeep":"12288:K+TyFzCVXhEu0hvb3kkjOO9FNkh4k6yvwUKA4AuJiT9h+:tTyFGjENkkyOWh87UK/JiT9h+","tlshash":"739423b1df0b89c858a39043dc74f99263e8d0a6bdc40ab80bf14b9176709dbbbf5116","first_seen":"2023-08-17T12:39:32Z","last_seen":"2026-08-10T17:58:48.277543Z","times_seen":2508,"resource_available":false,"data":null}},"time_used":1683,"timings":{"blocked":1260,"dns":0,"connect":0,"send":0,"wait":200,"receive":223,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/weihu.49a14962.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.920Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/weihu.49a14962.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://u65r.xyz/css/index-399e2569.1756903329400.f2d3fd45.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 2126\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-84e\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 101401\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 1336A7FE-FC22-4D0F-966B-D3B63A2D5375\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2126,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 165 x 137, 8-bit colormap, non-interlaced","md5":"f45e601eacd1a51add606050d2d843da","sha1":"b1a0568cad7dbd35bf562468a33a6609f2dfa11e","sha256":"4fbc5c06299c9916a03562acb78b4dcc5eb94d833516b17b1f0542ab0fb3de95","sha512":"516c3bdaa6616051458bcebfc6173abf020fa37c38e675e96715e55894ff4ebc72983024da196a7612bab4f4eb1df9742e05ce213d44c6a6a30fcf7c0749f4b6","ssdeep":"","tlshash":"7e411c037c240d349bee7d7208d55173d9e1580c69b9b760396fa4b87c2130fa955023","first_seen":"2025-09-01T05:05:19.834317Z","last_seen":"2026-08-10T01:13:04.271654Z","times_seen":535,"resource_available":false,"data":null}},"time_used":259,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":259,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/687494666756c09dc426ebfcb5969202b2682?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.486Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/687494666756c09dc426ebfcb5969202b2682?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 58641\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1806288\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"687494666756c09dc426ebfcb5969202b2682\"; filename*=utf-8''687494666756c09dc426ebfcb5969202b2682\r\ncontent-md5: w746CdBIRU5UAoUIpE8BLw==\r\ncontent-transfer-encoding: binary\r\netag: \"Fjwg5rvr1ylTsY-vAGUWohFK3-YD\"\r\nlast-modified: Sun, 06 Aug 2023 02:18:01 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-19;QNM3:7\r\nx-m-reqid: eAPAWeB6K\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: SLoAAABO6ZP91WkY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58641,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 225 x 225, 8-bit/color RGBA, non-interlaced","md5":"c3be3a09d048454e54028508a44f012f","sha1":"3c20e6bbebd72953b18faf006516a2114adfe603","sha256":"2b20c0f77cb5fb623655e9803f259b79b617c49954139bfd3a949591c9457740","sha512":"b36edb3123d63344ce85dda8f5986221937aefb4af6aa23e8369e4a50b60e5a70363b7cb05cef9b691417feefeb3bfd8feea9dba4340232f2a074ca23978d616","ssdeep":"768:3AxHoEVIW2VOiLaoRgZ0xuqkKifBhUZdnxV3GSQ67KFxSJ2PlkfJdSTcGTtB2Kj8:WHZ03nR5uqkVfUZJxV3GSQp3+eoo7Y","tlshash":"254302257c5b5c06cb1c4bae1a56f311a9f3b909c05c2c9edd30bd8a2771ef18b6ae14","first_seen":"2024-08-19T15:01:26.016964Z","last_seen":"2026-08-06T06:25:53.249649Z","times_seen":174,"resource_available":false,"data":null}},"time_used":2726,"timings":{"blocked":1055,"dns":0,"connect":0,"send":0,"wait":836,"receive":835,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202505/_raw_size656x844_f676ec47-4b6f-4d37-b476-fd69f2381a1a.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.691Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202505/_raw_size656x844_f676ec47-4b6f-4d37-b476-fd69f2381a1a.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 268659\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=R94bii4%2BN%2B2CZxIRpi%2FLt36cD9r6d4wmJOxBSHKFlifD%2BAKBHA97jCLk00O1s3AkjGbCHTAIoATPtfXbFXDqg%2B5AAk%2Fu1arzYcFCb9%2FlihQf1CvNOErDnnpSzzWg\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"f59451347b49ac6da9ca8dbbd242a85a\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:38 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189684\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacc93d71079e-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 612812A4-4CBA-4920-9B1C-E3AB449DDB01\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":268659,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 656 x 844, 8-bit/color RGBA, non-interlaced","md5":"f59451347b49ac6da9ca8dbbd242a85a","sha1":"1f739642381465a5c70a39f62be8dd9c8301a5ee","sha256":"04baef1ce689cbbeb934452a4fc47d78fc8c76abfad8794d9dd46210b607dea3","sha512":"22a9b48743e148281698602b6698551b4e00f8682fb8284977b622c00d00881d68f9677171d88cf72d67cf4a58865c0da893a4c72f0b38dfcc2841fb990a7000","ssdeep":"6144:sdhh8kdFouFNkfPmAz4/jGkhyyIgc34SMW:KD8sSuFNk2Az4bGkh3c34vW","tlshash":"fc4423a923587745d7c322bcd0d86d32b94a74c63ae28fdd109613f602f9d89aa43f47","first_seen":"2025-08-29T11:05:53.115888Z","last_seen":"2025-12-29T08:12:31.313621Z","times_seen":286,"resource_available":false,"data":null}},"time_used":1909,"timings":{"blocked":1402,"dns":0,"connect":0,"send":0,"wait":252,"receive":255,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_fc0e1468-bc71-4d42-9849-b6735b50978a.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.714Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_fc0e1468-bc71-4d42-9849-b6735b50978a.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 115787\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YP0Mf0MvKrOWwzNBJLY%2FavuDMRwGmJj8SVxG5VzAD6Gqzp%2BIrO%2BW9%2FcL1B38YW1X80wjaP2li2Bl%2FmGTDXUALKBGrVCGo8J30nXjcA1y4WcOfS3MlNn9ydbi6m3k\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"abd281a4af5a65d4299fe253a6e4ff61\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:10 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189684\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacc90e37e2e3-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: A836F94C-6594-414D-B0B5-E9AB4EEB9457\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":115787,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"abd281a4af5a65d4299fe253a6e4ff61","sha1":"fe83384c6f30f0d8088265253b05e664caa94b06","sha256":"e24c3350cac84789d5b9b5de7aabfe3203feb5f681d7cb27fbd637743754df57","sha512":"1ca10fd3aa8a6d8e4a2c1a47d701b1c59b7aa433aece4f6652ea0d24ba96c3d4a52078be3f26181283703f4e4f18e63fc9768d292fba09d96b9e8ca3ec5ebfb2","ssdeep":"3072:AaljLBKFeIcCPcF7fAV+e05d565c8T8mcArg5f:AsnBK7PcRAV+e07SRT8O4","tlshash":"abb312b5d477e069d8289f498b430092f5bea1a234ea0c726cc552f3165bdbe1ccca5f","first_seen":"2025-08-29T11:05:53.198537Z","last_seen":"2025-12-29T08:12:31.363529Z","times_seen":297,"resource_available":false,"data":null}},"time_used":2378,"timings":{"blocked":2172,"dns":0,"connect":0,"send":0,"wait":200,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/3ce652c0-55c8-48f5-a72d-a300accd6573.jpg","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.827Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/3ce652c0-55c8-48f5-a72d-a300accd6573.jpg HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:13 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xTTvNXqJvv%2F%2BGQaMULbZKDvVXfT2vdO7ug7ymoP%2BimHec1lBInVJHlyMd4av2KTDDCr7lckw4QLePKwystlAg2w8VxMDrlNRHydnD2Qr1S2j%2B1iVD7IFEj7AZg%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"87d1015ff2e14a1f6f7b2b57571ca887\"\r\nLast-Modified: Tue, 26 Aug 2025 07:00:51 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 24033\r\ncf-cache-status: HIT\r\nCF-RAY: 9920c3d36ce2dd67-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049813=bk7XIS2vvYZfuw49y+/1vuZkvKp7in4I6d98QSIICQpmqjx2IVuOZc7yXGU3JdMBVo2ZcZqwaX6XPz6DiIQKc4Ulu1/yD4pEu+KTNzGgF176OCle/zu5aymvRq1zWKbSX/lGdHLdBgoVlcW/A8dB0ax4ZoF38z6LR83T71zlRznYMLoPa0wr4NTxCfacAq3z\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 3D882013-0B3C-4A99-876E-007603C3ED39\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73462,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 1280x294, components 3","md5":"87d1015ff2e14a1f6f7b2b57571ca887","sha1":"630c6eb19b1145667fe91baf84895decf0d0d345","sha256":"139b3629229801138f790ec1592df247b8ea52b64260f0303c0a1a0931578de4","sha512":"7ac7fc84e76e24ca7fc132734f1a16b3bfd476bb9234a73673d104b28c1ea1637ad53f68958bcfd59a4f6d7358595d66e9f0e569c084fbd5d98ef37a2c539072","ssdeep":"1536:TNU9iSoOFwtZ7MTOwbD5vjre3CDYP9B7/+wbU5yMNg7Rlbpecj:hU9vm77MTOwP57mCDY1cwQslocj","tlshash":"367302ca87e1f2c32e756ce211751dad416066763fbef6262ceaacb187604d54a04327","first_seen":"2025-08-29T11:05:53.280437Z","last_seen":"2025-12-29T13:58:57.995004Z","times_seen":359,"resource_available":false,"data":null}},"time_used":5383,"timings":{"blocked":5000,"dns":0,"connect":0,"send":0,"wait":341,"receive":42,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/21954.1756903329400.57c97863.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.337Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/21954.1756903329400.57c97863.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:05 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-a3f0\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049805=po6D+l8dMhfLGKAdfLLnVeIRbjpxlkQDEuGKbtlEOTQWkshI6okgIymixUARr4wGybpILVpsVTfVc7k0JaAkDpC9mG+fNrxEIVp7sH1o9IEd57siolGhKy+cprba9qHT4pkoamaJpfQkaW28kwG1+DFqQQxzksZj++jdxZwG6L+cO51eyJYwemgSWglzoiWi\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 033CB73C-DC43-4D48-A5CE-00AA130B7DE5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41968,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (41968), with no line terminators","md5":"e2c9f0777c63b333fc66af020ed0ef8e","sha1":"72714b7bdf899cc87c7399253e37aaa2a2f4487e","sha256":"0a2a1939d88947975b56974be20cb84a9c00f3c94cae6e057836b39aaf6b8c41","sha512":"fc02eb76f16f16c8a7346f72e7ac7ef4a68bca53cc7a5bb9f1e00b43f1bb002ca7847e2804be7d6bfe0713c3466210038acc4d5794bea5bec8f0190135f3e7e0","ssdeep":"768:DBPsaSfmzKrMdvf0eMQ/96loumY1PI1yBK9LudEz+yUy51y9y0yk6Dio+ILqpTeY:DP81R6Ipyk6o","tlshash":"0a132088fac2b06dd3eb7330857f505ae66a1dc0668c5438e260d6917e7198dc1fb9f8","first_seen":"2025-09-04T00:49:32.704767Z","last_seen":"2025-12-29T13:58:58.045079Z","times_seen":433,"resource_available":true,"data":null}},"time_used":218,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":217,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/1620136e62e86f7674098b6777128422d0810?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.429Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/1620136e62e86f7674098b6777128422d0810?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 10630\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1620136e62e86f7674098b6777128422d0810\"; filename*=utf-8''1620136e62e86f7674098b6777128422d0810\r\ncontent-md5: 4+tVKOx5ILA5tbXjKeaPcA==\r\ncontent-transfer-encoding: binary\r\netag: \"FqAtZEQ1LqX5nSkzNqntmk85m9XW\"\r\nlast-modified: Wed, 06 Jul 2022 13:03:38 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-25;QNM:cz30;SRCPROXY:cz24;SRC_***:49;SRCPROXY:50;QNM3:51;QNM3:67\r\nx-m-reqid: By1gCe7Ed\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: aXoAAABIP05ePnAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10630,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit colormap, non-interlaced","md5":"e3eb5528ec7920b039b5b5e329e68f70","sha1":"a02d6444352ea5f99d293336a9ed9a4f399bd5d6","sha256":"8fac6e53dfcb6cdfa46cc3251b672e9381018d1911b83d6cd3cd84653b0f8a73","sha512":"8f893a8e8910d34091cfaca4a545fe5d2013792ad2741a165f48b18d28c86d4d1babf65fecda84242460e1cf33aa04c80201bfc82b3d297cbfc98c8e0ee84a38","ssdeep":"192:2U0BhGaf4SVf3wXw1ndo7Vl9alcmh1TuG4ikGiez1kBEuGly:v0HGjKf3wg1dg/aO6xuOHzc","tlshash":"f422e11293f5acb241702e241b2c9641f02642dfd9bb03ac39755cce5a58dfc947bae3","first_seen":"2024-08-19T14:26:05.906075Z","last_seen":"2026-07-28T17:16:08.064166Z","times_seen":101,"resource_available":false,"data":null}},"time_used":2505,"timings":{"blocked":1112,"dns":0,"connect":0,"send":0,"wait":836,"receive":557,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/css/chunk-common.1756903329400.fcaa3bb6.css","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:03.385Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /css/chunk-common.1756903329400.fcaa3bb6.css HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:03 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-340e\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049803=N2Mzwq8fLWQhe5PvbYJKnT1J9Jk9QgjpDkS98sT0zMkxLwtxh6uDYKsuHHgZ92HdOrvsCoOXZCeUHdYDG4WOFi8shXZ1ri+iElYDeZ1akQ3cSi8Vkg1DM7B53M3dJgpaHf6bli/J85KwiwvgYpuXBz3LFDvFlDARwGqtVF2qyuwPxvG8f0dCKPXCjzO5DnCS\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 7FB0E7CC-F51D-43E4-BB45-6F6F42B54B9D\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13326,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (13326), with no line terminators","md5":"826c687e5a03ee71f95d5348db199e55","sha1":"46d95f05e1da96866b57353cd147ecfe9f20f2dc","sha256":"daf2bc8bfaa2d7608bfcd21eb0a6aeda1d3452dc26f2b8577a7c69e599bb8d3e","sha512":"47a2d7bf1b9905ec12876df1008c5b7cd9da2ef5d6f72026fea2ef705e6b63bf2f88941c5b57b112aa663a612327e48e1e85da444a119e7187b615b4089da7df","ssdeep":"192:4dQK/X4cBY4mZGX1lsUTLA7gY3bz/i//LN4hHSQZA2VxM2XwKjv0:M8oTG3bz/i//LihHBrxP0","tlshash":"7852b831d635b53ce57be226f9d09adc6024d417e2730baeea653b3ac5ca4d215332c8","first_seen":"2025-08-29T11:05:53.265444Z","last_seen":"2026-04-27T23:33:28.249766Z","times_seen":1343,"resource_available":false,"data":null}},"time_used":1028,"timings":{"blocked":400,"dns":1,"connect":199,"send":0,"wait":213,"receive":1,"ssl":211},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/47203ff88d9962c5041a48b2f978286674e67?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.368Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/47203ff88d9962c5041a48b2f978286674e67?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 9765\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"47203ff88d9962c5041a48b2f978286674e67\"; filename*=utf-8''47203ff88d9962c5041a48b2f978286674e67\r\ncontent-md5: P4NhBuPgINV7HtgAaFUyxw==\r\ncontent-transfer-encoding: binary\r\netag: \"Flu_UFQegVDH9kIzxz2-X6AIzLjP\"\r\nlast-modified: Wed, 06 Jul 2022 12:57:00 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-29;QNM:yzh154;SRCPROXY:yzh151;SRC_***:41/304;SRCPROXY:41/304;QNM3:42/304;QNM3:75\r\nx-m-reqid: 5PhPLhlr2\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Validate,Hit\r\nx-reqid: CJAAAAB-grnYfHAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9765,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"3f836106e3e020d57b1ed800685532c7","sha1":"5bbf50541e8150c7f64233c73dbe5fa008ccb8cf","sha256":"47186ae2212540eef1c8c6cf3db319d3afda724500d7b96177e006035820df82","sha512":"c8e56241e2fada86e7b21123d279113604cd780b8977178f5e08d9563673f38afc78b9d9c679a76f36c738b6fcaf44dc96d78b47aed861a92e7fde4562c1283c","ssdeep":"192:5Mnj7JHzcIx4S4njeyzTybOo00+dC5aJR0mCdzf3o:5MnjNHdxlATEOo00+SaJR0jzfY","tlshash":"1112bf7317d02cde03abe421515ce634ee10e9571476fa9d51a3a7a085a4fb0e52b24c","first_seen":"2025-02-04T17:13:01.260081Z","last_seen":"2026-02-24T11:40:24.598382Z","times_seen":42,"resource_available":false,"data":null}},"time_used":4517,"timings":{"blocked":1384,"dns":327,"connect":269,"send":0,"wait":631,"receive":1117,"ssl":786},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_2a74177b-d024-4ea3-8b58-fce53f91051b.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.717Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_2a74177b-d024-4ea3-8b58-fce53f91051b.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 483349\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XqBvTcQyoZXpe5h1H2KQU6CqXZ39HDxa6rzHS%2B9J3Y6qQ7bufU4eodKZLWc3bJHU3BxW8TTXGrXO50vM%2Feyem5NHW2KnY713OBKZeS2pSGv1Dlw%2BHwLWF1kD2i5z\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"20cb497720893e4fbb1e23f7820720b8\"\r\nLast-Modified: Mon, 08 Sep 2025 20:42:28 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189693\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac98083ac8c3-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049810=8XOhqPYzNvtuGG/4OcysAi/9c1Ix5YgXavBiBH6qc9bjm9WqeG2yII9Rd1CIWAUKAG0FxykRuvJXzDnxMKqk+rS68KDMASNbTzkdswwt4XDucm6b5py1vQ6G35la3BMmWsZTXXT6A4L15Kx99KWkHMnTvjv0qUeu4ZUmFH0QFz5BQ+0r3VTY4mBrhnaqQbQB\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: BAF6CF6E-8AB7-4C5B-9C11-B9FF48AE1039\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":483349,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"20cb497720893e4fbb1e23f7820720b8","sha1":"c28199286ab1779fe69337d7e544caea3e1bfcf9","sha256":"e53e2e36299deb515827b23a503a4385192ad394c3c1cef219ad0615a941ec87","sha512":"afbc4206f4ddb37ff5cad057c7e0c5c79ac9cb49269f462a864fc177fcb5831f7c5b7facab8d3e82e3462514f2e886524759016e3bbe4265997b5b11b7a090f9","ssdeep":"12288:sZs0q1JCpNZTUEAee80UoTUaaDy8Vcn/QeRXXAiR4KZVTH:sZsV1QpNNUHt8wQjkoOgiLZJH","tlshash":"0ca423a8c90ff46632a7733eae2f1b981d112b44d0ebb75c805fad815d5ff7250a8849","first_seen":"2025-08-29T11:05:53.318971Z","last_seen":"2025-12-29T12:28:25.247491Z","times_seen":286,"resource_available":false,"data":null}},"time_used":3200,"timings":{"blocked":2375,"dns":0,"connect":0,"send":0,"wait":200,"receive":625,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_df036cfa-66a5-49f7-b863-3c22d1a3d180.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.758Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_df036cfa-66a5-49f7-b863-3c22d1a3d180.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 178321\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f3kEflnYZg%2BoGkINUdV9SA2DyeXMjlDey%2BD3aXgh4cYVelvo5GRBES6dFvh%2FoIXMOTh3BvPKKM68AXbnvK2xyvWbCX8A3HUtR%2BM21CwQk1s6oAPoiYrxYEk0HQ%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"0ea328c6532c94300f5a04740a02fe5b\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:19 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189689\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacb86bdeb852-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049811=yfEHl6AolJP0QC5NkMkOAeL2cxw2cvQEQ0CJoyH0PwylhAu+93HbTVa2aaGzmwCJZPRlEiCkJ/Lezou0DkT7iNjC2gSEaRk5/ITYUs6HFP6vgf9C2kZ+8cKO8dprXM2S7lcJEzc2ZecPldSfp0XqpOhoW/bsw+EQEoKlKZs4TyR039jUu6QbtWk2lIQvTHt+\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 70C63CFD-835F-450F-912E-C0D9DC0C3354\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":178321,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"0ea328c6532c94300f5a04740a02fe5b","sha1":"16f14cac5cef78adb3252d74ed3078f0ec546b12","sha256":"3cc57ac046b82d9864901bd1695acf13af777d3a4d39a29ff1aceca181cc9b84","sha512":"9cbe40a96c2598c11bffd5c812f6921c85a2ac1aff362bcd12bdcc345a892cd5a0df6e0d30550a3a1a1856bed1595d71c88966514d42886f76b5bbb6b5aed3d5","ssdeep":"3072:5nMfyun8IhspJcDnsyIKybNZZ8a0hobkT7ICDhSxrQHcAV:FmyDIkJcI18ebeNHL","tlshash":"8f04129aa304dfffdb7d2e331d6a221762530be0cd07c85692f676a1401702495a3afb","first_seen":"2025-08-29T11:05:53.32569Z","last_seen":"2025-12-29T13:58:58.060926Z","times_seen":293,"resource_available":false,"data":null}},"time_used":4027,"timings":{"blocked":3619,"dns":0,"connect":0,"send":0,"wait":200,"receive":208,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size750x590_1103f977-5f3c-414d-8305-ab6884e8769c.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.761Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size750x590_1103f977-5f3c-414d-8305-ab6884e8769c.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 79714\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GV0dH7qeZreMcWfHiSiw4ZyjcRHFeSmn3txcoULnILHyZDM9uaVR0PI2PMXd9OSGm2AL6uylS1xpfG%2FEoCEQamIxfkDz1T%2B9jv9G7ui2lPJFJqFZImIzxZtkQ4wg\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"ef17ab9ddd63b4c656b2b32b64dd5cce\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:30 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189684\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacd3eaf11114-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049811=yfEHl6AolJP0QC5NkMkOAeL2cxw2cvQEQ0CJoyH0PwylhAu+93HbTVa2aaGzmwCJZPRlEiCkJ/Lezou0DkT7iNjC2gSEaRk5/ITYUs6HFP6vgf9C2kZ+8cKO8dprXM2S7lcJEzc2ZecPldSfp0XqpOhoW/bsw+EQEoKlKZs4TyR039jUu6QbtWk2lIQvTHt+\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: C7C853EA-F283-4520-9BDB-813500BB319E\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":79714,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 750 x 590, 8-bit colormap, non-interlaced","md5":"ef17ab9ddd63b4c656b2b32b64dd5cce","sha1":"7ba556d00dfb16b930aad4b1beaf8aa53da162e7","sha256":"420e21a46c35f4347e767d170b68460bc95304b5ec459cabc107e85980c6af0b","sha512":"c9db896e40ab968a297150834286016a08b8ca93b4ebb35e1397f4021fcc2f7b8bad6e5c4e21e3cb916b72a8c31862c0f9e11302d3059b4c02cea4b55c50591a","ssdeep":"1536:IkxOWEsKXHidS1bbSZ5ReqcL870XVwdR1++xXV+dU2GUlj1ksKU:IkgWEsqCdSlbSZ5ReqcLbXCdD++3qDLT","tlshash":"7d73023d6288b7bee034ff7551d1137641b18daa5e41eb0ecf5082652862ffa2c76c49","first_seen":"2025-08-29T11:05:53.078061Z","last_seen":"2025-12-29T13:58:58.056612Z","times_seen":292,"resource_available":false,"data":null}},"time_used":4141,"timings":{"blocked":3870,"dns":0,"connect":0,"send":0,"wait":267,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_c0a34e2a-97fa-40dc-8123-594806696886.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.766Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_c0a34e2a-97fa-40dc-8123-594806696886.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 20219\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ofU%2F47pyCsOf002MYktTUnFr7HmLr%2BhCuKhHDujGHqI7mtkya5OIQyEapra1Kx3JNVugSDJz3Bp7a9jfUpAlWBc0%2BGvxo5Nr%2F4uSu0cg8ua2jBlWAeXvDa4aSwxJ\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"7fc7275341b7ffb7fc3c2e44aa37d83b\"\r\nLast-Modified: Mon, 08 Sep 2025 20:50:55 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189697\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac8c5863044b-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049812=rdeenGOu7oPbUjAiCKj7mQM/L2CZSERSb8B0wFuL8iAz8yGt/SZrwN9hzq//Jfkm2RgBtTQd0nDutTI6d6QWpAWOCgfp5dAbbfEI67TXctUIUufT2Gr4Y/EGVzH3Ds++pR5m1dg201x3t0V1APCXAY3Xdycq4n4xNiX+U+u5NzhLl7ERx+6lMbVyMrOoYSkT\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 8F64D0F0-81A3-41FB-A665-E428D687186A\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20219,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"7fc7275341b7ffb7fc3c2e44aa37d83b","sha1":"065bc30356a5837360c7194171d69da1feeada48","sha256":"58f2ef2554dc2845f5ea9b292b7fbf331543f49b3dcfcfee4353b924d1965663","sha512":"95f1b4c0e5e6060628321d0c6694d443893b1b8aaaf94e3ef05ea703e30003de317586329fcfaaf743d311ff27c2c58baddb7a8242e0de5514a0cf5303980815","ssdeep":"384:cbjBpF/NpKkd89ztdkMcDd2/GiyURwOnogFc5cBmwcbe2osrF:cbjBpFNpbePvcDdYv7ogFCcBm/e2o+","tlshash":"7592df661053129bfccb853eb52e99f0f9f484abd0bc871da6034c561b8e85c1668a9f","first_seen":"2025-08-29T11:05:53.28171Z","last_seen":"2025-12-28T02:09:46.214845Z","times_seen":307,"resource_available":false,"data":null}},"time_used":4397,"timings":{"blocked":4137,"dns":0,"connect":0,"send":0,"wait":258,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/service.68be110a.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.983Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/service.68be110a.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://u65r.xyz/css/index-399e2569.1756903329400.f2d3fd45.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 10641\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-2991\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 117977\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: C2E28C89-DDA4-4D4E-AD96-BD237C7BD32D\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10641,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"993784a38ddc1156572bfc3308055ead","sha1":"becff431867226bf323b5a6535fa383992f107eb","sha256":"abca3af980888b08c6cbd57366b3ac94344d66ea048484c4f9867e300ee8703a","sha512":"48790c6340f273a58295fc6607306353ab69d5a818569fe36ef1bffc8fff084b23d37b401e10502b830c67a5efedca56c1c9d778d6198e4069018d055f1869f0","ssdeep":"192:NdsarkpjwOOmfStcnaHtzB3l2eKD9RdfXtRqi3ln+ojjjKMGlnyL5H7nx+:nJQpjgOz9Dd0orKMGlnA5Hbs","tlshash":"8822c0c41e1be1b6d2ffa916b28543a04b3421fda1a24c342d828c04ccad56ac91f9e7","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-08-10T17:58:48.361392Z","times_seen":2584,"resource_available":false,"data":null}},"time_used":1709,"timings":{"blocked":1456,"dns":0,"connect":0,"send":0,"wait":252,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/65246.1756903329400.c090be2c.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.989Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/65246.1756903329400.c090be2c.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-11f2c\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: B5F8EE9C-B71C-4EFE-B316-DAE9B365A54F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73516,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (48688)","md5":"9695de283c01f0fadf4795c612b010e2","sha1":"9e9b20c41d8eac731f465f87713f570eee532180","sha256":"82d3d78a522caa25376deb145964490b699e6d2c976ae6cdad15f2c4e57cfc7e","sha512":"5f583070eebf753cebbbad1720360c270ec09391ef530c0efb982a92e03b1a10689136cbb74c005fa386f20111b32a602557c0fdf5e2d716062da09d942e2f6e","ssdeep":"1536:r2+iDvYvNjx4Uyao0L8oDNzAuMMsTAQ0mqt2pXYzA4dANV1:i+iDYvPo0L8oZzAuMMsTA7mqt9zA4dA1","tlshash":"c773a501f78272384fa7e290220f2026e16d191505ac5bd8f179ffb93ef4954aa7d7b4","first_seen":"2025-09-04T00:49:32.778143Z","last_seen":"2025-12-29T13:58:58.019409Z","times_seen":420,"resource_available":true,"data":null}},"time_used":227,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":226,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/CHESS.80cb714e.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.930Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/CHESS.80cb714e.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 58759\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-e587\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 101397\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 3319B391-6552-4BDA-BF47-2B1457D04FF7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58759,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"727b4dc207a4141335b27fa73f76fb10","sha1":"bb63b02e635f5503d76c4fc3532c2c652a06cac8","sha256":"5d840214ae46c94540df7d0a94963cc398b32c7b868edddb6a4f2a2faf113e42","sha512":"c1512f9d9a191ea10e806fe3a8f812f78dec9832568373b7b5362fafe9aef6783947d248deb2fc8d30ba1c61fd3b94f308298e69c1de32686110fa35f7bd4ed4","ssdeep":"1536:gtPCh483gu6aLw9AJeteTzkprgTWEHbP4BzrJ:344U9Xte3kprgKE7gZJ","tlshash":"0543025a13c1159f422f37b8148758a6d8154f9f38f32ea11a9e2afda58cb0af431c3d","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.378297Z","times_seen":2374,"resource_available":false,"data":null}},"time_used":1155,"timings":{"blocked":896,"dns":0,"connect":0,"send":0,"wait":256,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_ad0ed5ff-8fa0-4231-a619-ce0616ad2a8d.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.709Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_ad0ed5ff-8fa0-4231-a619-ce0616ad2a8d.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 437541\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Epn7GqO3UrafBnZBkUE9UQbkTtwgLKnnmdLhgenSFCe4zzFyaIM5%2BkE7FHiXVKk3td14I8MA37AtsHRh7cqbYpnWBr5UM%2BCpwlEOmrE9EQkyz1McY%2F%2BjR1csuqdT\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"022efc3205a0b1288fa238227eb86951\"\r\nLast-Modified: Mon, 08 Sep 2025 20:42:38 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189692\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac983f1885f8-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 33ED6C50-28AD-42F2-B664-0F821040F72E\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":437541,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"022efc3205a0b1288fa238227eb86951","sha1":"199eb2260e9390258f0fe010fe69365aff31a927","sha256":"d19ee176da9545bbc2d1463e31a456643804b2acc0382b4b8a6952924d15b536","sha512":"310ca94418c0c0559c34e7fb749fadd579d86e2e6d3727fb59ccf3446e54d0e2bf881283202bf0d342578af036c0384a119554cf89623afdcc8bb46498969e3e","ssdeep":"12288:4iXmQ8+GAh49y1xGL6uHhEI2qt7VMv06R7nLQItYg:4MVTp4+xGHhhxU0KnLQm","tlshash":"a29423f9140d9b6cb37673d5fc549dab26b0301fa63214be198259c70fcbd99c2ca226","first_seen":"2025-08-29T11:05:53.238055Z","last_seen":"2025-12-29T08:12:31.323425Z","times_seen":282,"resource_available":false,"data":null}},"time_used":2176,"timings":{"blocked":1952,"dns":0,"connect":0,"send":0,"wait":200,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_bbac9ff6-d09b-48f7-9e60-77639d6ba1ec.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.724Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_bbac9ff6-d09b-48f7-9e60-77639d6ba1ec.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 92069\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rLyL6arPh2l5DsCjp%2BOxbmKNkcphVU5EoIYAQvOJdk0y2eutJ3%2F4vsLmPB2mcK5TqtGtVtY7m46g9mBgaEKkWVmGNKtav4rKqffLsRbXyTzh%2BgZZER8nl7%2Fbkiiy\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"feb140fe19a10fd9e5db065a8a038f98\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:28 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189695\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac8ea8ab84ab-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049811=yfEHl6AolJP0QC5NkMkOAeL2cxw2cvQEQ0CJoyH0PwylhAu+93HbTVa2aaGzmwCJZPRlEiCkJ/Lezou0DkT7iNjC2gSEaRk5/ITYUs6HFP6vgf9C2kZ+8cKO8dprXM2S7lcJEzc2ZecPldSfp0XqpOhoW/bsw+EQEoKlKZs4TyR039jUu6QbtWk2lIQvTHt+\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 1F00FC93-B875-4D7E-B53B-93F340BD166B\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":92069,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"feb140fe19a10fd9e5db065a8a038f98","sha1":"5d0134793913e11a60a320c144c99ed060e1fd96","sha256":"20a24fe332b621908f702caccd9af7c3bd5f2bb30e3688dbee74cf2e92d42da0","sha512":"52cb6adf379c2cdc5acc60267ec402948eeb494f7181d0cba92c8fe24a245dfb941834f5c3e3c05e97f6b4fa867ab9e2deca29651e25a0a224f8867f8855df6a","ssdeep":"1536:kaaOm3ctZpCgpl/Vhbyyx0ZxUfhUg0Zif6rBF8ikHy+bgM8yd41nt12S1M0tdQr9:kRMnogH/VR9ZR0ZimkHn+hxtd8i4","tlshash":"6e9302bb4743ce6ce52cf0bf0469124571f91744332b6baa70e978a4993f50fad318a9","first_seen":"2025-08-29T11:05:53.160781Z","last_seen":"2025-12-29T13:58:57.996683Z","times_seen":298,"resource_available":false,"data":null}},"time_used":3519,"timings":{"blocked":3274,"dns":0,"connect":0,"send":0,"wait":239,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/19717bc35179e2b1b40d3a2bb77e7170e18c0?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.404Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/19717bc35179e2b1b40d3a2bb77e7170e18c0?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 118335\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"19717bc35179e2b1b40d3a2bb77e7170e18c0\"; filename*=utf-8''19717bc35179e2b1b40d3a2bb77e7170e18c0\r\ncontent-md5: cooMTDn683FfU/BkYddniQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FjsMl_A0gWx6djAo3q2WlIzHq0XO\"\r\nlast-modified: Wed, 06 Jul 2022 13:07:22 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-19;QNM:cz22;SRCPROXY:cz24;SRC_***:52;SRCPROXY:52;QNM3:61;QNM3:126\r\nx-m-reqid: ebOZC2yxm\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: vBoAAADPAXn5zG8Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":118335,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 390, 8-bit/color RGBA, non-interlaced","md5":"728a0c4c39faf3715f53f06461d76789","sha1":"3b0c97f034816c7a763028dead96948cc7ab45ce","sha256":"6c3e9f040e8dc50471d85d0b1ed2ec75332464c5170f8b720e5ae573c01c1832","sha512":"dc315497f31b4083c579c921b2b40e80d99e5f44c1446591612cb09e49a93a575bc6dc1a3666b7c0aa9e3684c995ef6cd449c1acfba2614543f11e316c82a95c","ssdeep":"3072:BuCS15zxdc0CYz/M/bOdjwbPRkKwIuEKKPo:BuzNxdmYz/M/bcjupqIbKKPo","tlshash":"73c312b3963138bef0b305258b702677365f751118b47a3687ff2238dad48e6603d6a2","first_seen":"2025-09-12T03:03:41.390888Z","last_seen":"2026-08-09T10:14:04.705414Z","times_seen":361,"resource_available":false,"data":null}},"time_used":3104,"timings":{"blocked":1136,"dns":0,"connect":0,"send":0,"wait":836,"receive":1132,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_3340babe-d86d-4379-84e5-92efe2221568.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.708Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_3340babe-d86d-4379-84e5-92efe2221568.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 482221\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bHg%2BfHQpN1cLZEoqcJY0T1Xf0A46w0Pjc%2FfCkTkB2PDjvjSNyD6xeriiGaOv6EkDjde8Lvb8osYUX%2By5U%2FzdJqHcpvAcGuHsBJolScBrOZ9bJ3ysk19qjaoQkHC8\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"f7ef4e37a62c368c1cfc0a2e7f9923f5\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:28 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189698\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac70fcf51fc4-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: E0F554C3-E506-42F0-9161-8669E4CBB0FE\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":482221,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"f7ef4e37a62c368c1cfc0a2e7f9923f5","sha1":"60b9a2019430f28a3e93fe500d293bd338686cf0","sha256":"bb0f3a60618593a93b138b40eb5990d34637c9261c7b758c834a3276950b076b","sha512":"096fb344e49b180a3e600985b27b9d3413525093ce06d6e5b66fabd0c11fd32b1547aebde698101595fd3a1e54ff541b24e86fd13b36cd7042eaf2133d5f6956","ssdeep":"6144:aNJaHi/7KQR9nGgwCN4i1jsFl1SzbFKGQSg1ru9KlrSg6BDC6q9LHnXnBkZJRS9s:3H871EyvlsFIc5wgFCmRcJ89qY4m6","tlshash":"c4a42301c0b1a6cbedbb99d132100b9f7c93eb4f2d2592b96c95fd7859b015b2e28464","first_seen":"2025-08-29T11:05:53.104502Z","last_seen":"2025-12-29T13:58:58.004708Z","times_seen":285,"resource_available":false,"data":null}},"time_used":3416,"timings":{"blocked":1893,"dns":0,"connect":0,"send":0,"wait":242,"receive":1281,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_13f1f273-ad7d-4854-b9a3-7f3eb8823296.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.725Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw_size1298x1156_13f1f273-ad7d-4854-b9a3-7f3eb8823296.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 147613\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fF0bu%2F3fJzidYmbpsxqimT8D20adjPKv2qFYd0ody5s0TNFsMwuMJhjhxqge3Bp%2FWWzbXaP2VI78uWKDolgR%2FW93z4ci2OqB11gOYNNuikDnqTaXaSZH%2F%2FvKThwc\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"1af1a4706ec456f37c4354214bb5397b\"\r\nLast-Modified: Thu, 18 Sep 2025 11:24:03 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189689\r\ncf-cache-status: HIT\r\nCF-RAY: 990eacb3f8830960-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049811=yfEHl6AolJP0QC5NkMkOAeL2cxw2cvQEQ0CJoyH0PwylhAu+93HbTVa2aaGzmwCJZPRlEiCkJ/Lezou0DkT7iNjC2gSEaRk5/ITYUs6HFP6vgf9C2kZ+8cKO8dprXM2S7lcJEzc2ZecPldSfp0XqpOhoW/bsw+EQEoKlKZs4TyR039jUu6QbtWk2lIQvTHt+\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: FD3CD637-9326-4CBE-8675-916EE1EF8893\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":147613,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"1af1a4706ec456f37c4354214bb5397b","sha1":"d4598a9b6373a24fa251d1326b973cefe08e7a7d","sha256":"de9a8bcaf7e6624d23a8f8415ea12a9ba8d103f977fabbccb6ae571671dd83d2","sha512":"f0526ef7d091b072d78284fb8011400651f5f7e9472ae9fddbf272a51e5d6d60a8df34fe85134d4a54d91c61a21dec8e862a338096beea33eef944daf93152b9","ssdeep":"3072:wpjsS/+EYEXoMenKagm4TP/DImKbojBuxcpGtBoWrYRMv:LS2tfgm4nI8UxXBrYq","tlshash":"f4e31204f52a98e2cd960db23b354cc149bc5e980a4b39e5e4c3d677644725adaeb2cc","first_seen":"2025-08-29T11:05:53.134299Z","last_seen":"2025-12-29T08:12:31.364681Z","times_seen":298,"resource_available":false,"data":null}},"time_used":3911,"timings":{"blocked":3435,"dns":0,"connect":0,"send":0,"wait":247,"receive":229,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_465faf5d-2f6d-44ba-896b-8d6bffead8bd.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_465faf5d-2f6d-44ba-896b-8d6bffead8bd.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 69399\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0AA9JAiUXcd%2B9abcLAxqtYqyUs1xn%2BK%2FX1n2NcU32VLFxR8LYUatsHgLXjDFZ665AUk%2FVolhbi%2B53MNtWXxdAiRrAUCj%2FoAwaEV9t%2B7H1YXpAny5F790WkzbK1iL\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"ba923e968e806ec3cc5e0ca4f15b6754\"\r\nLast-Modified: Mon, 08 Sep 2025 20:50:58 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189695\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac91bcf903e7-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049811=yfEHl6AolJP0QC5NkMkOAeL2cxw2cvQEQ0CJoyH0PwylhAu+93HbTVa2aaGzmwCJZPRlEiCkJ/Lezou0DkT7iNjC2gSEaRk5/ITYUs6HFP6vgf9C2kZ+8cKO8dprXM2S7lcJEzc2ZecPldSfp0XqpOhoW/bsw+EQEoKlKZs4TyR039jUu6QbtWk2lIQvTHt+\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: EC182161-A44E-4F25-B3BA-56F3F1DAFD55\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":69399,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"ba923e968e806ec3cc5e0ca4f15b6754","sha1":"6781e3cbf0cad47c0b41a379dd13754885427315","sha256":"191dda4470e82101bad4bd8363aee40e44c864056a114f213b56992d0ce6b744","sha512":"03d50e9e07273a54a7e264b8d66ff08c569f0eaab85fb9a87f90ff6b85cc421107dff11e8f5faf59051f9df26d22c8abe380aec5ea0960756dc392faafee9d8e","ssdeep":"1536:XUBrKrVeCYIB7URpEFD7UjVAP5mq68QB8siQSwFoySA5mjCTDz:w6VLQo0xXl/JwwFoyrEePz","tlshash":"79630255364b0a6eedcf6115da6378213889b3a9ecd8a5f429bc0d4206c2dc297f7326","first_seen":"2025-08-29T11:05:53.275096Z","last_seen":"2025-12-29T08:12:31.374845Z","times_seen":292,"resource_available":false,"data":null}},"time_used":3637,"timings":{"blocked":3428,"dns":0,"connect":0,"send":0,"wait":207,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/13575.1756903329400.cda1d494.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:03.395Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/13575.1756903329400.cda1d494.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:04 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-2f96c\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049804=h5k4oOZBnH07/tXwPIgLACWo459+P2Pabs9NtfDroPIDrNZiYSJJtMy3o1VcjQflqa1V7B/Z+Nh3eoBMUpChlR5iMn7XhWnsM406Yp37szt6I0vL5Dxr3e26J0gLTDWq4BPO2oJWrWBLw/2asm78ZGKFS0Ej8G3eFlTffCQraOfnlC5OG8KVbdcKmF+pSwvy\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: D925C601-F7B8-4FC1-898F-4219CD26ED58\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":194924,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"60a85822cef01147878bbad7876a1fe8","sha1":"94563a78fcb76c76cce769d2fc4021baf782c844","sha256":"5b0a33a268e1507f5e758833c854e3cda700d19c35357e4a2098263a80da8892","sha512":"c23f2184349d611d1c54c379a0aa29d9564ea4b76b44c049647f0caf9e5b9dfd809c87eb9fa94c58377df9a9540580d0920802784fe9f485380985f36eaa4a5b","ssdeep":"3072:z7jHoKRKphCnDgJoec+IDWIzls+7Xr0X7:sKRBgUPDWCW7","tlshash":"42141a84764170b8c396a165322f601ae22f789650dd9c24f3789ba47f7470df26fabc","first_seen":"2025-09-04T00:49:32.754298Z","last_seen":"2025-12-29T13:58:57.972807Z","times_seen":438,"resource_available":true,"data":null}},"time_used":1341,"timings":{"blocked":874,"dns":0,"connect":0,"send":0,"wait":240,"receive":227,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/css/home.1756903329400.edf3cc73.css","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.392Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /css/home.1756903329400.edf3cc73.css HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:05 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-13930\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049805=po6D+l8dMhfLGKAdfLLnVeIRbjpxlkQDEuGKbtlEOTQWkshI6okgIymixUARr4wGybpILVpsVTfVc7k0JaAkDpC9mG+fNrxEIVp7sH1o9IEd57siolGhKy+cprba9qHT4pkoamaJpfQkaW28kwG1+DFqQQxzksZj++jdxZwG6L+cO51eyJYwemgSWglzoiWi\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 23C2B4EF-71A6-417A-B6BB-7F4F4846FF0B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":80176,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65528), with no line terminators","md5":"2e29065a1a5515643e2fd444bf8a6276","sha1":"fca2b112876cca0762e522356083c0b8649f0520","sha256":"f77a87b9e81ebb2473ae09a9dcbb13e383ca95151a71a6aa85bfa51d6223f6ed","sha512":"0549da8eb6c9e2dbe1f6ec23b197491230176fb5952835cbed1e0650f680db8333bd65e3b4b026804c94d48229b8c6974427978bf83c88cac162db9511ead377","ssdeep":"1536:yzOcRM7jufawS2d3a8WiLKbzGhbKpXdNCg9khb+TJ/:PtuSJwLUK0Eg9khb+N/","tlshash":"25732b7aa610253db437da72b9f05bd8b524c846d7634a3df2537a25cbc72e213323a4","first_seen":"2025-09-04T00:49:32.974291Z","last_seen":"2025-12-29T13:58:58.075129Z","times_seen":426,"resource_available":false,"data":null}},"time_used":235,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":234,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/kc523-1/sponsor/sponsor_web_3.png?1756903280095","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.833Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_3.png?1756903280095 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 40879\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-9faf\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nAge: 189700\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: ABD2178B-9C19-4B85-8543-EC2E7E56F670\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40879,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"c26161f438986f6e2d677c34d653285e","sha1":"faf6c47a013a9944bb8cac197688908422992039","sha256":"58d11e173550b3420b35c4e4be3eeb76b59ac790d9fb59b535ffe55d3b470fa9","sha512":"97649de556447ef6aa6cdd7d0bec46837cfb328335daa3b862cbaa5e23ca5a8f2af296703c9e961cbad02bb797ebf1f99ced2d1d245fbbb3a428e39d26428c76","ssdeep":"768:ub+4OMIuYE3McXMuDR64Q7sRFKJdsCA1Hunj5tyKxGGTVtkDGlT2oTO:uS4OMXYODNDR6XsRFisCAk39t6oi","tlshash":"db03f108254f2d4466ec90bbc7a1e0f7ee1d103dddb7e30c35a685163e46ca559fa0e6","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.577131Z","times_seen":2346,"resource_available":false,"data":null}},"time_used":1262,"timings":{"blocked":1002,"dns":0,"connect":0,"send":0,"wait":258,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/configPage.js?v=9/3/2025,%2020:46:11","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:03.380Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /configPage.js?v=9/3/2025,%2020:46:11 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:03 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 949\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:19 GMT\r\nETag: \"68b8389b-3b5\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1761049803=N2Mzwq8fLWQhe5PvbYJKnT1J9Jk9QgjpDkS98sT0zMkxLwtxh6uDYKsuHHgZ92HdOrvsCoOXZCeUHdYDG4WOFi8shXZ1ri+iElYDeZ1akQ3cSi8Vkg1DM7B53M3dJgpaHf6bli/J85KwiwvgYpuXBz3LFDvFlDARwGqtVF2qyuwPxvG8f0dCKPXCjzO5DnCS\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: BD07DF4E-5A9A-4F23-997A-66E14971507B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":949,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (917), with no line terminators","md5":"e6aa74bb352ef198ba3e1c9a4b01b014","sha1":"2ea8bd6b5045475a36432f7665a129728e822d9e","sha256":"73828e873c0b6e847b37d78941ca436247471dfc90a12f743964f869f75abd5c","sha512":"2faaf24fdf1e4da637af8e9f82d1778bf061b00752dfca0c8f73432ba236a7b69410a7ad2a73727bc83e6cd631fd6555c3cc0d9d3a5d8a7f81818dd66566011f","ssdeep":"","tlshash":"be117aaf57444dffcf1d7e00a08b0a5ea8bc61d261889d4da8e9cf29e1c99002378978","first_seen":"2025-09-04T00:49:32.949926Z","last_seen":"2026-08-10T17:58:48.47216Z","times_seen":2885,"resource_available":true,"data":null}},"time_used":223,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":222,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/kc523-1/noData/cms_game_noimg.png?1756903280095","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.101Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /kc523-1/noData/cms_game_noimg.png?1756903280095 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 4977\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1371\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049807=D7GR3yXXTH6tA5qMX0TRLkPT62fZ1RcJ1BfbKfh3u0HYbeLvNq2vYt0hNmKA784pNHTaUvlGfECEEu2d10SPkEygse8BIwXjv5duhQXnp2qQMZrbxL2nJnI7EZjsmEDd+ieBw81CojQYlrxFSHMlY/mR6C0Trdal9nVKHuweLfCXYIMXL6pSxGVSkc1DFIyh\r\nAge: 117972\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: C06A2787-B262-4939-89F3-A535CC6B6FBA\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4977,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 750 x 590, 8-bit/color RGBA, non-interlaced","md5":"84170735ffce6fe0e70a3136a36b8ef6","sha1":"5b2dcf1d5d92d786f1e58dc65de3dab1f35d7278","sha256":"581435520cde2b0026b4e7244a85b6eef0be740cb18c43690c420d1ec326d0b4","sha512":"bb0fc1b267c99db65ff3b9414576d3f4c0c9016e5309f2806a9f4d51c8c63383e9279c3a04daa5feda5489eb231a846b60040c71e5fa2798ca141b36ae0241f6","ssdeep":"96:nKdKn+AFdoSfrmrMDpdXd8nbZDH3mC+b2A:KYn+QK+pdXd8nbZ73mC1A","tlshash":"99a14be32b5d4badfe1e9a76a5549760ea632aff482c8c0e6887c955048b2144f640d2","first_seen":"2023-05-01T02:34:20Z","last_seen":"2026-08-02T09:02:15.179219Z","times_seen":2038,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":254,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/13056ecf8df9d13984ffa8bb056fc85d4369d?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.436Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/13056ecf8df9d13984ffa8bb056fc85d4369d?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 113513\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"13056ecf8df9d13984ffa8bb056fc85d4369d\"; filename*=utf-8''13056ecf8df9d13984ffa8bb056fc85d4369d\r\ncontent-md5: NRnmel/Utvhskwnex2wrpw==\r\ncontent-transfer-encoding: binary\r\netag: \"FtdBF_fmuPImvDxJk_DzBgSsoQwy\"\r\nlast-modified: Wed, 06 Jul 2022 13:00:55 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-3;QNM:fn268;SRCPROXY:fn270;SRC_***:12;SRCPROXY:12;QNM3:14;QNM3:1284\r\nx-m-reqid: EfQ9mVnJq\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: 8wwAAACRmvVPEnAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":113513,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1643 x 1643, 8-bit/color RGBA, non-interlaced","md5":"3519e67a5fd4b6f86c9309dec76c2ba7","sha1":"d74117f7e6b8f226bc3c4993f0f30604aca10c32","sha256":"4e332b211d4b9136f68fccf8632e1160cf4fd6db8bbc3e6b8188f1bfc749496e","sha512":"c204bd3e33956e3d02d62efbbf7e1c5d603abb3178165359262112861a23b99dc5e41536a2aaffa038414e85e7ccb1b79e84f6fd31e41099df1f8b5cb98a44cd","ssdeep":"3072:nVUPkWiDKrS5NiAZ4h7E4VhvataYRNJFNA1Hwj+xF4:VUPVkr4lpataYRNJF2wi4","tlshash":"f9b3f22d775eca95eda969318cbc2a11b6babf1d93b9d3073115f8109c4e7d100e9e0c","first_seen":"2025-10-20T20:50:40.553587Z","last_seen":"2026-08-08T01:43:15.355786Z","times_seen":181,"resource_available":false,"data":null}},"time_used":3075,"timings":{"blocked":1104,"dns":0,"connect":0,"send":0,"wait":836,"receive":1135,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/assets/logo/favicon.ico","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.709Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /assets/logo/favicon.ico HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:05 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 58278\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-e3a6\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1761049805=po6D+l8dMhfLGKAdfLLnVeIRbjpxlkQDEuGKbtlEOTQWkshI6okgIymixUARr4wGybpILVpsVTfVc7k0JaAkDpC9mG+fNrxEIVp7sH1o9IEd57siolGhKy+cprba9qHT4pkoamaJpfQkaW28kwG1+DFqQQxzksZj++jdxZwG6L+cO51eyJYwemgSWglzoiWi\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 61179987-DA66-463B-A4AD-CBF752FBEB1C\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58278,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"7fb9203f2701deec1371d2fd0ddd079a","sha1":"a7d4ea5f1c3d103aaa3c078bf540b56404aec0e1","sha256":"2a342dd0f9977afb12227889cf13ff008d4cf1e9a4ca07fb4131d14af05978d0","sha512":"964cf7794a7b72bb9515927efe748563b6d46fe122b35baa4c7f57fafb09ea759e5e759a3000d385872218cdd08383a58a2b66feb9a712e6f3e9a06cc87e43b5","ssdeep":"1536:e7V6OVB39Hdm34GeF4KERayBlZ3WgaOlblY4+:e7V6OV7034GeFERd3WgaOlbGN","tlshash":"af43f10a258e86c73047c3921b2dc09b70d12c776b8daef9e6bc4a5816d54731bbd1ae","first_seen":"2025-08-29T11:05:53.165834Z","last_seen":"2026-03-18T12:35:38.966648Z","times_seen":1201,"resource_available":false,"data":null}},"time_used":239,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":227,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/loading.da46bff6.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.046Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/loading.da46bff6.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 473164\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-7384c\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nAge: 101402\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: D5581104-84F7-413D-BC28-B7F88993CED6\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":473164,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"ac7ca483f10bc73cffa89f639f6ffa56","sha1":"03873b9607c635752526968af31773498d259afa","sha256":"a054b81d2850fe2da5b4f97a1c50c05ee59a24c37f1c700e5cc45fe6079598b6","sha512":"caa6b3e243f02c86ccaf71aafd0e716834a7a0cf07305c5c7cc0a1b9d637cc2802caa067b0010c7c3c064e3fe8f7881b26992f57137f98477266653342257760","ssdeep":"6144:NFoYczeWIF3Q/IUPYhuF0KX38I4z/tcKZPehCIjAl/CS+b:rLczeTUPpF083CBdeh7MlvI","tlshash":"79a423929b411988e1096432215fab4d23993b6458ab5fbf78843d88893cf059ff763f","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-08-10T17:58:48.426547Z","times_seen":2243,"resource_available":false,"data":null}},"time_used":1366,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":1111,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/289905392407cd33e4ba9b4c8399f89b1d2fb?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.627Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/289905392407cd33e4ba9b4c8399f89b1d2fb?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 40186\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1525346\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"289905392407cd33e4ba9b4c8399f89b1d2fb\"; filename*=utf-8''289905392407cd33e4ba9b4c8399f89b1d2fb\r\ncontent-md5: XZEaN95G1XLXVTxuyqCFaQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fuo6P505lF2o_BIQkkn5731TqVM4\"\r\nlast-modified: Wed, 06 Jul 2022 12:49:21 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-24;QNM3:4\r\nx-m-reqid: vbeDjVqgg\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: KLsAAAAA4mFgFWsY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40186,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"5d911a37de46d572d7553c6ecaa08569","sha1":"ea3a3f9d39945da8fc12109249f9ef7d53a95338","sha256":"8ecd7ed0989fafa1549fbc3efc88b3b63c4c0fd816429f5fc722542afc03b626","sha512":"c2446416efc67ae163e8d4b6b6883efbfaff944b1758545064624bdd6e82798e24230587d343ad21ad516cfe65d63ba885e3586b8ba077e6609d0cd61f882c17","ssdeep":"768:bBJBP9LYkqPNYa443BewDaTbmriARvqA8eL6ebIrwwklUK9eSRduDk:bX13qya4SOGri2v206eUr0XRZ","tlshash":"a40302b0c05654e831cba70625e0edf33e6913892c87f46c67b1158fe552a321b4b6af","first_seen":"2025-04-01T11:41:17.813608Z","last_seen":"2026-03-15T13:28:40.90435Z","times_seen":170,"resource_available":false,"data":null}},"time_used":3159,"timings":{"blocked":918,"dns":0,"connect":0,"send":0,"wait":838,"receive":1403,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/config/initGeetest4.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:03.383Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /config/initGeetest4.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:03 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-3a06\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049803=N2Mzwq8fLWQhe5PvbYJKnT1J9Jk9QgjpDkS98sT0zMkxLwtxh6uDYKsuHHgZ92HdOrvsCoOXZCeUHdYDG4WOFi8shXZ1ri+iElYDeZ1akQ3cSi8Vkg1DM7B53M3dJgpaHf6bli/J85KwiwvgYpuXBz3LFDvFlDARwGqtVF2qyuwPxvG8f0dCKPXCjzO5DnCS\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: F7872538-E664-4581-83C8-674376357F59\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14854,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"8c1728fc2d381e145b190ab70c9bb0a1","sha1":"0b96f2760bd9ca0f1d9ffaeed79934edb645cae2","sha256":"6d0aaf3dd58610ef691fb625d47237f756c4821be2dc28950c94e8eaa7761edf","sha512":"df586fb362b77f15f597573310941d008233942242914d9791e6a38e0a642874843b4f98b66d2ffd84be5fe0a986968aaccecbefedcccc7831b559164b3724c2","ssdeep":"192:hN3ar8HuCDoNu5dq+ExNiqc4K25MB5VsaiQxta4SScQVy8QRHIqaawzjTki59r8j:fJe61XHlii5aI2PG4lyUIVKQTwwwlB","tlshash":"a762104d68f750a35553b43c8b9fa014b5388a93041cde41be9ce394af9843d9bbabdc","first_seen":"2025-04-08T11:24:52.26859Z","last_seen":"2026-05-23T23:33:56.909269Z","times_seen":2066,"resource_available":false,"data":null}},"time_used":306,"timings":{"blocked":62,"dns":0,"connect":0,"send":0,"wait":243,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/js/chunk-common.1756903329400.8e9f70b3.js","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:03.392Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /js/chunk-common.1756903329400.8e9f70b3.js HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:04 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-26f1c\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049804=h5k4oOZBnH07/tXwPIgLACWo459+P2Pabs9NtfDroPIDrNZiYSJJtMy3o1VcjQflqa1V7B/Z+Nh3eoBMUpChlR5iMn7XhWnsM406Yp37szt6I0vL5Dxr3e26J0gLTDWq4BPO2oJWrWBLw/2asm78ZGKFS0Ej8G3eFlTffCQraOfnlC5OG8KVbdcKmF+pSwvy\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: DA58DE18-84C1-4AB9-896A-F627D63E55DC\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":159516,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"1b35e779a9012cf73988d1d4b0d9e5f2","sha1":"c139c75aed4b303657e5a48a1fb036d7fcec6533","sha256":"9231e7c73c53eeebd2a055dc9c7402342f21053dbbbdd257be62eaf29c98fafa","sha512":"53ab4c8aaf4fb2bd81c55c7356348b96d509ee4f2a91869043061c8b6ffac404ce76a6ca57caddd47e94dfa5e821a3e6a85c969cc94675fe8625cf44d689c05d","ssdeep":"1536:6ZVB2bNNcdWUc2UTC6oryXHuLmbErF/G7D1dMI5MHLui7TAN/voVG5glVbGD3tFZ:6ZVBM/TC6yjFecHLui7T4/voVG5agD3t","tlshash":"73f3e8c5b3a0f07e9a1ed53779331499b12f758274c87c60f1a1ada6bf19708a436ca8","first_seen":"2025-09-04T00:49:32.82259Z","last_seen":"2025-12-29T13:58:58.058135Z","times_seen":438,"resource_available":true,"data":null}},"time_used":1190,"timings":{"blocked":769,"dns":0,"connect":0,"send":0,"wait":221,"receive":200,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/kc523-1/logo/logoWhite.png?1756903280095","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.803Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /kc523-1/logo/logoWhite.png?1756903280095 HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 6364\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-18dc\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049808=sBeSKsiafNlkKsLs4C/dAiFvvIebGS1CCiZrVBTiq6N2BrMHJO/A06D5FyfgjgTxmm65szHCxvbeWCjEoLhX52ZT+6aWyh2Ly2dWJuSrJO8MDlgQ2vONi+MIwEavNqtGmMx1nEqf7c6BCaib745OKSMBePL4GHCI7LEl0G2xpUJD22vca5uX8ey/KW8PlWax\r\nAge: 117975\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: 23F5F44A-B5EE-4A8D-BA82-0231D48575A8\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6364,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 318 x 144, 8-bit/color RGBA, non-interlaced","md5":"45c781dc22fa33ee3af4b9611b40208f","sha1":"85005a42a66ac2755af868d974cef7a96b3f7732","sha256":"992d312ebba7a4f7559af9b559b803b6de8be4577a26366c29066d98bb382428","sha512":"63a95d0d966dd41d636bcbedda1763579f8126b7ae5448c3f8f350aba06b05dbe81d9f615833f0bbff34bfe341c6f206a89e145ada9acb28945131c816ca8094","ssdeep":"96:T/iMk0vyTGRwuNomrrhXoC4P9IdsLM1hhpMUWBg+TM42IGWUp9PXtQJ1mTdAcsor:TqMkud+wWC4VNyhhpL/+yzV9QJM+4","tlshash":"d5d19e4301c5b55102d0521645ba005b6dfb6be0bedcc40aa497ef0609313e6fef75d9","first_seen":"2025-08-29T11:05:53.141975Z","last_seen":"2026-03-22T22:11:35.376909Z","times_seen":1124,"resource_available":false,"data":null}},"time_used":3035,"timings":{"blocked":2829,"dns":0,"connect":0,"send":0,"wait":205,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/ecb/8f8306425ab46d0221b2c56ef50f72e487d5bb0255ee7333091abb7c08c465094a574c3c12d0e1812241fe43c0d5f0ea88d857f698a4fd081b","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.300Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /ecb/8f8306425ab46d0221b2c56ef50f72e487d5bb0255ee7333091abb7c08c465094a574c3c12d0e1812241fe43c0d5f0ea88d857f698a4fd081b HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://u65r.xyz\r\nXign: n47YIHLqdFn/d/6Osxt0WfmuVkxFboAkzZZrADU1+xYv3ECp3nEGnpZGYIGjpY8Qb5y1+F9F5BGvKrZ3imCSH9odrLNeXN3ZYNTO4wFb30zPeCEw3Ee+km8kLMsQdiz2+mF8Rd7UIj6JS20vdP1J4unjCsEiOXxUz/8BM6pMBBU=\r\ntimestamp: 1761049806283\r\nsign: m2kh1b441c7m4t1f\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: htmZ44nXYhd2SnrNty4ztc2apf5FpAim\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Tue, 21 Oct 2025 12:35:06 GMT\r\nCache-Control: public, max-age=300, s-maxage=300, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: B17B4694-B03F-4349-A410-B0AD1E683541\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36975,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"c2f5cb810c879a3521f6d3f668989da0","sha1":"d4c49c0c9a38960088d0a3de5b73adca21983491","sha256":"4f8a36361befd2ba46d0a45e0639865637a5d9588a836de274e051222104d069","sha512":"93722e4482d3b7741f5483fd3d0f7235dfbb5c0e443862c277fb426a04e1aaae7a837352a3ae070d1cbaa8adc15e2ffb0fddd9bce275594feadcbf796628e928","ssdeep":"1536:OBVlEM53FRywEd+WG3xASsuw9pxXaEGBmZvU:0lEM51RTMVG3PKhaHBmZ8","tlshash":"3633e126a601f360f3ba60f9e90726c0a550de64e7dcdad1c235cca07d6f16aa7dd0c2","first_seen":"2025-10-21T12:31:20.673701Z","last_seen":"2025-10-21T12:31:20.673701Z","times_seen":1,"resource_available":false,"data":null}},"time_used":441,"timings":{"blocked":219,"dns":0,"connect":0,"send":0,"wait":221,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/33096d2367d754ae34c6ebcd770b0fffaba6a?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.400Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/33096d2367d754ae34c6ebcd770b0fffaba6a?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 11563\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"33096d2367d754ae34c6ebcd770b0fffaba6a\"; filename*=utf-8''33096d2367d754ae34c6ebcd770b0fffaba6a\r\ncontent-md5: d84ePynyz1vMK4x2D1/8vA==\r\ncontent-transfer-encoding: binary\r\netag: \"FggdUVmDlxgTbrXOj52U2MppPuk9\"\r\nlast-modified: Wed, 06 Jul 2022 12:50:39 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-1;QNM:fn197;SRCPROXY:fn275;SRC_***:20/304;SRCPROXY:20/304;QNM3:22;QNM3:95\r\nx-m-reqid: xKxxtiynB\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss, Validate,Hit\r\nx-reqid: FlsAAADp0-8DgHAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11563,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"77ce1e3f29f2cf5bcc2b8c760f5ffcbc","sha1":"081d5159839718136eb5ce8f9d94d8ca693ee93d","sha256":"a4beb2745866ec2100527d243b8cd8d2e683f339c0c78e5fefb583c89a628016","sha512":"747253c51322aee7e5941d409b30b82264c03abee8d96a6b6cbaea5b7556f46815cc87d4696dfca8534006f1249e4134b2584b517b0f159b4c084b7008d0fbdf","ssdeep":"192:WnFqfYqEFa9oOX9WfJHCfEO0WwOvrn8JfQse4fVLcywqJOKE1sAJTQF:WqfYpE9WfJH5A0fkexZAJTQF","tlshash":"d832c06b9d458fbdce8242178c12bc9f4f87524403d048598bbe6d610bbfdbd88f4119","first_seen":"2025-01-29T13:39:14.584046Z","last_seen":"2025-10-21T12:31:43.494451Z","times_seen":3,"resource_available":false,"data":null}},"time_used":4265,"timings":{"blocked":1152,"dns":309,"connect":287,"send":0,"wait":831,"receive":1117,"ssl":566},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_0b2c7f25-c17b-4d07-adb1-68f1823633a2.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.773Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw_size328x442_0b2c7f25-c17b-4d07-adb1-68f1823633a2.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 17930\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=47p221DCY4bc1VyBlxgJRbYARv7xYttTJb%2FAWHvi%2F7mDE3%2FcqFunnoGY5kk%2FPdspQV%2FMH9sjCxSvtA78WIOzquS8iDQockGxyPgOtSx8mWi6aJIRBp%2BDZ01EvVyl\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"20f2a955c113cb54ff31889b4b042acd\"\r\nLast-Modified: Thu, 18 Sep 2025 10:48:08 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189687\r\ncf-cache-status: HIT\r\nCF-RAY: 990eaccb1f8ff4fc-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049812=rdeenGOu7oPbUjAiCKj7mQM/L2CZSERSb8B0wFuL8iAz8yGt/SZrwN9hzq//Jfkm2RgBtTQd0nDutTI6d6QWpAWOCgfp5dAbbfEI67TXctUIUufT2Gr4Y/EGVzH3Ds++pR5m1dg201x3t0V1APCXAY3Xdycq4n4xNiX+U+u5NzhLl7ERx+6lMbVyMrOoYSkT\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: BD13C1CA-B3C2-4AD2-B3CE-4F8D675E82C9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17930,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"20f2a955c113cb54ff31889b4b042acd","sha1":"08d9f6359743b39286cd78531671d615884b616b","sha256":"660aadafb61000d1d9b2e9e90096092fadb32dc8ef671b25ad5014bd47dc5ae6","sha512":"e6f587ce2b92baf6ffbc0de68413ac2d3af7f3c01ac9039a23a21b5beb2835194260ae1440db3bd75a5419db91df6a265adbf536abfdff92665bb476b66ea3ed","ssdeep":"384:jtp0ai9STNjk9ZZZL3Gt+m4OZZ6r6ZuImcZtiknaMu9Ov0:UaqSBjk9Z3G+m4OZor6rmcZJZu9Ov0","tlshash":"2682d00a499faa97dd8bf53bf949660208c1804a282dbda394e456d3d678dd4ca3313d","first_seen":"2025-08-29T11:05:53.266681Z","last_seen":"2025-12-29T13:58:58.061767Z","times_seen":295,"resource_available":false,"data":null}},"time_used":4938,"timings":{"blocked":4669,"dns":0,"connect":0,"send":0,"wait":268,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:06.295Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://u65r.xyz\r\nXign: epb5mGLJK/CSn/QtbCQ+cnhD63EeCKBmpbgzdbM5W49B2UusUP7nZQrFyh3FRrkwc89S9PC0tEaU34XOd0SVYWFs+gyTNmMBikXCzgh9QI+xA8aUgySydQNWJ6xeM8QuSFbM9jc6YRLt+apa+YfXjEiPedUWu4Q5EKGm678zexM=\r\ntimestamp: 1761049806283\r\nsign: 424k7j4b2u3g4m12\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: htmZ44nXYhd2SnrNty4ztc2apf5FpAim\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Tue, 21 Oct 2025 12:40:06 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1761049806=+6MAfhNb1B4OZQsJSi1yFD1LQf3YX5XjvkuL4oPFXoRGWbPiD7hI/+QVKdiJq+s1Dnu6dV2EgDnHYaEOzYT3Tnnn0h0lcuyXDW2+vSjsFDkEMDsx6oghlQRKtQIfJ1ywyMxVChziAFw3VFvVmeObtZFOLe7qxpz1KNoTUijFev2i3OUkWN5IcaYo+k+12sXQ\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: A611E128-7239-4C71-92C6-F4F2AE914336\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6556,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"ba12473e8df0ea322e3305b0ae59609e","sha1":"f4b789c8cb9dc73062ac64339b0f6e87ddcbbbc7","sha256":"95863711cb727994753c0972a2c5407a430333a87166091501d34d4258844973","sha512":"b6dfc7e4afb149b9c3bdff8bfc627cb0e5ffc61a39f1aa64f4bd191674a7ccfb2798d335c5bdfb213dd700d887e397c8b5f8c34b9bd2f94c38ea29581ad026a6","ssdeep":"192:Vca8lKBA7Wqyi3BnhneHGAZrwUK8ge37LdMXA4SRJBfdJgrGfMOMg:vZ27WdwBJUNeUK8gerASqOMg","tlshash":"e012af1ad7715704b03a40eeb50bcb84b11d519bffe6bba9ca5049e518a010875fc26b","first_seen":"2025-10-21T12:31:20.522516Z","last_seen":"2025-10-21T19:10:13.010801Z","times_seen":2,"resource_available":false,"data":null}},"time_used":278,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":277,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/478035171fde67cfc496db7c9c5806a49fcb8?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.374Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/478035171fde67cfc496db7c9c5806a49fcb8?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 51938\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 687841\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"478035171fde67cfc496db7c9c5806a49fcb8\"; filename*=utf-8''478035171fde67cfc496db7c9c5806a49fcb8\r\ncontent-md5: QcflkRA0uQSaHz6n2fivZA==\r\ncontent-transfer-encoding: binary\r\netag: \"FkhkU50iqnlJW0AGVcBt7u69vjQf\"\r\nlast-modified: Wed, 06 Jul 2022 12:54:54 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-5;QNM:fn268;QNM3:49;QNM3:77\r\nx-m-reqid: Fa5ih9WFh\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss, Hit\r\nx-reqid: klMAAADE90NCC24Y\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":51938,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"41c7e5911034b9049a1f3ea7d9f8af64","sha1":"4864539d22aa79495b400655c06deeeebdbe341f","sha256":"375eb9a73f9b68d9042c042e4ff8cff2a73e40d1c88cd23ff5ae2efb9dcd356e","sha512":"b658b719a46821f72da674b163b187eefe00447c610e739b196854dbf3f8563da4b70616521acfb1a7ae7d96b578aa88a419420692bb19dd5737730464c40272","ssdeep":"768:VSqU9Tduzc8hnaneSttCACH1k/oi0l+g/AJ0PnHzezdMrzoX5VDt1uUU035FvZyd:VJU9TdE7naxtCkzogOfTmazoJ1lk8+","tlshash":"9133f18248934a6b431ce5d6e062a517a7fc1bfda3a0b8268e20c7f55377d054eeb391","first_seen":"2025-01-29T13:39:14.558553Z","last_seen":"2026-04-14T12:48:18.016564Z","times_seen":44,"resource_available":false,"data":null}},"time_used":4518,"timings":{"blocked":1394,"dns":316,"connect":272,"send":0,"wait":616,"receive":1119,"ssl":797},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/10015b960d084968541f38c7b19d5679fed83?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.450Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/10015b960d084968541f38c7b19d5679fed83?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 58488\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"10015b960d084968541f38c7b19d5679fed83\"; filename*=utf-8''10015b960d084968541f38c7b19d5679fed83\r\ncontent-md5: 83jrHqBOU5mbiQUaoyRN5g==\r\ncontent-transfer-encoding: binary\r\netag: \"FmijecFtsxscEDUokd5bPf5Y5kj0\"\r\nlast-modified: Wed, 06 Jul 2022 12:48:59 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-22;QNM:cz29;SRCPROXY:cz17;SRC_***:37/304;SRCPROXY:37/304;QNM3:39/304;QNM3:59\r\nx-m-reqid: s80ivAlXw\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Validate,Hit\r\nx-reqid: VSkAAADnH_3MQHAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58488,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"f378eb1ea04e53999b89051aa3244de6","sha1":"68a379c16db31b1c10352891de5b3dfe58e648f4","sha256":"6d97cb2ffb41686581fb8278013726d9816440ad2d139f4f5ed7e4e59edf9d6b","sha512":"7719bedbdd9985f02c4a3a06631a7b2f236438de4b11f3ba20f5b72d2374b67141cc1205f881670a0227cb198c4eb450ccef7bb35640b70d21bc1b03a55993ce","ssdeep":"768:Ij5XxD36zb/IbbaLFUHwVcXli6hrF/Fi3y3GfmCOxY88xlkZLN4n08p9HNDUvqi7:IF0AOLFuwVQi6/EhfmelkXcHGK4X","tlshash":"e24302016cd64d8822525756dca833cb959beadd3c885e87d30335a5b0abfe5f8433d4","first_seen":"2025-01-07T09:47:10.013981Z","last_seen":"2026-05-17T16:34:28.484194Z","times_seen":362,"resource_available":false,"data":null}},"time_used":2486,"timings":{"blocked":1091,"dns":0,"connect":0,"send":0,"wait":836,"receive":559,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_188684fd-5a0b-43f3-8a6e-b9c558e44ec4.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.711Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_188684fd-5a0b-43f3-8a6e-b9c558e44ec4.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 521413\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OpRuENMFKPZV6nK8VKyZ%2BSMl%2Bz2VbELu%2BCEjMTkflduK4P84KYnuj4vtPtD9teoj7OhcwlAA1zo%2FYCvcgWm17gWdu1IsTHfYoNPfXkZBW9QjdADRrG%2BwZNHhC5SW\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nETag: \"7af0e229cfa55344fcefe8c5dc35c36a\"\r\nLast-Modified: Thu, 18 Sep 2025 10:36:25 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189698\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac72d9de11cf-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049809=bPwjmRtffi9VF99FA5syjjPXlzqNR7vDqJZnZTAihEvWxUmRxH82umqP+LcBK9XgC3EhRTPFUThjn7wH6/fje3PsT/gpstw8rgVfq/baEdS9bbGRoXH8hGeTAICmZssHRyddrpl7eReIzvwm/Is+iGfexzZYjP5r9zBApGrQRc4aRSZNO0nSZn0J95Ywo2Pz\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: A8DC33A7-84A2-48D5-BCBB-81CD8739FEFF\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":521413,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"7af0e229cfa55344fcefe8c5dc35c36a","sha1":"50146d77df37307958fd0f7c3829605ff99444ba","sha256":"c1d5a5e57cb937644c9218cc17f9834c9c6a13b97e04b545ea6731102359f803","sha512":"8ac56375a3fe5949283831742e7c82ba38cc8b7e4d054a6eba190afe1ebaa8ad05a06561736abe2698daa7ea69f7bf9e33e2757625f66cf146c532ffd0b664ca","ssdeep":"12288:pJG3X3rmMkQC+czqeH67CCU8GNCaSms+9qo7cFtoCGW:pJG3XbHkQCTegzCuNntqo7o","tlshash":"35b42395d653f0c0a847304fd6ce8abc1e831e4b835bcf3b2e67cc5966669da6da40c1","first_seen":"2025-08-29T11:05:53.306771Z","last_seen":"2025-12-28T02:09:46.265785Z","times_seen":284,"resource_available":false,"data":null}},"time_used":2293,"timings":{"blocked":2023,"dns":0,"connect":0,"send":0,"wait":240,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/11241e738bb495f39440db5263d763077c344?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.571Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/11241e738bb495f39440db5263d763077c344?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 21058\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"11241e738bb495f39440db5263d763077c344\"; filename*=utf-8''11241e738bb495f39440db5263d763077c344\r\ncontent-md5: Lol7aS71rDzjVql+/JeBVQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FsPDZtMNgZfipLk4aaCnciQsqlXS\"\r\nlast-modified: Wed, 06 Jul 2022 12:50:35 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-zjwz-wz-23;QNM:cz27;SRCPROXY:cz15;SRC_***:66;SRCPROXY:66;QNM3:68;QNM3:100\r\nx-m-reqid: qKqZNdc7y\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Miss\r\nx-reqid: DjsAAABox5h7SnAY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21058,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"2e897b692ef5ac3ce356a97efc978155","sha1":"c3c366d30d8197e2a4b93869a0a772242caa55d2","sha256":"d3742a3cce357d29da6451e753a26e330b482e202ce4597995c548ab4aa20576","sha512":"70c20e77d24c48ae08efdc8e9dd25d145ba58c38b8ab9bbf4e06b701094e7740a058ec07581cc448017fd64fd823e86d2bbf9c3d0b07c47289b472c1cc6cc33d","ssdeep":"384:aP+GAvOU52W5lzxw4/l39QbA1mKYHNt/PKe1mkYtPLdwaXXAuJ:ucvd5l5L9lNIAHYHj6e1mkojxHA+","tlshash":"9a92e02e01be9092d41f6cdd42f994c191604066bad5c67abd4ef2b4cc50a4bfd30bbc","first_seen":"2024-12-13T03:40:21.320187Z","last_seen":"2026-07-24T04:32:26.389338Z","times_seen":205,"resource_available":false,"data":null}},"time_used":3205,"timings":{"blocked":973,"dns":0,"connect":0,"send":0,"wait":837,"receive":1395,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ssl.gfw301.top:3600/?u=http://www.u52j.xyz/\u0026p=/","fqdn":"ssl.gfw301.top","domain":"gfw301.top","tld":"top"},"ip":{"addr":"23.224.132.157","port":3600,"asn":40065,"as":"CNSERVERS","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-21T12:29:56.971Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"cloud.hw301.top","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Thu, 29 May 2025 00:00:00 GMT","end":"Mon, 08 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"52:4E:24:3A:D8:36:35:C8:D0:C1:C1:A1:1F:7B:D9:0D:EC:CE:62:BC","sha256":"67:2E:AD:FA:0B:E2:35:70:C6:CA:33:A6:37:89:7B:60:02:EB:53:E8:1A:BA:DA:2C:70:AE:4E:BD:D0:A3:11:0D"}}},"request":{"raw":"GET /?u=http://www.u52j.xyz/\u0026p=/ HTTP/1.1\r\nHost: ssl.gfw301.top:3600\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://www.u52j.xyz/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx\r\nDate: Tue, 21 Oct 2025 12:29:57 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: keep-alive\r\nLocation: https://u64p.xyz\r\nX-Frame-Options: DENY\r\nVary: Origin\r\nReferrer-Policy: same-origin\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T02:51:57.151416Z","times_seen":17879698,"resource_available":true,"data":null}},"time_used":1293,"timings":{"blocked":545,"dns":78,"connect":153,"send":0,"wait":201,"receive":1,"ssl":311},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"ssl.gfw301.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/img/pay.8f35ebe1.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.189","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:05.987Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /img/pay.8f35ebe1.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 5453\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-154d\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049808=sBeSKsiafNlkKsLs4C/dAiFvvIebGS1CCiZrVBTiq6N2BrMHJO/A06D5FyfgjgTxmm65szHCxvbeWCjEoLhX52ZT+6aWyh2Ly2dWJuSrJO8MDlgQ2vONi+MIwEavNqtGmMx1nEqf7c6BCaib745OKSMBePL4GHCI7LEl0G2xpUJD22vca5uX8ey/KW8PlWax\r\nAge: 101404\r\nX-VIA: l1=CJR9oEa4UnlD0OBR\r\nX-VERSION: 1760857239\r\nX-Request-Id: A10AA342-0434-43D9-AA09-B13287F4A34A\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5453,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 492 x 132, 4-bit colormap, non-interlaced","md5":"05d444b76263f6958a37ac82e45daa67","sha1":"a067d3a654da1ec4c51d8f049aabaa112183e355","sha256":"49166910b376f5487f30174e60fcf13aaaca9620ef1aa58cfb2c94a8c111ea8d","sha512":"7d276d57b068ec4a0125512e0781c501a96bf6c30b30304d247251190c6421a9ed7a03ec208a590d19d9a1183e3837b06d141bddd99abb7b0ee4e2a1ba28b28b","ssdeep":"96:u9g9Yof8+keuD1Kai/MXG5BHMsDiCNPFH/qX4iWXnqvcIzDRHSVyl07TrOKCm0R4:u9g9rJuYai//7FiSXnqvNYGmrOKcPwzp","tlshash":"74b18e749d6efb2a26b315c30d7499c21ea45c9e0d94f1c2244776963c732de3270985","first_seen":"2025-08-29T11:05:53.301829Z","last_seen":"2026-08-10T17:58:48.519855Z","times_seen":2452,"resource_available":false,"data":null}},"time_used":3050,"timings":{"blocked":2850,"dns":0,"connect":0,"send":0,"wait":200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/10071bcd129874b6448949d53c4f367f13c0b?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.613Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/10071bcd129874b6448949d53c4f367f13c0b?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 17623\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 2424318\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"10071bcd129874b6448949d53c4f367f13c0b\"; filename*=utf-8''10071bcd129874b6448949d53c4f367f13c0b\r\ncontent-md5: WAbS6q0mnzldC5UWSm8Eng==\r\ncontent-transfer-encoding: binary\r\netag: \"FjLRHcpENzefcQdyjgyKGSNh-Edc\"\r\nlast-modified: Wed, 06 Jul 2022 12:49:08 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-5;QNM3:17\r\nx-m-reqid: jszaDUHjy\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: EzUAAACkV5dzkmcY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17623,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 139 x 181, 8-bit/color RGBA, non-interlaced","md5":"5806d2eaad269f395d0b95164a6f049e","sha1":"32d11dca4437379f7107728e0c8a192361f8475c","sha256":"6ede3953d83405064ab1df0719e6481a7def427defb402d3c451c541e284fbd6","sha512":"e8da29bf8c0a7f593b4f66abade0291886dcb134fb70c1f777b4dba80d30adf17adc10de3514e879f26a2451dde6803f9164f898fd373d1c28840205d28f5ec2","ssdeep":"384:2FoANXd7ZnpUyD0wbicO8c5s230FGkvEUlGf85bpWPruiA6x1c6Xf4gaAO7:2zsyD0wbhUs23kvEUlkebpWP8eq6Xf47","tlshash":"fe82d1f829d606678e9de501275d86cf97275303b6430ebb9297103fca36909c8bee1c","first_seen":"2025-04-01T11:41:17.722537Z","last_seen":"2026-08-10T17:58:48.43265Z","times_seen":261,"resource_available":false,"data":null}},"time_used":3170,"timings":{"blocked":931,"dns":0,"connect":0,"send":0,"wait":838,"receive":1401,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"u65r.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_d991353f-39ff-4552-be18-848fc3fabfb2.png","fqdn":"u65r.xyz","domain":"u65r.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.200","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.767Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"b223c.xyz","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Oct 2025 06:02:08 GMT","end":"Sat, 17 Jan 2026 06:02:07 GMT"},"fingerprint":{"sha1":"C5:D9:A1:57:7C:57:BE:9F:07:D9:07:0C:13:19:4A:54:77:DB:B9:36","sha256":"F7:99:37:A2:C0:80:3B:43:59:99:41:81:66:13:0D:65:7F:90:5B:D3:2D:57:F4:77:21:86:CA:62:82:B9:29:25"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw_size649x578_d991353f-39ff-4552-be18-848fc3fabfb2.png HTTP/1.1\r\nHost: u65r.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Oct 2025 12:30:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 329516\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Mi6T3DMyBrDiQFfY3zT7hULB4Wt4LBrWm%2FAGxppT77wTeS%2Ft1LDF%2FSzDHR2mtXg0wqZjmm9lpKSwxGb%2FXTr%2Bw977dw0BKpqyNVHidRYXRKxPeQtNvybFPrCTRqWx\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6349b4be3bf7b45da5cc14ac341cc9f2\"\r\nLast-Modified: Thu, 18 Sep 2025 11:00:18 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 189694\r\ncf-cache-status: HIT\r\nCF-RAY: 990eac9c9d3f6d08-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1761049812=rdeenGOu7oPbUjAiCKj7mQM/L2CZSERSb8B0wFuL8iAz8yGt/SZrwN9hzq//Jfkm2RgBtTQd0nDutTI6d6QWpAWOCgfp5dAbbfEI67TXctUIUufT2Gr4Y/EGVzH3Ds++pR5m1dg201x3t0V1APCXAY3Xdycq4n4xNiX+U+u5NzhLl7ERx+6lMbVyMrOoYSkT\r\nX-VIA: l1=YtspipsrEjkq0DXf\r\nX-VERSION: 1760857239\r\nX-Request-Id: 02D2D773-E6A1-4CCC-859D-0CAAA551D97D\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":329516,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"6349b4be3bf7b45da5cc14ac341cc9f2","sha1":"97362e5adce73ca7389eaf74b32958229efde267","sha256":"5684c9c66ee829f18a54d63c2ae5f50519c223e916778ac864e296f697e17647","sha512":"60dda27ed534d66d8de434fa683cdd74b9178abf1d703d8c215ce9955fec938bd79248b110e362b7a86d510203a749bb5584fa8ff660b009af7f492391c60fd1","ssdeep":"6144:QqXZESOr07UFOBtjljLtQ2n1WtWjmseQmOBzN7ivJNze:PKPr07kOBvtd1WAjgjOFN2m","tlshash":"f764233728e3d1be02e1f2b91098d5da0d3afc649795b3a3127699d80b9f9eb12030d5","first_seen":"2024-12-13T03:40:21.274372Z","last_seen":"2025-12-29T13:58:58.079672Z","times_seen":309,"resource_available":false,"data":null}},"time_used":4671,"timings":{"blocked":4151,"dns":0,"connect":0,"send":0,"wait":264,"receive":256,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-21","alert":"Sinkholed","trigger":"u65r.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.365live88.com/img/football/team/1014678eb5aa0c4d6419e9f67c3d069db2980?win007=sell","fqdn":"img.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"43.154.191.40","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://u65r.xyz/","date":"2025-10-21T12:30:07.520Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"img.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Wed, 26 Feb 2025 00:00:00 GMT","end":"Thu, 26 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:CE:52:90:B8:65:F0:FA:69:20:05:AE:F8:49:3C:7A:F3:75:B1:DE","sha256":"93:E9:48:53:64:5C:A3:29:88:2D:17:0E:C0:B6:9E:57:ED:61:0D:10:36:DE:E1:71:0D:41:6F:77:B1:E4:C4:0A"}}},"request":{"raw":"GET /img/football/team/1014678eb5aa0c4d6419e9f67c3d069db2980?win007=sell HTTP/1.1\r\nHost: img.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://u65r.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 21 Oct 2025 12:30:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 92007\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 0\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1014678eb5aa0c4d6419e9f67c3d069db2980\"; filename*=utf-8''1014678eb5aa0c4d6419e9f67c3d069db2980\r\ncontent-md5: eDYERcEvo/3ItIlIb/9Otg==\r\ncontent-transfer-encoding: binary\r\netag: \"FhbFh5IZFwNszmvnh8SGSihKrb82\"\r\nlast-modified: Wed, 06 Jul 2022 12:49:30 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:cdn-cache-dls-gddg1-dg-7;QNM3\r\nx-m-reqid: irKzxnLCo\r\nx-qiniu-zone: 2\r\nx-qnm-cache: Hit\r\nx-reqid: _6QAAABeGMRF2mYY\r\nx-svr: IO\r\nx-frame-options: Access-Control-Allow-Origin: *\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92007,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 294, 8-bit/color RGBA, non-interlaced","md5":"78360445c12fa3fdc8b489486fff4eb6","sha1":"16c587921917036cce6be787c4864a284aadbf36","sha256":"1b33fdd23b2a96104f1bd392fc286018a32df939e516995be9866faf5053e729","sha512":"8be14ba8c6fe41888a4cf86b004cc936afc97235f0981011bab7e8d252bb0075e855cf260f4bc5864bab4cf643c660fb147d4b85bceaef392e201c1049b53e5d","ssdeep":"1536:R61j/W7EZRxXtkv2k6Oe1nPYeWKC7bmQ9BBV5ppeLduP1gFzkjWTXefeSEt4ILG3:R6dAkRxWqhnggC7bnjNW+gFQaTJSvIq3","tlshash":"ed9312e463072c6bbf4a25595286c9beebaa3d21960c24f8cf654a5f3d83b4440c73e5","first_seen":"2025-01-29T13:39:14.662453Z","last_seen":"2026-08-09T17:07:42.834414Z","times_seen":125,"resource_available":false,"data":null}},"time_used":2999,"timings":{"blocked":1022,"dns":0,"connect":0,"send":0,"wait":836,"receive":1141,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}