{"report_id":"522a004c-f989-43ee-be15-060ef715f5e0","version":6,"status":"done","tags":[],"date":"2025-12-25T15:22:16Z","url":{"schema":"http","addr":"6688xyz.top/","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"172.67.129.226","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"6688xyz.top/","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"title":"BIG1 MD5 CASINO GAME","dom":{"size":13890,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (381)","md5":"59355656a25ac9a17ca192abf98ac9c8","sha1":"8bd1aa44f0ade3c0edfa6e0fae604d050f2fc3cd","sha256":"0c587a22cac76ef3c26be7da2583ea2e8cedc48137e2eb49a8fe8fec7807927d","sha512":"0324d3c1579c03b55dfd52c96c985302ac8ad9c2aede1c40d80c1f510eacfa62237ddcd3b061847518217f9c4f4277eabee22967ef5f2cc7d5ae16ece634b306","ssdeep":"192:6wBI+fRDCf99hxeKrYhruisnJYWuae7faX7iJe6JauhjCV0RPePSQW4KQ6C4hNGe:1llm5EOTum+ZF","tlshash":"b852c8496c96245732b370398bafb118b131c0275444cc24bdac8a94afd5bab9de77dc","dom_hash":"domhash90404c8b5c806b81d05d36c2445d2e05","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"6688xyz.top/","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"172.67.129.226","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-29T15:22:16Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-25","alert":"Sinkholed","trigger":"6688xyz.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"6688xyz.top","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":12,"request_count":13,"received_data":913261,"sent_data":6178,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"jQuery:3.6.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"epochu.matomo.cloud","ip":{"addr":"18.157.122.248","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"2017-09-08","domain_rank":0,"first_seen":"2025-12-25T15:22:17.531873Z","last_seen":"2025-12-25T15:22:17.531873Z","alert_count":0,"request_count":1,"received_data":231,"sent_data":781,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"www.googletagmanager.com","ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2025-12-21T22:17:33.83847Z","alert_count":0,"request_count":2,"received_data":867703,"sent_data":880,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"6688xyz.top/","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f7c8cf47646666df66c675a316ff6b71","sha1":"24c8fad0f0d1b462c37ca8ba089e1edc3b107eb5","sha256":"a1e23c2244086f73b6b3188c345ceb480e9e4f68bd2f192cc6cf42eb03122d0c","sha512":"a58b50255ed98aaaba7ac8dad32011315efa9b954a80fe87b3044e0c8280a45343eaebde65361d747948fbc408d32eb7f0b6a4b460ec70c6e19b2981c394a0de","ssdeep":"","tlshash":"85c02bcc210e0c7041f727408b3fb600b002332598d86932481a23044e30e03d758820","size":153,"data":"","first_seen":"2025-12-25T15:22:25.656224Z","last_seen":"2025-12-25T15:22:25.656224Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"aa3c32dfac05c3578f70324444eef61f","sha1":"4f0788c77dd8e596188273b630d6fd4d76b432ca","sha256":"8fea1dfeb1628554bbbb33f36e2979598fb99ade9bcb7dab1160757fac178c03","sha512":"b65a28f43eba31f8f2761e60f5c53b3bff1d120a7e6510e9f21f9f8ea750e834329255e7a5e44b4374298029e74d427e3cce45bf7a56a2712b412848ad72dc8c","ssdeep":"","tlshash":"eb11ab5c726a3cf011af267f175fab583a25148b2840d928fe1e8b491fa5f0869e08d9","size":1108,"data":"","first_seen":"2025-12-25T15:22:25.657343Z","last_seen":"2025-12-25T15:22:25.657343Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-8C3T08JMX4","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"569eec0b41b37c8ea27a54a403761ac0","sha1":"fee3bed9589aebca328a711b3a0fa85f1c6aa43c","sha256":"ea9c67e261b471015f2d0e89217aad005b2db475354c136d536fa49d96c24472","sha512":"d3dcbadba781fd1b5de305236fbbe5f316f74fb0f86162d3ac6b7083c17e4dc08b534734e5b2963cc5c813233d008d6d16165ed8a45c2eea762fd752b241b39b","ssdeep":"6144:K9Ie7ma2bulKY/1u99xHDmHYmyBFzvnsyRO6jJWoNPad4FpC1xY:HC8bu7/1mbrnsy39WbMpb","tlshash":"d6941ace73c674269396e078503f118ba57b29e2b45cc896f189cce42e7469a4237f7c","size":433247,"data":"","first_seen":"2025-12-25T15:22:25.632716Z","last_seen":"2025-12-25T15:22:25.632716Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"e38eedb627421b09ad8dd2e2e66204a4","sha1":"f11c3314aace04fccd6a10b17d04376500e9efcf","sha256":"3b61c13825f32e4a357863284f974aeeca1443c5480160d46da4991bab6a8275","sha512":"f9ef222fa4ee06714b2a5c24ce6c6d399a0743237b0513bf7b0a2297def8ba73f4c65855e08516847ef2974dc08fcf5bab0af4e8b291b59d91ab31de1fe4bd39","ssdeep":"","tlshash":"8811ce681c636455b7f92138c39b666937529b83a181c031b95c88e91fe099e48dbbcd","size":906,"data":"","first_seen":"2025-12-25T15:22:25.658786Z","last_seen":"2025-12-25T15:22:25.658786Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a1c2ddcf3bf6d40ba8070510c1181450","sha1":"7ac232d4e347ab660530a5f810f150fa53fa617f","sha256":"01883ee9223f61de27b5e6bdcf5aeaa40537adf6b370522c893325df99a49813","sha512":"bc49fe573d5761782d2a80fdb35f045422461951120f65348693830aaad06738da71dd90c39f37d87bff1d6dc8d55851d75193a7ad1a4c62c0a6837c3c09e002","ssdeep":"","tlshash":"26e026413cc80252b3a3246e123fa609b21684326051c416e9a9cdd8fe247d78e2a1dc","size":341,"data":"","first_seen":"2025-12-25T15:22:25.6599Z","last_seen":"2025-12-25T15:22:25.6599Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-EX3FKDF54F\u0026cx=c\u0026gtm=4e5ca1","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"6c09749013022426bc9d70dc142956f7","sha1":"a098dd22fc4def47119eb9b554ba0170eacc372c","sha256":"ca5efc315aac5b451e906fe9aea4d4eb9c5342fdef9b6c802144ee7012a2dcd8","sha512":"5473ef3bcd988ff8c6ded2d92901a71f50407f882c1ef6ebcfb2b14a6e629959631019f7e387a896f7d3e69e6f911cbdf7cadfafcfd8efb5de9e6fbd83db98ea","ssdeep":"6144:IvIe7ma2bulKY/1u99xHDmHYmyBFzvnsyRO6jJWoNPad4FpC1xY:NC8bu7/1mbrnsy39WbMpb","tlshash":"d2941ace73d674269396e078503f118ba57b29e2b45cc896f189cce02d74a9a4237f7c","size":433268,"data":"","first_seen":"2025-12-25T15:22:25.624204Z","last_seen":"2025-12-25T15:22:25.624204Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/AgentShareLink_files/jquery-3.6.0.min.js","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","size":89501,"data":"","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-04-04T04:41:25.448678Z","times_seen":444697,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4ce5cfcf2c187f807b8751640d239390","sha1":"7d17ee204f216b9dd861b1462b015f69713c48d2","sha256":"2676580a5be1fa91f511a7976bcad492c62159ce758bfd6e702c327c2df2db8c","sha512":"30a93ed55e946b7622984cba55e2c6597181ba1201ea1f9e672dce83925dfb381bd387da97b3af3e744ce76162eee5d107df1fd4440f7430888294e25ac96743","ssdeep":"96:vzrMW4KQYVC2VhjBGvSCoAQj00VOPUY2Uyq2O+fkCPbTMlqBJOkyf:bQW4KQ6C4hNGvSCo3j00Vhoyq2BsCPbM","tlshash":"d3c172ad6d6730966a67307e4f8f63187071c453280dcc247c0c92905fa627edaeabdc","size":6143,"data":"","first_seen":"2025-12-25T15:22:25.661058Z","last_seen":"2025-12-25T15:22:25.661058Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/AgentShareLink_files/container_zozHzNdv.js","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d296a9af1df4235db4ef1f87b05013ec","sha1":"eeeb349df71eac23e66ec80e4dd469cd3d1d2737","sha256":"4c081ef495345d5f8e36aa7fdddd0bfe424157c97911670d58934d1fda12462b","sha512":"475a633bc221a3b21e7f492737f5291161e7a2654e411a012712a509d72ab15cdd224b044d5ba6d91d0dce669a9c7b0e5e52d827167309b930aed9abc4ed5912","ssdeep":"3072:0cT+Z2fuULzsyWbbVdda8EbdAA0XvBv1QkNw0C1H8bTdaO0JlB8A:0cSUuULzszRdd8dngpv1HYH8bTdaOIlD","tlshash":"6104f78633c3757686ea6074543f1106b33a99ab244cc078f666d8e63d78e0e953bf78","size":177966,"data":"","first_seen":"2025-12-25T15:22:25.628966Z","last_seen":"2025-12-25T15:22:25.628966Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null},"http":[{"url":{"schema":"https","addr":"6688xyz.top/AgentShareLink_files/jquery-3.6.0.min.js","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://6688xyz.top/","date":"2025-12-25T15:21:54.410Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6688xyz.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 06:58:27 GMT","end":"Fri, 13 Feb 2026 07:56:03 GMT"},"fingerprint":{"sha1":"68:1E:2C:70:70:D3:57:87:DD:7F:D4:61:50:80:F2:00:01:07:EC:FA","sha256":"95:FA:D1:D3:71:54:DB:5D:FC:4F:B5:27:8E:3A:84:61:93:B6:4E:EF:76:C1:3C:3F:23:1F:A6:32:3A:8B:52:5A"}}},"request":{"raw":"GET /AgentShareLink_files/jquery-3.6.0.min.js HTTP/1.1\r\nHost: 6688xyz.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://6688xyz.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 25 Dec 2025 15:21:55 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 16 Feb 2025 08:38:47 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67b1a417-15d9d\"\r\nexpires: Fri, 26 Dec 2025 03:21:54 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uYSX2xXtJ8wW5bzutQY%2B95dU%2BUCisjz%2FZYRY8dnpSNaSgDNgf62kn79VKq5grEiqdKDPmSvV06UZ2e%2FLWeob2BtY6%2BwAbbEY8w%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b3954b2e91ab509-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":89501,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-04-04T04:41:25.448678Z","times_seen":444697,"resource_available":true,"data":null}},"time_used":850,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":847,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-25","alert":"Sinkholed","trigger":"6688xyz.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/AgentShareLink_files/style.css","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://6688xyz.top/","date":"2025-12-25T15:21:54.416Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6688xyz.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 06:58:27 GMT","end":"Fri, 13 Feb 2026 07:56:03 GMT"},"fingerprint":{"sha1":"68:1E:2C:70:70:D3:57:87:DD:7F:D4:61:50:80:F2:00:01:07:EC:FA","sha256":"95:FA:D1:D3:71:54:DB:5D:FC:4F:B5:27:8E:3A:84:61:93:B6:4E:EF:76:C1:3C:3F:23:1F:A6:32:3A:8B:52:5A"}}},"request":{"raw":"GET /AgentShareLink_files/style.css HTTP/1.1\r\nHost: 6688xyz.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://6688xyz.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 25 Dec 2025 15:21:54 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Sun, 16 Feb 2025 08:38:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67b1a41d-87b\"\r\nexpires: Fri, 26 Dec 2025 03:21:54 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=baiddeuu3sXgHSgyPBpHynMJZMjRu4bO9SyivyORs%2FlrlRWO5fx9xTCDjZEp9txuQOgysTE07reQlK4XpEhkori5scsmor5Fjw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b3954b2e91fb509-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2171,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"1516426789548f287ff9f51965892417","sha1":"132ff213ac1092772e8f1ff6213209ec887d8868","sha256":"679449d43f41712c22810608d4b679af10a254beef0147df7bbfdac05862cd1e","sha512":"902e287e44244432592a0f3ad594c72f7c8b83b766af064f9034d8d0347de6821975398419bfaa3a5c6746b5e9778df890cd00cdf8a465e817591b0af1125df4","ssdeep":"","tlshash":"1741f3715681ad2d945b5175b87627cc12398082a31f49fe7f3a32f8e1af09501367ba","first_seen":"2025-12-25T15:22:25.61899Z","last_seen":"2025-12-25T15:22:25.61899Z","times_seen":1,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-25","alert":"Sinkholed","trigger":"6688xyz.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/AgentShareLink_files/top_01.jpg","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://6688xyz.top/","date":"2025-12-25T15:21:54.419Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6688xyz.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 06:58:27 GMT","end":"Fri, 13 Feb 2026 07:56:03 GMT"},"fingerprint":{"sha1":"68:1E:2C:70:70:D3:57:87:DD:7F:D4:61:50:80:F2:00:01:07:EC:FA","sha256":"95:FA:D1:D3:71:54:DB:5D:FC:4F:B5:27:8E:3A:84:61:93:B6:4E:EF:76:C1:3C:3F:23:1F:A6:32:3A:8B:52:5A"}}},"request":{"raw":"GET /AgentShareLink_files/top_01.jpg HTTP/1.1\r\nHost: 6688xyz.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://6688xyz.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 25 Dec 2025 15:21:55 GMT\r\ncontent-type: image/jpeg\r\nserver: cloudflare\r\nlast-modified: Sun, 16 Feb 2025 08:38:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67b1a41e-1515b\"\r\nexpires: Sat, 24 Jan 2026 15:21:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1i7Z%2FRwqEpgPsl1BjQoZZAexTn3sth17OizNLrGOxI72sjKAs4Gi79jRXs5cJIYBH2sx4rvrqXG%2BgZkAPc9z60SKCA34OWdbgA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b3954b2f924b509-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":86363,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1125x217, components 3","md5":"dc957572ab70cd0c113af3803a42811b","sha1":"48821ac69368a650ca07e65db17dd5033590c151","sha256":"bbb007caa7578c8ab21c0a644c1dfd4883db9c745203251ad0ad9171c46b0262","sha512":"3a6566d23ce0318cb76e43e5cc45b662be9c51ece3bbcbc48a512ee05ebbcf6ac553a0277d0f15e87bec9ed008ba82b152b56b559fe44811a07838926d89737d","ssdeep":"1536:cRlq4zz8t1KylcFMRt0z6+4rljBAvJaDqUq53ikiUnDf+Tdy26i:so4zs1KylQMw9GVB4JmqUq5LiUnr+TdT","tlshash":"dd83c01ee13bd4d44c5e53aed4b198cf29b02fb992e2f84a02849b3a74cc156f911c9d","first_seen":"2025-12-25T15:22:25.620381Z","last_seen":"2025-12-25T15:22:25.620381Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1005,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":806,"receive":199,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-25","alert":"Sinkholed","trigger":"6688xyz.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/AgentShareLink_files/top_02.jpg","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://6688xyz.top/","date":"2025-12-25T15:21:54.420Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6688xyz.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 06:58:27 GMT","end":"Fri, 13 Feb 2026 07:56:03 GMT"},"fingerprint":{"sha1":"68:1E:2C:70:70:D3:57:87:DD:7F:D4:61:50:80:F2:00:01:07:EC:FA","sha256":"95:FA:D1:D3:71:54:DB:5D:FC:4F:B5:27:8E:3A:84:61:93:B6:4E:EF:76:C1:3C:3F:23:1F:A6:32:3A:8B:52:5A"}}},"request":{"raw":"GET /AgentShareLink_files/top_02.jpg HTTP/1.1\r\nHost: 6688xyz.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://6688xyz.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 25 Dec 2025 15:21:55 GMT\r\ncontent-type: image/jpeg\r\nserver: cloudflare\r\nlast-modified: Sun, 16 Feb 2025 08:38:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67b1a415-17c88\"\r\nexpires: Sat, 24 Jan 2026 15:21:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dyTpUGZjAIfXCKSF18IS11p4ZkagWAtH7LmFHBsxYfutQN1huNUlgLqapqL2hQjuQo98rMEmYfVKqDV0A3pRCH7QJM7kHefInQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b3954b2f927b509-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":97416,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 23.5 (Windows), datetime=2025:01:02 11:25:16], progressive, precision 8, 1125x429, components 3","md5":"b56681836fc4ee4a97ccf6853617e768","sha1":"b75635736d863800fa10dc4fa7d918edaee04d95","sha256":"f894fd8030a55e56cdc451fc670f886da87bff745237774974d6a339eff7a40a","sha512":"ca30c3061ecb1225bd405d05b1ccd16f334bb595a4a496a49799bb076bab82d2706fb713a266196a632c3badb41081e79cb8e1153087f6f1a419f821792d0146","ssdeep":"1536:cmzGomzGFT5CLPZJa15EuB/4sDUtM5mqcH5C32QkTUDzVr/LAKT:K+O1JcwsDUtM5mVH0mQkIDB5T","tlshash":"e893015ddfc2df06f7c81177518ac31f2a52aa0ca8a31292749f35427b712f6ea7e409","first_seen":"2025-12-25T15:22:25.621562Z","last_seen":"2025-12-25T15:22:25.621562Z","times_seen":1,"resource_available":false,"data":null}},"time_used":947,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":757,"receive":190,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-25","alert":"Sinkholed","trigger":"6688xyz.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/AgentShareLink_files/googleseo.png?id=3434","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://6688xyz.top/","date":"2025-12-25T15:21:54.424Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6688xyz.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 06:58:27 GMT","end":"Fri, 13 Feb 2026 07:56:03 GMT"},"fingerprint":{"sha1":"68:1E:2C:70:70:D3:57:87:DD:7F:D4:61:50:80:F2:00:01:07:EC:FA","sha256":"95:FA:D1:D3:71:54:DB:5D:FC:4F:B5:27:8E:3A:84:61:93:B6:4E:EF:76:C1:3C:3F:23:1F:A6:32:3A:8B:52:5A"}}},"request":{"raw":"GET /AgentShareLink_files/googleseo.png?id=3434 HTTP/1.1\r\nHost: 6688xyz.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://6688xyz.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 25 Dec 2025 15:21:55 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nlast-modified: Thu, 15 May 2025 02:59:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68255891-39756\"\r\nexpires: Sat, 24 Jan 2026 15:21:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FXNoZ4lcO2E8ktirXhR1tzyWUBjYINGRZerDqxaAYcqy7aounowYEJWxxefGtf0MOZe7lc3aOWLDOtqt1SXPqhBJlimExnGY1w%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b3954b30934b509-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":235350,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 548, 8-bit colormap, non-interlaced","md5":"bb80f158819732cc4c5644b0ce1b6287","sha1":"1f7dc7d96d0b08e505a7a89af94b0bdb9a1537c2","sha256":"ff8a40b74d46478c26faab8a3fca78d6364980b97f0585253fd3baa64b900c2d","sha512":"c7e73fc0568cd72a54df4caf635580f0b5102fab2d147a4e422dcbbd4c0e486dbf75f32023d25386b7c87a61a52b06e78d0c58a07817f2330c5c9797105bed28","ssdeep":"6144:M+Fo7eRz8mVh0QGJLJ1pbHShxOX6V9MyYj:jVh0JJr6xlzO","tlshash":"373423875101702dabfb01168148faf44d769d32be2f75dc495e66c363907a22ad03ef","first_seen":"2025-12-25T15:22:25.622625Z","last_seen":"2025-12-25T15:22:25.622625Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1474,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":846,"receive":628,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"epochu.matomo.cloud/matomo.php?action_name=BIG1%20MD5%20CASINO%20GAME\u0026idsite=30\u0026rec=1\u0026r=003813\u0026h=15\u0026m=21\u0026s=56\u0026url=https%3A%2F%2F6688xyz.top%2F\u0026_id=3e41689f15712bbb\u0026_idn=1\u0026send_image=0\u0026_refts=0\u0026pv_id=ExOERE\u0026pf_net=349\u0026pf_srv=615\u0026pf_tfr=1\u0026pf_dm1=1008\u0026uadata=%7B%7D\u0026pdf=1\u0026qt=0\u0026realp=0\u0026wma=0\u0026fla=0\u0026java=0\u0026ag=0\u0026cookie=1\u0026res=1280x1024","fqdn":"epochu.matomo.cloud","domain":"matomo.cloud","tld":"cloud"},"ip":{"addr":"18.157.122.248","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://6688xyz.top/","date":"2025-12-25T15:21:56.297Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.matomo.cloud","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M02","organization":"Amazon"},"validity":{"start":"Mon, 21 Apr 2025 00:00:00 GMT","end":"Wed, 20 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"20:11:4C:63:17:FD:99:09:3C:43:B7:CC:E0:3C:3D:1B:68:53:F3:19","sha256":"B0:CB:AA:8B:5C:DE:18:64:46:50:8B:3C:EF:2F:F8:94:E6:C3:D9:44:13:32:41:13:29:76:AB:D1:5A:E1:A0:1C"}}},"request":{"raw":"POST /matomo.php?action_name=BIG1%20MD5%20CASINO%20GAME\u0026idsite=30\u0026rec=1\u0026r=003813\u0026h=15\u0026m=21\u0026s=56\u0026url=https%3A%2F%2F6688xyz.top%2F\u0026_id=3e41689f15712bbb\u0026_idn=1\u0026send_image=0\u0026_refts=0\u0026pv_id=ExOERE\u0026pf_net=349\u0026pf_srv=615\u0026pf_tfr=1\u0026pf_dm1=1008\u0026uadata=%7B%7D\u0026pdf=1\u0026qt=0\u0026realp=0\u0026wma=0\u0026fla=0\u0026java=0\u0026ag=0\u0026cookie=1\u0026res=1280x1024 HTTP/1.1\r\nHost: epochu.matomo.cloud\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\r\nContent-Length: 0\r\nOrigin: https://6688xyz.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://6688xyz.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\ndate: Thu, 25 Dec 2025 15:21:56 GMT\r\nserver: nginx\r\naccess-control-allow-origin: https://6688xyz.top\r\naccess-control-allow-credentials: true\r\ncross-origin-resource-policy: cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T04:46:10.842589Z","times_seen":13317089,"resource_available":true,"data":null}},"time_used":875,"timings":{"blocked":385,"dns":65,"connect":21,"send":0,"wait":86,"receive":12,"ssl":303},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-EX3FKDF54F\u0026cx=c\u0026gtm=4e5ca1","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://6688xyz.top/","date":"2025-12-25T15:21:54.906Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:49:40 GMT","end":"Wed, 25 Feb 2026 15:49:39 GMT"},"fingerprint":{"sha1":"A1:49:37:FE:E0:3E:26:88:A3:64:37:DC:04:D7:8D:D1:D3:F3:91:75","sha256":"BB:61:22:1A:6C:67:5D:C0:C8:A6:73:93:B9:53:82:98:95:54:B5:52:8B:33:FC:08:58:01:D2:3B:FF:E6:35:12"}}},"request":{"raw":"GET /gtag/js?id=G-EX3FKDF54F\u0026cx=c\u0026gtm=4e5ca1 HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://6688xyz.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Thu, 25 Dec 2025 15:21:54 GMT\r\nexpires: Thu, 25 Dec 2025 15:21:54 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 143297\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":433268,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6031)","md5":"6c09749013022426bc9d70dc142956f7","sha1":"a098dd22fc4def47119eb9b554ba0170eacc372c","sha256":"ca5efc315aac5b451e906fe9aea4d4eb9c5342fdef9b6c802144ee7012a2dcd8","sha512":"5473ef3bcd988ff8c6ded2d92901a71f50407f882c1ef6ebcfb2b14a6e629959631019f7e387a896f7d3e69e6f911cbdf7cadfafcfd8efb5de9e6fbd83db98ea","ssdeep":"6144:IvIe7ma2bulKY/1u99xHDmHYmyBFzvnsyRO6jJWoNPad4FpC1xY:NC8bu7/1mbrnsy39WbMpb","tlshash":"d2941ace73d674269396e078503f118ba57b29e2b45cc896f189cce02d74a9a4237f7c","first_seen":"2025-12-25T15:22:25.624204Z","last_seen":"2025-12-25T15:22:25.624204Z","times_seen":1,"resource_available":true,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/AgentShareLink_files/container_zozHzNdv.js","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://6688xyz.top/","date":"2025-12-25T15:21:55.292Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6688xyz.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 06:58:27 GMT","end":"Fri, 13 Feb 2026 07:56:03 GMT"},"fingerprint":{"sha1":"68:1E:2C:70:70:D3:57:87:DD:7F:D4:61:50:80:F2:00:01:07:EC:FA","sha256":"95:FA:D1:D3:71:54:DB:5D:FC:4F:B5:27:8E:3A:84:61:93:B6:4E:EF:76:C1:3C:3F:23:1F:A6:32:3A:8B:52:5A"}}},"request":{"raw":"GET /AgentShareLink_files/container_zozHzNdv.js HTTP/1.1\r\nHost: 6688xyz.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://6688xyz.top/\r\nCookie: _ga_8C3T08JMX4=GS2.1.s1766676114$o1$g0$t1766676114$j60$l0$h0; _ga=GA1.1.1304800034.1766676115; _ga_EX3FKDF54F=GS2.1.s1766676115$o1$g0$t1766676115$j60$l0$h0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 25 Dec 2025 15:21:56 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nlast-modified: Sun, 16 Feb 2025 08:38:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67b1a41b-2b72e\"\r\nexpires: Fri, 26 Dec 2025 03:21:55 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gBdjtXXbvnfAOpcjco%2FUsER3r4MxrcelWMPkF3XIf7SoX9mg6a2%2B1sF%2FNrATC9RzlJECnJVYbXJICr%2FsOyn3JMPCvtpshuctVQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b3954b89efbb509-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":177966,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2854)","md5":"d296a9af1df4235db4ef1f87b05013ec","sha1":"eeeb349df71eac23e66ec80e4dd469cd3d1d2737","sha256":"4c081ef495345d5f8e36aa7fdddd0bfe424157c97911670d58934d1fda12462b","sha512":"475a633bc221a3b21e7f492737f5291161e7a2654e411a012712a509d72ab15cdd224b044d5ba6d91d0dce669a9c7b0e5e52d827167309b930aed9abc4ed5912","ssdeep":"3072:0cT+Z2fuULzsyWbbVdda8EbdAA0XvBv1QkNw0C1H8bTdaO0JlB8A:0cSUuULzszRdd8dngpv1HYH8bTdaOIlD","tlshash":"6104f78633c3757686ea6074543f1106b33a99ab244cc078f666d8e63d78e0e953bf78","first_seen":"2025-12-25T15:22:25.628966Z","last_seen":"2025-12-25T15:22:25.628966Z","times_seen":1,"resource_available":true,"data":null}},"time_used":959,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":768,"receive":191,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-25","alert":"Sinkholed","trigger":"6688xyz.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/AgentShareLink_files/favicon.ico","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://6688xyz.top/","date":"2025-12-25T15:21:55.631Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6688xyz.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 06:58:27 GMT","end":"Fri, 13 Feb 2026 07:56:03 GMT"},"fingerprint":{"sha1":"68:1E:2C:70:70:D3:57:87:DD:7F:D4:61:50:80:F2:00:01:07:EC:FA","sha256":"95:FA:D1:D3:71:54:DB:5D:FC:4F:B5:27:8E:3A:84:61:93:B6:4E:EF:76:C1:3C:3F:23:1F:A6:32:3A:8B:52:5A"}}},"request":{"raw":"GET /AgentShareLink_files/favicon.ico HTTP/1.1\r\nHost: 6688xyz.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://6688xyz.top/\r\nCookie: _ga_8C3T08JMX4=GS2.1.s1766676114$o1$g0$t1766676114$j60$l0$h0; _ga=GA1.1.1304800034.1766676115; _ga_EX3FKDF54F=GS2.1.s1766676115$o1$g0$t1766676115$j60$l0$h0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 25 Dec 2025 15:21:56 GMT\r\ncontent-type: image/x-icon\r\nserver: cloudflare\r\nlast-modified: Sun, 16 Feb 2025 08:38:52 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KIYB6LlZJXJf99j453q38wImRwWp0dl9EoZMx237UPHkhX2gjHNius0Nce6XrE9mNu%2F3Mm6eAuacUJBoCRtBIf1bF6rYdtHi1Q%3D%3D\"}]}\r\netag: W/\"67b1a41c-10be\"\r\ncontent-encoding: br\r\ncf-ray: 9b3954baa8d9b509-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4286,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"f0199ee8e44cf8baf34fff347992f3dd","sha1":"0cf30ed4dcbc0bc5a0b037298276e7f7f94b2c26","sha256":"fd911c2902e9135e46e21111c61030602eeb5842b60a00b94c6c89e44c81da5c","sha512":"66639671298c28eeb87f6956417700efab8724fcc5ae4623d656c87fc6adf2ac9b4c48d6a4a22f2e064139aec712c940ce7027c02120a89f1d01b91013b8030d","ssdeep":"96:H4omyiqdqKCaj2Pn00j8Fbp7AVxCitT3daavCXYVTvUlxUj8VOjl/n:OyiMdCO2s0QujntTbvtAUnjl","tlshash":"16914d1e1e65fb58e6296a757c4fc2b00f5ded073f4791d324247bd39e29b922b0600a","first_seen":"2025-12-25T15:22:25.631475Z","last_seen":"2025-12-25T15:22:25.631475Z","times_seen":1,"resource_available":false,"data":null}},"time_used":592,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":592,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-25","alert":"Sinkholed","trigger":"6688xyz.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-8C3T08JMX4","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://6688xyz.top/","date":"2025-12-25T15:21:54.404Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:49:40 GMT","end":"Wed, 25 Feb 2026 15:49:39 GMT"},"fingerprint":{"sha1":"A1:49:37:FE:E0:3E:26:88:A3:64:37:DC:04:D7:8D:D1:D3:F3:91:75","sha256":"BB:61:22:1A:6C:67:5D:C0:C8:A6:73:93:B9:53:82:98:95:54:B5:52:8B:33:FC:08:58:01:D2:3B:FF:E6:35:12"}}},"request":{"raw":"GET /gtag/js?id=G-8C3T08JMX4 HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://6688xyz.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Thu, 25 Dec 2025 15:21:54 GMT\r\nexpires: Thu, 25 Dec 2025 15:21:54 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 143175\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":433247,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6031)","md5":"569eec0b41b37c8ea27a54a403761ac0","sha1":"fee3bed9589aebca328a711b3a0fa85f1c6aa43c","sha256":"ea9c67e261b471015f2d0e89217aad005b2db475354c136d536fa49d96c24472","sha512":"d3dcbadba781fd1b5de305236fbbe5f316f74fb0f86162d3ac6b7083c17e4dc08b534734e5b2963cc5c813233d008d6d16165ed8a45c2eea762fd752b241b39b","ssdeep":"6144:K9Ie7ma2bulKY/1u99xHDmHYmyBFzvnsyRO6jJWoNPad4FpC1xY:HC8bu7/1mbrnsy39WbMpb","tlshash":"d6941ace73c674269396e078503f118ba57b29e2b45cc896f189cce42e7469a4237f7c","first_seen":"2025-12-25T15:22:25.632716Z","last_seen":"2025-12-25T15:22:25.632716Z","times_seen":1,"resource_available":true,"data":null}},"time_used":486,"timings":{"blocked":161,"dns":0,"connect":31,"send":0,"wait":57,"receive":83,"ssl":151},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/AgentShareLink_files/Agentsharestyle.css","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://6688xyz.top/","date":"2025-12-25T15:21:54.414Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6688xyz.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 06:58:27 GMT","end":"Fri, 13 Feb 2026 07:56:03 GMT"},"fingerprint":{"sha1":"68:1E:2C:70:70:D3:57:87:DD:7F:D4:61:50:80:F2:00:01:07:EC:FA","sha256":"95:FA:D1:D3:71:54:DB:5D:FC:4F:B5:27:8E:3A:84:61:93:B6:4E:EF:76:C1:3C:3F:23:1F:A6:32:3A:8B:52:5A"}}},"request":{"raw":"GET /AgentShareLink_files/Agentsharestyle.css HTTP/1.1\r\nHost: 6688xyz.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://6688xyz.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 25 Dec 2025 15:21:54 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Sun, 16 Feb 2025 08:38:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67b1a41d-119e\"\r\nexpires: Fri, 26 Dec 2025 03:21:54 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vzmWbs3oLjH3UJkT8PiiuqGDgVEm6tmF7YMmN%2B87x%2BL6NBge%2BNowAFVOVBXDmFz65g2Wlbojm3r4iOmxPutaDpiDvpq%2B%2FNIQ3g%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b3954b2e91cb509-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4510,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"6e7a6d459b7f60b4ea050e0af876d530","sha1":"7bd46a03c209925cfddd5a8f83feffa1eb3c8132","sha256":"1b40df9be28fe93606aa7d70aff9ed6b61e4b929ebfce9ee6465f1ad691c796c","sha512":"fbf1eff188a68f4d925b49ed3eef0b7a6b89294e64e4bacf9e8c2374b6b610581ee1be27efa95a99658de402a7a9f1e3b309cf74ac6aba1b5df4e37add2312f3","ssdeep":"96:4CQzq/n06j2N40mg9CFrN94blj/bAERn2yuV+5JMrU9Z:RQ6n0v40mg92N94blj/bAERn2zgYU9Z","tlshash":"d7917404c5013241b536c5783bb64e6afa24409fcf8265ec3fc95ab48ff55b886a1fda","first_seen":"2025-12-25T15:22:25.633761Z","last_seen":"2025-12-25T15:22:25.633761Z","times_seen":1,"resource_available":false,"data":null}},"time_used":606,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":606,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-25","alert":"Sinkholed","trigger":"6688xyz.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/AgentShareLink_files/top_07.webp","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://6688xyz.top/","date":"2025-12-25T15:21:54.426Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6688xyz.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 06:58:27 GMT","end":"Fri, 13 Feb 2026 07:56:03 GMT"},"fingerprint":{"sha1":"68:1E:2C:70:70:D3:57:87:DD:7F:D4:61:50:80:F2:00:01:07:EC:FA","sha256":"95:FA:D1:D3:71:54:DB:5D:FC:4F:B5:27:8E:3A:84:61:93:B6:4E:EF:76:C1:3C:3F:23:1F:A6:32:3A:8B:52:5A"}}},"request":{"raw":"GET /AgentShareLink_files/top_07.webp HTTP/1.1\r\nHost: 6688xyz.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://6688xyz.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 25 Dec 2025 15:21:55 GMT\r\ncontent-type: image/webp\r\ncontent-length: 54624\r\nserver: cloudflare\r\nlast-modified: Sun, 16 Feb 2025 08:38:49 GMT\r\netag: \"67b1a419-d560\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=l5Rhs1RF7n1r8bHqL0K6V4DzP1b73e%2BpqP9eydARMNvJkUKxBdjWWPmOuicfqitvX3FuODEoqHFE%2Fgh6TgJh9rVaV%2FJMASeQzw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b3954b30939b509-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":54624,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"93aa6d1607c9b4252346bdb3174181db","sha1":"b315553d6f4f0b4b958a6737826caff81fe40cf9","sha256":"f22214742f81902983c3d19cdc7b2dce48d1f48a05df164f36bd84a0e615397f","sha512":"7357bdb67434d2659e7aee880b82544b755fd7b62d5ae254642d53ad0b10f1829da9d65b50a37ad5148e2c177ba10855f53a3657cde89a55180497f3caafff4b","ssdeep":"1536:vgBsVX7aUc9dH4OVYdXTfz0X27VjnFAbxD+8/ot6Zs/QO:v6cX7aUc9d4MgXTfJxjnFAxIus/QO","tlshash":"533302cb5d40253bc1a82250c2bcb7ab26e5bd2a3f0a0b7c6e9053b7b5d9754dc1c61b","first_seen":"2025-12-25T15:22:25.641955Z","last_seen":"2025-12-25T15:22:25.641955Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1024,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":618,"receive":406,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-25","alert":"Sinkholed","trigger":"6688xyz.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-25T15:21:53.247Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6688xyz.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 06:58:27 GMT","end":"Fri, 13 Feb 2026 07:56:03 GMT"},"fingerprint":{"sha1":"68:1E:2C:70:70:D3:57:87:DD:7F:D4:61:50:80:F2:00:01:07:EC:FA","sha256":"95:FA:D1:D3:71:54:DB:5D:FC:4F:B5:27:8E:3A:84:61:93:B6:4E:EF:76:C1:3C:3F:23:1F:A6:32:3A:8B:52:5A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 6688xyz.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 25 Dec 2025 15:21:54 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Sun, 16 Nov 2025 15:02:26 GMT\r\nvary: Accept-Encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3VrTybntvSMcFGgPJOOPNHYFO8luKOpX563YBYumK%2FwuvQcOxEs4Sw5RC4%2Fuj37Z2ptSh%2BdLya8b3K8A89crUpQz1Qd5FaDpCA%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9b3954adfe9856a9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"jQuery:3.6.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13689,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"8f866a9e79741d5c1d628cc2035eba75","sha1":"20c4870c1c504e61b9c6115705afa58d2d99a110","sha256":"2cfa7e6f90f31d9a3edc69a544b95d66f318acfd918320fa2f664465bce5be01","sha512":"35bda0fd3696c1e7bd88b0a015f7f3d8362b232fe2abac814e44e8e2d429ca604264fa8550184ee236695e4433cb9bfad34d438313f65fa6a7f20c8ca7044646","ssdeep":"192:AWVR73f99hxeKIl0hosnJYWuae7faX7iJe6JauhjCV0RPePSQW4KQ6C4hNGvSCo9:AG2UjTum+ZEu","tlshash":"7f52c8496c96245732b360398b9fb218b231c0271444cc24bdac8a949fe5faaddf77dc","first_seen":"2025-12-25T15:22:25.643367Z","last_seen":"2025-12-25T15:22:25.643367Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1311,"timings":{"blocked":348,"dns":325,"connect":1,"send":0,"wait":615,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-25","alert":"Sinkholed","trigger":"6688xyz.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/AgentShareLink_files/btn.css","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://6688xyz.top/","date":"2025-12-25T15:21:54.417Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6688xyz.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 06:58:27 GMT","end":"Fri, 13 Feb 2026 07:56:03 GMT"},"fingerprint":{"sha1":"68:1E:2C:70:70:D3:57:87:DD:7F:D4:61:50:80:F2:00:01:07:EC:FA","sha256":"95:FA:D1:D3:71:54:DB:5D:FC:4F:B5:27:8E:3A:84:61:93:B6:4E:EF:76:C1:3C:3F:23:1F:A6:32:3A:8B:52:5A"}}},"request":{"raw":"GET /AgentShareLink_files/btn.css HTTP/1.1\r\nHost: 6688xyz.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://6688xyz.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 25 Dec 2025 15:21:55 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nlast-modified: Sun, 16 Feb 2025 08:38:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67b1a41a-53a1\"\r\nexpires: Fri, 26 Dec 2025 03:21:54 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eGZUj0J4h7dY46qjBw2UU%2BUHQOp7I7k0ncFxUVSzzJjGUevQs%2FOmsD0ubZp3IFWru1YQaO9IdNQ0F%2BjqlpiaB2QeRg%2BZJmWZ2g%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b3954b2e921b509-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21409,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"080d0069ab4eda78c1180c853d02b5b5","sha1":"9cf3c56285712d3d067e75f53763879789460728","sha256":"4bcac2f0b7439296320382dd11f1819e5929b11f233f6200483f3062b07f90ae","sha512":"807dc322a867de5fc74a0d8b0dde84ffcf5062cf8a4cde2d4d8f574bee925e3f6ef0bd52939b87e9817455bed4aa47bbb719032da0ae7ba7b65f809247fd9c05","ssdeep":"192:fFJ/nwQWZLFFf8RPGSxEjOoxI0/RF/NliyoJyaw8d:fFyFfr9jF1RF/NlSyaw8d","tlshash":"87a2de78998aa829b237c4e99d12a50dd758855bec07cf6cc3fab5ecbf311d0406f852","first_seen":"2025-12-25T15:22:25.644493Z","last_seen":"2025-12-25T15:22:25.644493Z","times_seen":1,"resource_available":false,"data":null}},"time_used":626,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":626,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-25","alert":"Sinkholed","trigger":"6688xyz.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/AgentShareLink_files/top_03.jpg","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://6688xyz.top/","date":"2025-12-25T15:21:54.421Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6688xyz.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 06:58:27 GMT","end":"Fri, 13 Feb 2026 07:56:03 GMT"},"fingerprint":{"sha1":"68:1E:2C:70:70:D3:57:87:DD:7F:D4:61:50:80:F2:00:01:07:EC:FA","sha256":"95:FA:D1:D3:71:54:DB:5D:FC:4F:B5:27:8E:3A:84:61:93:B6:4E:EF:76:C1:3C:3F:23:1F:A6:32:3A:8B:52:5A"}}},"request":{"raw":"GET /AgentShareLink_files/top_03.jpg HTTP/1.1\r\nHost: 6688xyz.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://6688xyz.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 25 Dec 2025 15:21:55 GMT\r\ncontent-type: image/jpeg\r\nserver: cloudflare\r\nlast-modified: Sun, 16 Feb 2025 08:38:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67b1a414-17cd8\"\r\nexpires: Sat, 24 Jan 2026 15:21:54 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U2qxVSI4TnkaacbbwfSQ7uTfob9iv2Tg6q6%2FZRPEySWzuZMcVI9%2BawCmk4PHeP8a5tPTHF0Go7l1PohSkzKhvl7gQrPnHvrJCA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b3954b2f929b509-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":97496,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=389, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=1125], progressive, precision 8, 1125x389, components 3","md5":"b1902f35b26ca6e460a37e21eaf6cf9e","sha1":"78b23464e3d09388632f176dd2974426f51e924c","sha256":"38e4ab2cf9bfbdf9a43b67053e655569cffbc55995eb9f46da816acfba92d2ce","sha512":"776a57ee45eecd43af34636373395f64a8f4d833655a0a909cf5909bfdb3c637ba35ebb6770cc403dc534dbf03889f780f5b28399082d7a4049545480112f0db","ssdeep":"1536:PwvMwvVsN1wO9xxRHQ6o6NVoCe7jLai6ijCfDIED/7dqG71eKdK2MCs5qhoQE5o:P9lH1HHEjOi6ij0Z7d/1e7NoEG","tlshash":"0593f11dc7a59e72fdc45b75a8ebe0b58721ddc05b9368423ccd60897fb52948c08a8f","first_seen":"2025-12-25T15:22:25.649997Z","last_seen":"2025-12-25T15:22:25.649997Z","times_seen":1,"resource_available":false,"data":null}},"time_used":993,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":795,"receive":198,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-25","alert":"Sinkholed","trigger":"6688xyz.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"6688xyz.top/AgentShareLink_files/top_04_new.webp","fqdn":"6688xyz.top","domain":"6688xyz.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://6688xyz.top/","date":"2025-12-25T15:21:54.422Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6688xyz.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 06:58:27 GMT","end":"Fri, 13 Feb 2026 07:56:03 GMT"},"fingerprint":{"sha1":"68:1E:2C:70:70:D3:57:87:DD:7F:D4:61:50:80:F2:00:01:07:EC:FA","sha256":"95:FA:D1:D3:71:54:DB:5D:FC:4F:B5:27:8E:3A:84:61:93:B6:4E:EF:76:C1:3C:3F:23:1F:A6:32:3A:8B:52:5A"}}},"request":{"raw":"GET /AgentShareLink_files/top_04_new.webp HTTP/1.1\r\nHost: 6688xyz.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://6688xyz.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Thu, 25 Dec 2025 15:21:55 GMT\r\ncontent-type: image/webp\r\ncontent-length: 18860\r\nserver: cloudflare\r\nlast-modified: Sun, 16 Feb 2025 08:38:48 GMT\r\netag: \"67b1a418-49ac\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QFDwZ%2Fi%2BWgLXPJRgL5fGjH5KIo2i4sdQO8QhcipcmpqtUOSlSn6s0zfeDEUdP82kC07dvjDw7mmbs%2BBNNqjqGQJ0Je2iuR3hGw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b3954b2f92bb509-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18860,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"877a5ae614a522eb4e1387df17d54a6c","sha1":"0d6e99248e4573d487c3f9137777e926c3147e75","sha256":"4b7c9f646bd3287a21eae22d6c7fcb517dc3519bd7be60b3dc99f35ec2367bd3","sha512":"9cb6176b8b247dc45d8cd2d7284dcf123ff8277e0e91cf2b7e3fbbc8fcda7e1fafa7458299d6cd0dd882ec5c1d34adcb611c2b9494a1d926a2c711bd07e13d17","ssdeep":"384:E79e2smuWucUl16svjdLbFg8UR5G/sY2uUf7A9EQcNbY8zZsymRJ144F+73mn2R3:w9e2VuWVMEsbdLoRSkuUQEQQbY8zWywg","tlshash":"7182d0692e75b8afccf31e7834e1a61675ab8f0cfc04a5c174442555b726e698bc308e","first_seen":"2025-12-25T15:22:25.654386Z","last_seen":"2025-12-25T15:22:25.654386Z","times_seen":1,"resource_available":false,"data":null}},"time_used":837,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":630,"receive":207,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-25","alert":"Sinkholed","trigger":"6688xyz.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}